Sijka Builder Fee Approval

A single static page that lets Sijka copy-trade users authorize a Hyperliquid builder fee for our address with one wallet signature. Live at https://approve.sijka.xyz.

---

What this page does

1. Detects installed wallets (MetaMask, OKX, Rabby, Phantom, Coinbase, Trust, …) via the EIP-6963 browser standard — works with multiple wallets installed at once.
2. After you pick a wallet, builds an EIP-712 typed-data message asking you to approve a maximum builder fee of 0.025% for the Sijka builder address (0xff4bb12c1ae22220ed7a8771d2d128c25ca1c4ef).
3. Sends the signed message to Hyperliquid (api.hyperliquid.xyz/exchange).
4. Verifies via the public maxBuilderFee info endpoint that the approval was recorded by HL.

What the signature does (and does NOT) authorize

✓ Authorizes: Sijka takes up to 0.025% of each order's notional as a builder fee when it routes a copy-trade order on your behalf. HL hard-caps at this rate — any order attempting to charge more is rejected by HL.

✗ Does NOT authorize:

• Withdrawal of any funds
• Transfer of any assets
• Trading on your behalf outside of copy-trade signals
• Access to your private keys
• Anything beyond the 0.025% fee cap above

It's an off-chain EIP-712 signature — no gas, no on-chain transaction.

Revoking

Open https://app.hyperliquid.xyz/builderCodes with the same wallet you used to approve, find Sijka in the list, click Remove. Effective immediately — HL will reject any subsequent order from us that tries to charge a fee.

Security model

The page is plain static HTML + vanilla JS (~250 lines), no React, no Vite, no @nktkas/hyperliquid SDK, no viem, no wagmi. Auditable in five minutes. The signature is computed and submitted entirely in your browser — neither the page server (Caddy on approve.sijka.xyz) nor any third party ever sees your private key, your signature, or the payload.

Hardening on the page

• No external script sources. Tailwind is self-hosted (single file in this repo, see verify-tailwind below); CSP script-src 'self' 'unsafe-eval' blocks any third-party JS from running.
• Strict Content Security Policy — only api.hyperliquid.xyz is reachable by fetch from this origin; everything else is blocked at the CSP layer.
• No 'unsafe-inline' for scripts — every JS file is loaded as an external resource with a known origin.
• X-Frame-Options: DENY — can't be embedded in an iframe (no clickjacking).
• HSTS preloaded — max-age=63072000; preload.
• security.txt at /.well-known/security.txt (RFC 9116) — contact for security reports.

Hardening at the infrastructure layer (production deployment)

• Domain proxied through Cloudflare (Full Strict TLS).
• Origin TLS uses a Cloudflare Origin Certificate (15-year validity).
• Origin firewall (ufw) accepts 80/443 only from Cloudflare IP ranges — the origin IP cannot be reached directly, every request goes through CF.

Verifiable build — file hash manifest

Every served file has a deterministic SHA-256. Compare what your browser loaded against what's committed in this repo; mismatches mean tampering.

File	SHA-256
index.html	4a1fc10f0d6879a8a685f7f9efc630156cc445993f03994c9c1ad7a3c25b103a
app.js	376e7f57c3a4787a4b19103681e846d6097c343a37a82f91da084ebbf47f1ca6
styles.css	9ceaf7a521958e7c620c88b1807e3a659b338f5721875d2e77f1780042f70a45
tailwind-config.js	69ff354b5df04e79bebf75c625429ad50dd35da217183c910883dc69cbfde824
tailwind.js	3f81aa7f6ecdb1acc14c202e513dfee00b6c7703cd81ce1be25bf5215a92e8cb
security.txt	1cfa002052c3ef67aa39086218ed8ae096afd1b3bd407dbc787c675b5fd7840f

Verify what's currently served against this manifest:

curl -s https://approve.sijka.xyz/index.html         | sha256sum
curl -s https://approve.sijka.xyz/app.js             | sha256sum
curl -s https://approve.sijka.xyz/styles.css         | sha256sum
curl -s https://approve.sijka.xyz/tailwind-config.js | sha256sum
curl -s https://approve.sijka.xyz/tailwind.js        | sha256sum
curl -s https://approve.sijka.xyz/.well-known/security.txt | sha256sum

Note about index.html: if you see a mismatch only on index.html, it is almost certainly Cloudflare's Email Obfuscation feature injecting a small <script src="/cdn-cgi/scripts/email-decode.min.js"> tag into the served HTML to protect the contact email from spam scrapers. The page behaviour is not affected. You can either accept the mismatch as benign, or, if you operate the deployment, disable Email Obfuscation in your Cloudflare dashboard under Scrape Shield for a byte-identical match.

tailwind.js should additionally match the official Tailwind Play CDN build 3.4.16, which you can verify independently:

curl -sfL https://cdn.tailwindcss.com/3.4.16 | sha256sum
# 3f81aa7f6ecdb1acc14c202e513dfee00b6c7703cd81ce1be25bf5215a92e8cb  -

Files

.
├── index.html              page structure (no inline JS / CSS)
├── styles.css              custom CSS: fonts, animations, <details> chevron
├── tailwind-config.js      Tailwind theme extension (fonts, shadows)
├── tailwind.js             self-hosted Tailwind Play CDN v3.4.16
├── app.js                  wallet detection, EIP-712 build, sign, submit
├── security.txt            served at /.well-known/security.txt
├── logo.png, favicon.png   brand assets
├── Caddyfile.example       example reverse-proxy config (Caddy)
├── README.md               this file
└── LICENSE                 MIT

Self-hosting

Any static-file server works. The page does no server-side work — the backend serves files and that's it.

Minimal (any static server)

# Clone
git clone <this-repo> sijka-approve
cd sijka-approve

# Serve from the directory containing the files
python3 -m http.server 8080
# → http://localhost:8080/

Production (Caddy)

See Caddyfile.example for a complete site block with the same CSP and security headers we use in production.

approve.example.com {
    tls /path/to/origin-cert.pem /path/to/origin-key.pem
    header { ... security headers ... }
    root * /path/to/sijka-approve
    try_files {path} /index.html
    file_server
}

Contact

• Telegram: @SijkaRobot
• Email: prt1sn@proton.me
• Security reports: see security.txt