Risk

BBO jitter risk

The execution price is Hyperliquid’s best bid and offer, read directly. On BTC and ETH the spread is tight but not zero, and inside it anyone can place a small limit order that never needs to fill: just sitting at the top of the book moves the best bid or offer, and with it the mid, by a tick or two.

Someone who moves the book this way may be able to open or close here at a distorted mid and profit as the quote returns to normal. This is a real, open risk: the pricing has no independent reference price to reject a quote against.

Economic frictions and exposure controls

Four controls apply. None of them proves that manipulation is impossible or unprofitable.

1. The deadband. On a winning close, a gain smaller than 0.002% of the entry price is zeroed before the impact curve runs, and larger gains lose that amount first.
2. The asymmetric impact curve. The haircut on winning closes is steepest on the smallest moves, which reduces the payoff from small distortions without comparing the book to any other price.
3. Directional open-interest caps. Each market has separate long and short caps; an open that would exceed its side’s cap reverts. A keeper keeps each cap at the side’s open interest plus a headroom H valued at the current mid, leaves it alone while the headroom stays within 10% of H, and limits how fast caps can grow. H is set per launch stage (below). These caps limit new exposure per side; they are not a ceiling on total open interest or on losses.
4. The young-close hold. The relayer holds a close of a position opened moments ago for up to 6 seconds, so a single stale snapshot cannot be opened and closed at once.

Together they reduce payoffs and limit how much new exposure fits under the caps. A manipulated but non-zero, uncrossed book still passes, so manipulation and LP-loss risk remain.

Operational guards

• Watching keepers. Our keepers monitor the books, open interest and the health of every position, and run liquidations and harvests every block. A sentinel watches for halted books and abnormal flows and alerts the operators.
• Retiring a market, pausing trading. The guardian can retire a market id when something looks wrong: it never accepts another open, and its positions stay closeable at the book frozen at retirement. Retirement cannot be undone; the market may later be listed again under a new id. Pausing trading is the reversible way to stop opens on every market; the guardian can pause, and only the owner can unpause.
• The cap keeper. The market keeper applies the cap policy to each side independently and changes a cap only when the headroom leaves its band.

Permissionless and gated surfaces

Trading goes through our relayer: opens, closes, session-key registration and staking actions are submitted by the configured relayer keys through the BatchExecutor. Every one still carries your wallet’s or your session key’s signature, checked on-chain, so the relayer cannot act for an account without its signature.

Withdrawals stay in your hands: you can call withdrawToCore from your wallet, and a signed withdrawToCoreBySig can be submitted by anyone but needs your wallet’s own signature. Liquidations, harvests, deposit sweeps and their finalization, and replaying deferred mints are public maintenance calls; pushing staker fees is reserved for the staking contract, which does it at every distribution. Deploying a deposit proxy is open to the relayer’s deployer and to the account itself; triggering a staking distribution is reserved for the distributor keeper or a signed request through the relayer. There is no admin switch over user balances.

Admin keys

Each role is limited to a narrow surface:

• Guardian (a multisig). Can retire a market (at the frozen book, or in an emergency at Hyperliquid’s mark or oracle price), pause trading on every market, replace the market keeper, cancel operations scheduled on the timelock, and raise the gas allowance for price reads. It cannot unpause, move funds, change balances or switch on any dormant defence.
• Owner (the timelock, scheduled by the governance multisig, with a delay of 2 days). Can change fees and the impact parameters, list markets, replace relayers and keepers, set the team’s fee recipient, lift a trading pause, approve builders and set their fee rate (at most 15%), move a builder’s unclaimed fees, switch minting to the supply-share rule (once), and upgrade the contracts. The contracts are upgradeable, so in principle the owner can make them do anything; the delay makes every such change visible before it runs. Who holds the timelock’s roles is itself behind a second timelock of 7 days.
• Market keeper. Moves the per-side open-interest caps and sets the minimum margin and minimum position size for opens. Setting a side’s cap to zero stops new opens on that side without freezing any price. It cannot move funds, freeze prices or touch the impact curve.
• Off-hours keeper. Switches winning closes between the two payout curves fixed in the contract (Asymmetric impact PnL), on a published schedule. It can choose one of those two curves and nothing else.
• Builder guardian (the governance multisig). Can remove an approved builder at once, which stops its fee on every key; fees it already earned stay claimable.
• Reconciler. Can credit a deposit sweep that was marked unconfirmed, only up to its recorded amount, only from funds that verifiably arrived and belong to nobody, and only within 30 days.

Launch stages

The exchange opens in stages. They change only off-chain levers (who may trade, the cap headroom H per side, the largest single order the relayer accepts), never an on-chain parameter. Each stage runs at least its minimum duration without a serious incident before the next starts, and any lever can be lowered at any time.

Dormant defences

The contracts include defences that are built and tested but switched off at launch, by decision: fills stay at the raw mid, and there is no outflow limiter and no circuit breaker. Enabling one is a timelocked parameter change that must be decided and announced first.

There is therefore no limiter on money leaving the exchange: a bug that inflated a balance could be withdrawn before a fix lands. The indexer checks the accounting after every block and alerts at once, and the relayer can stop relayed withdrawals; direct withdrawals cannot be stopped.

Other risks

• Unbacked queue claims. A win the LP cannot pay becomes a claim paid only from future losses. Nothing caps the queue or bounds the wait. The LP started at $0, so early winners are paid through the queue.
• Orders need the relayer. If it is down or refuses an order, you cannot open or close; your free balance stays withdrawable from your wallet. A signed order has no price limit and stays valid until its deadline, up to 61 minutes ahead; revoking your session keys voids every order they signed.
• Keys and phishing. A session key can trade but never withdraw; code running in the page could still use it while it runs. Check every signature request against official signatures.
• The token. TOKEN is minted to losers, so emissions can be farmed with offsetting positions. Transfers are disabled and will not be enabled without a separate decision. Rewards are not streamed, so a stake placed just before a distribution shares in it.
• Technology. Contract bugs, HyperEVM or HyperCore outages, changes to Hyperliquid’s precompiles and bridge failures can all cause losses or delays. Audit reports will be listed on audits.
• Legal. The terms, privacy policy and risk disclosure are being prepared with counsel and are not published yet.