Why You Should Always Check Source Code Before Buying a Forex Expert Advisor
Why You Should Always Check Source Code Before Buying a Forex Expert Advisor
Table of Contents
- Why Source Code Transparency Matters
- Red Flags in EA Marketing
- What to Look for in the Source Code
- Dangerous Hidden Functions to Watch For
- Evaluating Risk Management Implementation
- How to Get Source Code Access
- Using Decompilation for Due Diligence
- Your Complete Pre-Purchase Checklist
Every year, thousands of Forex traders spend real money on automated trading robots that do not perform as advertised, contain deceptive logic, or in the worst cases actively harm the trading accounts they run on. The majority of these bad outcomes share a common root: the buyer never looked inside the robot they were purchasing.
Source code inspection is the most powerful due diligence tool available to anyone considering a Forex EA purchase. This guide explains why it matters, what to look for, and how to access source code even when the vendor does not voluntarily provide it. The time invested in this process can protect you from significant financial losses.
Why Source Code Transparency Matters
An Expert Advisor is software that has complete, unrestricted access to your trading account when it runs on a connected MetaTrader terminal. It can open positions, modify stops, close trades, and in some configurations execute actions you did not explicitly authorize. Every one of these actions is ultimately defined by the code inside the EX4 file you installed.
When you cannot read that code, you are trusting the vendor's marketing materials, their selected testimonials, and their cherry-picked backtests. You have no independent means to verify what the EA actually does, what risks it takes, or whether any hidden behavior exists beyond what is described in the marketing.
Consider the asymmetry of information in a typical EA purchase: the vendor knows everything about what the code does. The buyer knows only what the vendor chooses to share. Source code inspection is the only way to eliminate this information asymmetry and make a genuinely informed purchase decision.
The good news is that most legitimate EA developers those who are genuinely confident in the quality and integrity of their product are willing to accommodate reasonable due diligence requests. The developers who resist such requests are often those who have something to hide. A vendor's response to a source code request is itself highly informative.
Red Flags in EA Marketing
Before you even get to source code inspection, the marketing materials surrounding an EA often reveal whether the product is likely legitimate. Watch for these warning signs in any EA you are evaluating:
Backtest Results That Are Too Perfect
Real trading systems have drawdown periods, losing streaks, and imperfect equity curves. A backtest showing an almost perfectly linear upward equity line with minimal drawdown over years of data is almost certainly either heavily over-optimized to historical data or constructed using manipulated parameters. Legitimate strategies show realistic variation including extended flat periods and meaningful drawdowns.
Forward Test Evidence Is Absent
Backtests are generated by applying rules to historical data easy to optimize after the fact. Forward tests (live or demo trading in real-time, with independently verifiable results through platforms like Myfxbook or FX Blue) are far harder to fabricate. An EA vendor who provides only backtests and no independent forward test evidence deserves significant skepticism regardless of how impressive the historical results appear.
Implausible Win Rates
Marketing claiming 90%+ win rates across diverse market conditions should trigger immediate scrutiny. High win rates are typically achieved through strategies that hold large losing trades while booking small winners eventually leading to catastrophic drawdowns when a streak of losses cannot be recovered. The win rate metric in isolation is meaningless without accompanying maximum drawdown statistics over a realistic time period.
No Information About the Developer
Anonymous or pseudonymous vendors with no verifiable track record or reputation in the Forex trading community are a risk factor. Legitimate, confident developers stand behind their products with their real names and verifiable credentials. Search the developer's name across major Forex forums before proceeding with any purchase.
Pricing That Does Not Make Sense
An EA generating hundreds of percent per year in genuine returns would be worth millions in managed funds. Why would such a system be sold for $97? Either the marketing claims are exaggerated, the strategy requires conditions that no longer exist, or the product is outright fraudulent. Pricing that seems disconnected from the claimed performance is a red flag worth investigating.
What to Look for in the Source Code
If you gain access to the MQL4 source code before purchase either because the vendor provides it, or because you used decompilation for audit purposes here is what competent evaluation covers:
The Core Trading Logic
Identify what signals the EA uses to open positions. Is the logic based on legitimate, well-understood technical analysis concepts moving averages, RSI, MACD, Bollinger Bands, price action patterns? Or does the entry logic appear arbitrary, perhaps optimized to specific historical quirks that have no theoretical basis? Does the logic match what the marketing described, or are there material differences?
