Audits › Lumiwealth/lumibot › Coinbase
Bot × exchange
Does lumibot work with Coinbase?
The lumibot README names Coinbase as a supported exchange (README scanned 2026-09-17). We did not run the bot against Coinbase: this page reports what the public code says and what the exchange itself publishes.
Coinbase facts
- CoinGecko trust score
- 10 / 10 · rank 2
- Country
- United States
- Established
- 2012
- 24h volume (BTC, normalized)
- 0
- Puerto Rico residents
- Not verified: the eligibility page returned an access error (HTTP 403) on the check date (source, 2026-09-17)
- Derivatives
- Regulated futures through Coinbase Financial Markets; global perpetuals since June 2026 (source, 2026-09-17)
- Official API
- Yes (Advanced Trade API); futures access for U.S. territories not confirmed (source, 2026-09-17)
Exchange data: CoinGecko public API and the exchange's own endpoints, 2026-09-17. More on the Coinbase page.
What the audit says about running it live
From the lumibot audit (2026-09-17), the controls that matter most once a live API key is connected:
| Control | Verdict | Evidence |
|---|---|---|
| API key permissions | Not verified | GET /search/code?q=withdraw+repo:Lumiwealth/lumibot+path:lumibot/brokers -> 3 hits (alpaca.py, broker.py, and one more), not individually inspected line-by-line within the session budget. |
| Orphaned stop-loss | Not verified | No queried directly: would require reading each broker adapter's order-submission code (alpaca.py 84 KB, schwab.py 158 KB, tradier.py 104 KB, etc.) to see whether stop-loss orders are placed as broker-native conditional orders or simulated in-process. |
| Websocket and data reconnection | Partial | docs/FAST_ORDER_LIFECYCLE_GUIDE.md, section 'Schwab Profile': 'uses account-activity WebSocket messages as a wake-up signal... performs an active-order reconciliation after login or reconnect and retains a 30-second broad order-history poll only as a healing fallback' and 'Schwab 429 responses suppress more reads... for the server's Retry-After interval, or bounded exponential backoff with jitter when that header is absent.' |
| Order rejection handling | Partial | docs/FAST_ORDER_LIFECYCLE_GUIDE.md testing matrix explicitly lists 'rejected hedge and bounded retry' as something a regression suite 'should cover', and states 'the strategy still owns its deadline, replacement, hedge, and conflict policy. Do not turn one strategy's timeout or risk rule into a global LumiBot default.' |
| Position reconciliation with the exchange | Partial | docs/FAST_ORDER_LIFECYCLE_GUIDE.md: the order state machine includes 'a bounded exact-order reconciliation read after a missed callback, restart, reconnect, or ambiguous mutation result', confirmed implemented for Schwab ('performs an active-order reconciliation after login or reconnect'). |
Before you connect a key
- Create the API key with trading enabled and withdrawals disabled, and restrict it to your server's IP if Coinbase allows it.
- Start in paper or dry-run mode if the bot has one (the README mentions it).
- Decide the maximum loss per day before the first order and check the bot can enforce it: see the circuit breaker control. If it cannot, the watchdog enforces it from outside with a read-only key.