Hardened Remote Flatten Listener
Most remote-control EAs try to do everything a trader might want from outside the terminal - open, close, modify, query - which also means every one of those actions is something a forged or replayed command could abuse. This EA does the opposite on purpose: it recognises exactly one command, FLATTEN, and refuses to be extended into anything more, because a panic switch that can only ever close positions is far harder to turn into a loss than one that can also open them. A dropped command file must contain a line of the shape "seq,timestamp,FLATTEN,signature". The signature is checked with a hand-assembled HMAC-SHA256 built from MQL4's CryptEncode(CRYPT_HASH_SHA256, ...) primitive using the standard RFC 2104 nested-hash construction - MQL4 exposes a raw hash function, not a keyed MAC or any public/private key signing, so the HMAC construction is assembled by hand from that primitive rather than borrowed from a real signing library, which MQL4 does not have. This is honestly a shared-secret integrity check, not cryptographic non-repudiation: anyone holding the configured secret can forge a command, exactly like an HMAC webhook check anywhere else. The construction is written fresh inline in this file (not shared via #include, per house rules against cross-project includes) - the same construction appears independently, also written fresh, in other signed-file projects in this catalogue. Beyond the signature, a strictly increasing sequence number (persisted to disk, so it survives an EA restart) rejects any replayed or re-dropped file, and a configurable freshness window rejects a validly-signed but stale command. Every attempt, accepted or rejected, is appended to a CSV audit log with the exact reason, so a forged, stale, or malformed drop is visible after the fact even when nothing happened. Notes and limitations This is a shared-secret check, not asymmetric signing - it protects against replay and forgery by anyone who does NOT hold the secret, not against the secret itself leaking. Rotate InpSharedSecret if it may have been exposed. The EA only ever closes; it has no code path that can open, modify, or resize anything, by design. If a "remote open" capability is ever wanted, it belongs in a separate, differently-scoped project rather than added here. The sequence-number watermark is stored in a plain text file in the sandbox (HardenedRemoteFlatten_LastSeq.dat) - deleting that file resets replay protection to "accept the next sequence number seen," so the file itself should be treated as part of the trust boundary, not left world-writable outside the sandbox.
Expert advisor · MT4 · v1.0 · Free
About Hardened Remote Flatten Listener
Hardened Remote Flatten Listener is a script for MetaTrader 4. It has 8 settings, such as Shared secret, Drop folder and File extension. MQL source code included.
Files in the download: HardenedRemoteFlatten.ex4, HardenedRemoteFlatten.mq4, HardenedRemoteFlatten.txt.
Settings
| Setting | Default | What it does |
|---|---|---|
| Shared secret | Shared HMAC secret, must match the sender - blank refuses everything (fails safe) | |
| Drop folder | HardenedRemoteFlatten\\Inbox | Subfolder of MQL4\Files scanned for command files |
| File extension | .flat | |
| Max command age seconds | 30 | Reject a command whose embedded timestamp is older/newer than this |
| Magic number | 44900 | Only positions carrying this magic are ever touched |
| Scan interval seconds | 1 | |
| Max retries | 5 | |
| Retry wait ms | 300 |
How to install
- Download the ZIP from your PolyMaria library and unzip it.
- In MetaTrader 4 open File → Open Data Folder, then go to MQL4 → Scripts.
- Copy the .mq4 file(s) there. Put any .mqh files in MQL4 → Include.
- Open the .mq4 file in MetaEditor and press Compile (F7) if MetaTrader does not show it.
- Drag the script onto a chart to run it once.
Tags: MT4 Expert Advisor · MQL4 Source Code