The Complete Exit Strategy
How does the EA decide to close positions? Are take profits and stop losses clearly defined and consistently applied? Does the EA use trailing stops and are they implemented correctly? Does it exit based on time (closing positions at end of session or end of week)? Is there a maximum holding period? A complete exit strategy is as important as a clear entry strategy.
Broker and Account Dependencies
Does the code check for specific broker conditions, account numbers, or spread values? Some EAs are optimized so specifically for the vendor's partner broker that they perform poorly elsewhere. This is worth knowing before you buy particularly if your broker is not the vendor's preferred one. Look for any string comparisons involving broker names or hardcoded account numbers.
Time Filters and Session Logic
Many EAs restrict trading to specific market sessions (London, New York, Tokyo) or specific hours. Understanding these restrictions tells you whether the EA will trade during your preferred hours and whether it avoids high-risk periods like major news releases or low-liquidity overnight sessions.
Dangerous Hidden Functions to Watch For
The most serious cases of EA fraud involve hidden functions that harm traders actively not just strategies that underperform due to poor logic. Source code inspection can reveal:
Account Credential Harvesting
Some malicious EAs send account credentials login number, password, investor password to external servers controlled by the vendor or third parties. In MQL4, this requires calls to WebRequest() or DLL imports. Any EA that calls AccountPassword()and then sends data externally should be immediately removed from any trading terminal and never run again.
Strategy Tester Fraud
Some EAs explicitly detect the MetaTrader Strategy Tester environment using IsTesting() and apply different, more profitable trading logic during backtests than during live trading. This is detectable only through source code review it is completely invisible from backtest results and forward test periods that happen to align with the "normal mode" behavior.
Time-Based Behavioral Switches
Certain fraudulent EAs perform normally for a fixed period say, 90 days building the trader's confidence and generating positive reviews, before activating a high-risk or account-damaging mode. This time-based switch is visible in the source code as a conditional statement checking the current date against a hardcoded threshold.
Spread-Based Exploitation
Some EAs only produce profitable results with specific spread conditions available at specific brokers. The code may check the current spread and refuse to trade, or trade poorly, when spread conditions differ from the vendor's preferred broker. This can be discovered by reading the order entry logic and identifying any spread-based conditions.
Evaluating Risk Management Implementation
Risk management is arguably the most important dimension of any EA evaluation. A beautiful entry strategy with poor risk management will eventually blow an account. Here is what to examine:
Stop Loss Implementation
Every opened trade should have a stop loss. Search the source code for every OrderSend() call and verify that the stop loss parameter is non-zero. An EA that sets stop losses to 0 for any category of trade is running naked risk that will eventually produce catastrophic losses. This is one of the most important checks in any source code review.
Lot Sizing Formula
Is lot size fixed, percentage of equity, or based on running position count? A formula that scales position size based on the number of open losing positions is a martingale system regardless of how it is described in the marketing. Even "moderate" martingale factors (1.5x per additional position) can produce extreme leverage during extended losing streaks that exceed any account's margin capacity.
Maximum Exposure Limits
Does the EA implement any ceiling on total open exposure? An EA with no maximum position count or lot size limit is a time bomb market conditions can generate many simultaneous signals, and without limits, each of those signals becomes an open position consuming margin.
Grid Trading Identification
Grid trading strategies open multiple positions at fixed price intervals, often without stop losses, and rely on price eventually returning to profitable levels to exit. They can produce extended periods of steady small profits followed by catastrophic drawdowns when price trends strongly in one direction. Grid logic is identifiable in source code by the pattern of price-interval-based position opening.
How to Get Source Code Access
There are several legitimate routes to source code access for evaluation purposes:
Request It from the Vendor
Simply asking is always the first step. Some vendors provide source code to verified buyers after purchase, under non-disclosure agreements. Frame your request professionally "I need to review the source code for risk management and security verification before committing to live trading" is a reasonable request that legitimate vendors should respect.
Third-Party Audit Services
Some professional EA marketplaces offer third-party code audit services. A qualified MQL4 developer reviews the source on your behalf and reports whether it matches the described strategy and contains any concerning elements. This protects the vendor's intellectual property while giving the buyer meaningful assurance.
