> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chance.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Derive

> Venue-aware verification for Derive (formerly Lyra) — judge the exact order params before they are signed, so the verdict physically gates the self-custodial signature.

Chance understands Derive natively. Derive (derive.xyz, formerly Lyra) is a self-custodial options, perps and spot exchange: an off-chain orderbook that settles trustlessly on its own OP-stack rollup, where **every order is authorized by an EIP-712 signature over its exact economics**. That makes it an unusually good fit for verification — submit the `private/order` params your agent proposes, get a verdict, and sign **only on ALLOW**: the verdict becomes a physical gate, because an unsigned order is inert and a signed one needs no further permission.

## What gets recognized

Both bare params and the JSON-RPC envelope (`{ "method": "private/order", "params": { … } }`) are accepted:

| Family       | Payloads                                                                                                                                                                                                       |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `order`      | `private/order`, `private/replace`, the cancel family (`cancel`, `cancel_all`, `cancel_by_instrument`, `cancel_by_label`, `cancel_by_nonce`), and RFQ block trades (`send_rfq`, `send_quote`, `execute_quote`) |
| `withdrawal` | `private/withdraw` — funds exiting the subaccount                                                                                                                                                              |
| `transfer`   | `private/deposit`, `private/transfer_erc20` (dual-signed), `private/transfer_position`                                                                                                                         |
| `permission` | `private/register_scoped_session_key` and session-key grants — an **admin** key can sign orders *and* withdrawals, so the classifier treats granting one like Hyperliquid's `approveAgent`                     |

Instrument names are self-describing and parsed deterministically — `ETH-PERP`, `ETH-20260828-2600-P` (put, strike \$2,600, expiring 2026-08-28), `ETH-USDC` — so the judge reasons over:

> *Derive ORDER: SELL 10 ETH-20260828-2600-P (put, strike $2,600, expires 2026-08-28) @ 145 (limit, gtc) ≈ $1,450 premium, max fee 1000 USDC/contract, subaccount 30769*

with the notes that catch what the raw JSON hides: selling an option without `reduce_only` **writes short-option exposure** far beyond the premium collected; `max_fee` is **bound into the signature** and the venue may charge up to it (`max_fee × amount` is real worst-case money); `limit_price` is required even for market orders and is the true slippage bound; a `signature_expiry_sec` at MAX\_INT32 is a never-expiring authorization; and a payload that arrives **pre-signed is already authorized** — the verdict can gate submission, but no longer gates signing. When the classifier can reach Derive's public ticker, it fail-soft enriches the summary with the live mark, tick/step/minimum conformance, and flags limit prices that deviate more than 20% from mark.

## Use it from your bot

Verify the unsigned params, then sign and submit:

```ts theme={null}
const order = {
  instrument_name: "ETH-PERP",
  direction: "buy",
  order_type: "limit",
  time_in_force: "gtc",
  amount: "0.5",
  limit_price: "3000",
  max_fee: "5",              // USDC per contract — signed into the order, keep it tight
  subaccount_id: 30769,
  nonce: Number(`${Date.now()}${Math.floor(Math.random() * 999)}`),
  signer: SESSION_KEY_ADDRESS,
  signature_expiry_sec: Math.floor(Date.now() / 1000) + 600, // don't sign forever
};

const res = await fetch("https://harness.chance.cc/api/v1/intent", {
  method: "POST",
  headers: { "x-api-key": process.env.CHANCE_API_KEY!, "Content-Type": "application/json" },
  body: JSON.stringify({
    intent: "Delta-hedge ETH only: perps, max $2,000 notional per order, max fee 5 USDC/contract, subaccount 30769 only. Never withdraw, never register session keys.",
    venue: "derive",
    action: order, // unsigned — the verdict gates the signature
  }),
});

const { verdict, reasoning } = await res.json();
if (verdict !== "ALLOW") throw new Error(`Blocked: ${reasoning}`);
// only now produce the EIP-712 action signature and POST /private/order
```

`venue` is optional — perp and option instrument names auto-detect (spot pairs like `ETH-USDC` additionally need the signing-envelope fields, since `BASE-QUOTE` alone is too generic). The legacy name still works: `venue: "lyra"` routes here.

## Use it from Claude or ChatGPT

Add the hosted connector (`https://harness.chance.cc/api/mcp`, see [Connectors](/connectors)) and give your agent one standing instruction:

> Before signing or submitting any Derive action — orders, withdrawals, transfers, session keys — call `verify_intent` with my rules as the intent and the exact API params as the action, with `venue: "derive"`. Only proceed on ALLOW; on BLOCK or ESCALATE, stop and tell me why.

There is no official Derive MCP server, so agents typically drive the REST/WebSocket API directly — the standing instruction gates whatever client they use.

## How the harness knows Derive

The judge works from a **versioned snapshot of Derive's own documentation** — order placement and the cancel/replace family, instrument naming and live specs, the two-layer auth model and exactly what the EIP-712 action signature commits to (module addresses, domain separators, 1e18 scaling), session-key scopes including the granular trade-only grants the REST docs understate, withdrawals/deposits/transfers with their dual-signed shapes, margin (standard vs portfolio) and price-banding rejection rules — plus a curated brief of the venue's footguns (signature-bound `max_fee`, premium-vs-notional readings, short options, never-expiring signatures, the 1 TPS matching rate limit). Docs are never fetched at verdict time: the snapshot is reviewed like code, its version is hashed into every transcript, and each page the judge consults is chained with its content hash. See [Architecture](/concepts/architecture).

## What the receipt adds for Derive

On top of the standard proof bundle (transcript root, judge signature, onchain anchor), venue-aware verdicts carry `venue: "derive"`, the `actionFamily`, the venue `actionType` (`order`, `replace`, `cancel-all`, `withdraw`, `session-key`, `rfq-execute`, …), `mode: "structured"`, and the knowledge-snapshot version — all inside the hash-chained transcript. For orders, the transcript records the exact instrument, side, size, limit price, fee cap and subaccount the verdict was issued against.

<Note>
  **Eligibility is yours to check:** Derive's Terms of Use restrict several jurisdictions, including United States persons. A Chance verdict verifies an order against your mandate — it never confers eligibility to trade on the venue.
</Note>