Open Source Crypto Trading Bot

What open source means for a trading bot

Software is open source when its authors publish the source code under a licence that lets others read, run and often change it. For a trading bot that means you can see the rules it follows, which a closed product does not show you. Many people find that useful because the logic is not a black box.

It is worth being clear about what it does not mean. Anyone can publish code, and nobody has to check it. A project can be abandoned, full of bugs, copied with a hidden change, or simply wrong about how an exchange works. A large number of readers makes a mistake easier to find, but it does not promise someone found it. And readable code says nothing about whether the trading rule makes money. A clean bot with a poor rule loses cleanly.

How to review the code before you run it

You do not need to be an expert to do the first checks. If you cannot read the language at all, ask someone who can, or do not run it with real money. Work through this list in order.

• Where did you get it? Download only from the project's own official page, not from a link in a video, a chat group or an ad. Fake copies of real projects are a known way to steal keys.
• Is it maintained? Look at when it was last updated, whether problems reported by users get answers, and whether it still matches the exchange's current rules.
• Where does the key go? Search the code for the places that read your API key. It should be used only to sign requests to the exchange you named. Any other network address that receives it is a red flag.
• What does it connect to? List every address the program contacts. A trading bot has no need to send data to unknown servers.
• What are the dependencies? Bots rely on other packages. Each one is more code you are trusting. Fewer and well known is easier to check.
• Is the trading rule stated? You should be able to say in a sentence when it buys and when it sells, and what it does if the price falls a long way.
• Does it have limits? Look for a maximum order size, a stop when losses reach a set level, and a way to switch it off by hand.

API key permissions

An API key is the secret that lets the bot act on your exchange account. Most exchanges let you choose what each key may do. Fewer rights mean less harm if the key leaks or the bot is faulty. The names differ between exchanges, but the ideas are general.

A bot normally needs the first two. It should not need to withdraw. If a bot asks for withdrawal rights to trade, treat that as a reason to stop. Keep the key out of the code you share, out of screenshots and out of chats, and create a new one if you think it may have been seen. A key limited to your own IP address is useless to someone who steals it and tries it from somewhere else, where the exchange supports that option. The crypto trading bot guide covers more on custody.

Run it on demo or paper first

Many exchanges offer a test environment, often called a testnet or sandbox, that uses play money. Where one does not exist, the bot can run in a paper mode that records the orders it would send. Both let you see what the bot does without risking money. See paper trading and demo accounts.

Paper results are still too good. A paper run usually fills every order at the quoted price. Real orders cross the spread and slip. The made-up example shows how much that can matter.

A worked example with made-up numbers

A made-up bot makes 40 trades of $200. Each one gains 0.5 percent gross. The exchange fee is 0.1 percent per side, so 0.2 percent per round trip. Slippage is added on both sides. On paper with no slippage, each trade nets $0.60, a total of $24.00.

The paper figure is $24.00. At 0.1 percent slippage per side it is $8.00, which is 67 percent less. At 0.15 percent per side it is $0.00. The numbers are made up, but the lesson holds for any bot: a paper result is a ceiling, not a forecast.

How an open source bot fails

• Hidden or copied code. A changed copy sends your key somewhere else.
• Out of date. The exchange changes how its API works and the bot sends orders that are rejected or wrong.
• A bug in the maths. A rounding, size or fee error can place orders too large or too small.
• No stop. The code has no loss limit and keeps buying into a long fall.
• Too much trust in a backtest. A tested result may be overfitted to the past.
• Your own setup. A key saved in a file that is shared by mistake, or a computer that is not kept secure.

What this page does not tell you

It does not say that any open source bot is safe or unsafe, or that any one earns money. It describes checks that reduce some risks. They do not remove them. Start with an amount you can afford to lose, and keep watching it.