Audits › Drakkar-Software/OctoBot › Binance.US
Bot × exchange
Does OctoBot work with Binance.US?
The OctoBot README does not name Binance.US directly, but it names ccxt, the exchange library that ships a Binance.US adapter. Whether the bot's own code handles Binance.US's rules (symbols, order types, rate limits) is not something a README scan can tell. We did not run the bot against Binance.US: this page reports what the public code says and what the exchange itself publishes.
Binance.US facts
- CoinGecko trust score
- 9 / 10 · rank 14
- Country
- United States
- Established
- 2019
- 24h volume (BTC, normalized)
- 0
- Tradable pairs
- 265
- Quote currencies
- BTC, USD, USDC, USDT
- Order types (BTCUSD)
- LIMIT, LIMIT_MAKER, MARKET, STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, TAKE_PROFIT_LIMIT
- Markets
- spot only: no futures, no margin
- Puerto Rico residents
- Accepted, in writing (source, 2026-09-17)
- Fees
- 0 % maker / 0.02 % taker on spot (source, April 2026)
- Official API
- Yes: REST and websocket, HMAC-signed private endpoints (source, 2026-09-17)
Exchange data: CoinGecko public API and the exchange's own endpoints, 2026-09-17. More on the Binance.US page.
What the audit says about running it live
From the OctoBot audit (2026-09-17), the controls that matter most once a live API key is connected:
| Control | Verdict | Evidence |
|---|---|---|
| API key permissions | Partial | exchange_credentials_data.py only models api_key/secret/password/uid (CEX) or wallet_address/private_key (DEX) fields; GitHub code search for '.withdraw(' found a match only in a DEX blockchain_wallet_operators tentacle (on-chain, user-initiated), not in any CEX/CCXT order-execution path. |
| Orphaned stop-loss | Not verified | Order type implementations live under packages/trading/octobot_trading/personal_data/orders/ (order.py, order_factory.py, and an unread 'types' subfolder); not opened due to time/budget. |
| Websocket and data reconnection | Not verified | packages/trading/octobot_trading/exchanges/abstract_websocket_exchange.py (8521 bytes) exists as a dedicated websocket abstraction, confirmed via directory listing, but its reconnect/backoff/429-handling logic was not read due to time/budget. |
| Order rejection handling | Present | index_trading.py IndexTradingModeConsumer._rebalance_portfolio(): except (trading_errors.MissingMinimalExchangeTradeVolume, copy_errors.RebalanceAborted) as err: logs a warning/error and marks the rebalance as REBALANCING_SKIPPED instead of retrying blindly or crashing. |
| Position reconciliation with the exchange | Present | index_trading.py IndexTradingModeProducer.ensure_index() calls _wait_for_positions_init() and _wait_for_orders_init() at startup before rebalancing, loading real exchange positions/orders; telegram_bot.py exposes /refresh_portfolio ('Forces OctoBot's real trader portfolio refresh using exchange data'). |
Before you connect a key
- Create the API key with trading enabled and withdrawals disabled, and restrict it to your server's IP if Binance.US allows it.
- Start in paper or dry-run mode if the bot has one (the README mentions it).
- Decide the maximum loss per day before the first order and check the bot can enforce it: see the circuit breaker control. If it cannot, the watchdog enforces it from outside with a read-only key.