> ## Documentation Index
> Fetch the complete documentation index at: https://docs.perpetradex.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Order Signing

> How your wallet proves an order actually came from you

Before an order ever reaches Perpetra, it's signed by your wallet. That signature is what proves you actually authorized this exact order, and nothing else. Nobody, not Perpetra, not a keeper bot, not the matching engine, can submit an order on your behalf without a valid signature attached.

## Turning an order into one fixed value

Every detail of your order, market, direction, size, collateral, price limit, slippage tolerance, expiry, all gets combined into a single fixed value that represents that exact order and nothing else. Changing even one number, even by a tiny amount, produces a completely different value. A signature made for one version of an order will never be accepted for a slightly different one.

## How signing actually works on Hedera

```mermaid theme={null}
flowchart TD
    A[Order details] --> B[Combined into a\nsingle fixed value]
    B --> C[Wallet wraps it in a\nstandard message format\nand signs it]
    C --> D[Quick off-chain check:\nrejects obviously broken\nor forged submissions fast]
    D -- Looks valid --> E[Sent for matching]
    D -- Malformed --> F[Rejected immediately]
    E --> G[On-chain contract\nre-checks the signature,\nthis is the real authority]
    G -- Valid --> H[Order accepted]
    G -- Invalid --> I[Rejected on-chain]
```

Hedera wallets don't sign the fixed order value directly, they wrap it in a standard message format first. Both the quick off-chain check and the final on-chain check account for that wrapping, so what gets verified always matches what your wallet actually signed.

There's also a quirk specific to Hedera's signature format: it doesn't include the extra piece of information needed to immediately tell which of two possible signer addresses produced a given signature. Rather than have the contract guess, which could occasionally accept the wrong signer, the wallet resolves that ambiguity itself before the order is ever submitted, by checking which of the two possibilities actually matches your account.

## The off-chain check is just a fast filter

When your order first arrives, the platform does a quick check right away, mainly to catch obviously broken or forged submissions before they waste any further processing. This check is never the final word though. Only the on-chain contract's own verification is authoritative, if a signature wouldn't hold up on-chain, it doesn't matter whether it passed the earlier quick check.

## Preventing replay and letting you cancel

Every order includes a unique number (a nonce) tied to your account. Once an order has been used, that same nonce can't be reused by a different order, this is what stops someone from resubmitting an old signed order to make it execute again.

You're also always in control of your own pending orders:

* Cancel one specific order directly
* Cancel a specific pending nonce before it's ever used
* Invalidate every pending order below a certain point all at once, an emergency "cancel everything" option that doesn't require finding and cancelling each order individually