Custody
- One vault, one account. Each vault is an EIP-1167 clone with its own address, which is its own HyperCore account. Traders’ positions never commingle.
- Trader-only withdrawals. The trader is the only address that can withdraw, in every mode and every state.
- Agents can trade, never withdraw. In vault mode the agent calls the vault; in fast mode its key is a HyperCore API wallet, which cannot withdraw.
Bounded governance
- Fee caps in the contract: performance fee at most 20%, execution fee at most 10 bps, listing fee at most 5%, builder share at least 50%.
- Risk caps in the contract: position cap at most 25%, drawdown limit at most 50%.
- Timelocked whitelist: adding a market is queued publicly and cannot execute until the delay passes. Removing one is immediate, so a bad market can be stopped fast.
- Multisig control: listings, slashing and configuration sit behind a multisig. No single key controls the protocol.
Known limits, stated plainly
- HyperCore accepts orders from HyperEVM asynchronously, so a vault reconciles its orders after the fact. Reservations expire after 1 hour and traders can cancel all of them in one call.
- In fast mode, limits are monitored by a keeper, not enforced by the vault. The UI says so before you opt in.