Risks & security

Read this before you trade or make a market.

Price data#

Every option price is anchored to a listed market we do not control: Deribit for BTC, Derive for HYPE. Perp prices come from Hyperliquid. A source can fail, go stale, change, or withdraw access.

• The mark comes straight from the oracle venue (its bid for what you bought, its ask for what you sold). So your margin and liquidation follow that venue's quotes. A per-point confidence check skips broken points, but a venue-wide error would still reach your marks until the venue freezes the asset.
• Normal — options data at most 15 minutes old and spot at most 60 seconds old: every trade carries a freshly signed price.
• Frozen — older than that: opens and closes are refused ("Prices are stale — trading is paused"), nobody is liquidated, holding costs stop accruing for the frozen time, withdrawals wait. It lifts by itself when prices are fresh. Each asset is judged on its own; its state is on /health (oracleTier).
• No licence and no second source: if a source stops, nothing replaces it automatically.

Matching risks#

• One maker per fill. Your order (or piece) fills whole from the single best maker that can take it, or not at all. A large order in several pieces may fill only in part ("may not fill fully"); you keep what filled.
• Close price vs mark. You close at the best maker's price, which can be worse than the mark your account is valued at.
• Makers see requests. Every maker's program sees each request (asset, strike, duration, size) — never who sent it — as at Derive and Paradigm.
• Crossed makers (for makers). There is no crossing breaker: if makers' quotes cross, a trader can buy from one and sell to another. The price limit caps that gain at about the oracle venue's spread. Makers carry this risk.

Other risks#

• Contracts on a young chain; a bug can lose money (how they are checked, below).
• Custody: deposits sit in a HyperCore wallet the venue controls; the ledger records whose money is whose; daily withdrawal limits bound how much can leave in a day.
• Margin per asset: BTC 15 % / 10 % floor to open, 7.5 % to hold; HYPE 30 % / 25 % / 18 %; each plus the option's mark.
• Partial liquidation: the chain closes only what it needs, stopping 15 % above maintenance.
• Insurance fund: a loss below zero is never collected from later money; a thin fund is a real risk on testnet.
• Admin powers: pause, settings and upgrades, all through a 2-of-3 multisig and a timelock (the testnet delay is short; raising it is a mainnet gate).
• It is a testnet: it may be reset, paused or upgraded.

How the contracts are checked#

No paid audit. Automated, open checking in layers: a fuzzer that runs random programmes against the compiled contracts and checks money conservation and the margin rules after every step; fixed test vectors that the contracts and the off-chain engine must match exactly (including the v11 single-best-maker rule and its round-trip bound); recurring adversarial scenarios; and a formal model of the ledger's money arithmetic (a model tied by parity checks, not a proof of the bytecode).

Kept in lockstep with the code: a check fails if this page drifts.