Safety and hedging
Hedged on Derive, minute by minute
The pool sells you convexity and buys it back on Derive as a weekly options strip plus a perp for the linear leg. The keeper rebalances about once a minute and marks the pool's value against the hedge. Far-out-of-the-money wings cover the jumps a hedge can't follow. If Derive is unreachable for five minutes, every market goes reduce-only: no new risk opens until the hedge is back.
Gap stress cap
Every open is checked against a designed one-hour gap: ETH −15% / +20%, HYPE −30% / +40%, widening as realized volatility rises (up to 2.5×). If the pool, after the insurance fund, couldn't absorb its loss on that gap, the open is refused. As the gap budget fills, maximum leverage slides down for new positions.
Circuit breaker
A move of 5% in ETH (8% in HYPE) within a minute pauses new opens for 15 minutes. Closes always work.
Backstop, in order
- Insurance fund, built from 10% of trading fees while under its target (2% of open interest), half of liquidation fees, and knock-out buffers.
- Protocol fees.
- Auto-deleverage: if the pool's marked value is still negative after a gap beyond everything planned for, the most profitable positions are closed, each keeping its collateral and all but a haircut of its profit. The haircut is the same share for every closed position and at most 50%. Markets then run reduce-only for an hour.
Nothing is left owed and losses never reach your collateral; the vault never owes more than it holds.
Prices
The index is Hyperliquid's oracle price (a stake-weighted median of exchange prices), cross-checked against Derive's index. With three or more sources any one more than 0.5% from the median is dropped; with two sources disagreeing by more than 0.5% there is no price and opens pause. Opens and closes need a price less than 15 seconds old.
Proof of reserves
On testnet and mainnet deposits sit in a vault on Elysium. The engine posts a Merkle root of every balance, and the vault's escape hatch pays your last proven equity even if the operator disappears. In paper mode there is no vault: money stays in the engine.
No single point of failure
Three engine nodes in two regions share one durable log. Every acknowledged write is durable before you see it; a dead leader is replaced in seconds. The whole state is rebuildable from the log.