Audits › YizhiSong/FriesTrader › Robinhood Crypto
Bot × exchange
Does FriesTrader work with Robinhood Crypto?
The FriesTrader README names Robinhood Crypto as a supported exchange (README scanned 2026-09-17). We did not run the bot against Robinhood Crypto: this page reports what the public code says and what the exchange itself publishes.
Robinhood Crypto facts
- Puerto Rico residents
- Accepted, in writing: every U.S. state, the U.S. Virgin Islands, Puerto Rico and D.C. (source, 2026-09-17)
- Markets
- Spot crypto only (source, 2026-09-17)
- Official API
- Yes: Robinhood Crypto Trading API with Ed25519-signed requests; even the public trading-pairs endpoint requires a key (source, 2026-09-17)
Exchange data: CoinGecko public API and the exchange's own endpoints, 2026-09-17. More on the Robinhood Crypto page.
What the audit says about running it live
From the FriesTrader audit (2026-09-17), the controls that matter most once a live API key is connected:
| Control | Verdict | Evidence |
|---|---|---|
| API key permissions | Not verified | README First-time setup #1: Agentic Trading 'requires a separate, dedicated account -- distinct from your regular investing account, and restricted to only the funds you put in it' (a segregation control). No API key, OAuth scope, or credential file exists anywhere in this repo to inspect. |
| Orphaned stop-loss | Partial | scripts/stop_loss.py + PHASE_B_TASK.md Step 5: the stop is recomputed fresh every cycle from get_equity_positions/get_equity_quotes/get_equity_historicals, never held only in a running process's memory, so a crashed session can't 'lose' it between cycles. |
| Websocket and data reconnection | Partial | No websocket exists in this architecture at all -- it is synchronous MCP tool calls inside two scheduled batch sessions (README 'How it works'), so continuous-connection reconnection does not apply. PHASE_B_TASK.md Step 6's only documented failure rule is generic: 'if a tool call fails, log the failure and skip that candidate.' |
| Order rejection handling | Present | PHASE_B_TASK.md Step 6: review_equity_order is always called first as a preview; a blocking alert is logged verbatim and treated as rejected without placing; after placement, get_equity_orders is polled up to twice (~15s apart) for a terminal state, whatever state comes back is logged, and a failed tool call is logged and the candidate skipped. |
| Position reconciliation with the exchange | Present | PHASE_B_TASK.md Step 4 ('Pull get_equity_positions -- this snapshot... is also what Step 5's stop-loss/take-profit checks use') and Step 6 ('Re-pull fresh account state... the earlier pull is now stale for any sell that actually executed above'). |
Before you connect a key
- Create the API key with trading enabled and withdrawals disabled, and restrict it to your server's IP if Robinhood Crypto allows it.
- Start in paper or dry-run mode if the bot has one (the README mentions it).
- Decide the maximum loss per day before the first order and check the bot can enforce it: see the circuit breaker control. If it cannot, the watchdog enforces it from outside with a read-only key.