Open Source Alternatives
A growing body of high-quality open-source EAs are available with full source code. While you give up the proprietary "edge" of a closed-source strategy, you gain complete transparency and the ability to verify and modify the code. For many traders, this trade-off is well worth making.
Professional Decompilation for Already-Purchased EAs
If you already purchased an EA and are concerned about its behavior, professional decompilation of the EX4 file is a legitimate audit tool. The team at ForexMQ5 handles exactly this use case security auditing of purchased robots as one of their primary service categories. The Ex4decompiler.com approach gives you the source for inspection, which is better than trading blind indefinitely while having concerns about what the code might be doing.
Using Decompilation for Due Diligence
Professional EX4 decompilation as a due diligence tool is, in most jurisdictions, defensible practice for security auditing of an EA you already own or are evaluating for purchase under a trial arrangement. The process is straightforward: submit the EX4 file to ForexMQ5, receive the recovered MQL4 source, and review it yourself or with an MQL4 developer hired for the audit.
What decompilation reveals that marketing never will: the actual entry and exit conditions, the real lot sizing formula (including any martingale or grid behavior), all external connections the EA makes, any date-based or account-based behavioral switches, and the complete risk management implementation. This information is the foundation of any genuine due diligence review.
For a detailed look at how backtest manipulation works and what decompilation exposes, the article ex4decompiler.com covers this in depth. And to understand the full audit process after purchase, ex4decompiler.com provides a complete step-by-step methodology that works through every dimension of code review.
Your Complete Pre-Purchase Checklist
Before buying any Forex Expert Advisor, work through this checklist systematically:
Marketing and Claims Verification:
- Does the vendor provide independently verifiable forward test results (Myfxbook or equivalent)?
- Is the forward test period at least 12 months on a real account?
- Is the developer identifiable with a verifiable track record in the community?
- Is the pricing consistent with a legitimate commercial product (not implausibly discounted from implausible claims)?
- Does the marketing describe the strategy logic clearly enough to evaluate it?
Source Code Access:
- Have you attempted to request source code access from the vendor?
- If refused, have you considered obtaining it through professional decompilation?
- Has the code been reviewed by someone qualified to evaluate it?
Code Review (once source is available):
- Does every trade have a stop loss?
- Is the lot sizing formula non-martingale?
- Are there no calls to AccountPassword()?
- Does any WebRequest() usage only contact the vendor's known legitimate servers?
- Is there no IsTesting()-based behavioral switch affecting trading logic?
- Is there no date-based or account-balance-based behavioral switch?
Pre-Live Testing:
- Has the EA been tested on a demo account for at least 4 weeks?
- Did demo results match the marketing claims at a reasonable level?
- Is there a clear plan for live deployment at reduced position sizing initially?
An EA that clears this complete checklist is dramatically less likely to disappoint than one evaluated solely on marketing materials. The due diligence investment is small compared to the capital you are about to risk.
How Legitimate vs. Problematic Vendors Respond to Source Requests
One of the most reliable practical tests for evaluating a vendor's integrity is how they respond to a professional request for source code access or independent review. This response tells you a great deal about what they might be protecting.
Legitimate vendors who are confident in their product typically respond professionally: they explain their IP protection approach matter-of-factly they do not share open source code but are willing to discuss audit arrangements, provide a hash commitment to the code, or arrange a third-party review under NDA. They treat the request as normal professional business and do not become defensive. Some will offer an extended trial specifically to satisfy due diligence concerns.
Problematic vendors respond with defensiveness, deflection, or offense. Common deflection responses include "our code is proprietary and we never share it with anyone" (which does not address audit arrangements), "our results speak for themselves" (substituting outcome claims for accountability), or "if you don't trust us you don't have to buy" (reframing a reasonable security concern as an attack on their reputation).
The meaningful distinction is not whether source code is shared openly most legitimate commercial vendors do not but whether the vendor supports any form of independent verification. A vendor who refuses every reasonable proposal and frames due diligence as adversarial sends a clear signal about what that review might find. Combined with the warning signs in the vendor red flags article, vendor behavior in response to source requests is one of the most reliable pre-purchase filters available to informed buyers.
A decompiled EA also reveals how the developer handles edge cases: what happens when market data is unavailable, how the EA responds to a broker's spread widening beyond expected ranges, and whether there are hard-coded values that could cause unexpected behavior on certain account types. These details are invisible from the outside but plainly visible in the source code.
