Risks & security

Price data and what happens if it fails#

Every price on this venue starts from data we read from other markets. We do not produce it, we do not control it, and we accept the risk that it can fail. We tell you here, openly, instead of hoping you never find out.

Where the prices come from#

Option prices are set from a listed options market for each asset, fitted by the venue's model. The market named below is the one the venue is using right now, read live from the venue. Perp marks and the spot reference come from Hyperliquid for every asset.

What can go wrong#

A source can fail, go stale, change what it publishes, or withdraw our access. If that happens:

• Option prices may stop updating. The last good prices can stay on screen while the market moves on.
• Trading may be limited or halted. The venue may allow only closing positions, or stop trading in that asset altogether.
• Marks used for margin may be stale. Margin, equity and liquidation levels are computed from marks; a stale mark can make an account look safer or riskier than it is.
• Settlement uses the last good data. How long prices can be stale before the venue steps in, and what it does at each step, is set out in the next section. A position is never settled automatically on stale data.

When prices go stale#

The venue watches two clocks for each asset, separately: how old its options data is, and how old its spot price is. Each asset is judged on its own, so a problem with one asset does not stop another. There are four states.

• Normal. Options data is at most 2 minutes old and the spot price at most 10 seconds old. Everything works.
• Degraded. Options data is between 2 and 10 minutes old (or the spot price between 10 and 60 seconds old). Only closing is allowed. New positions, new options, new perps and raising a quoting limit are refused with “Prices are stale — only closing is allowed right now.” Closes go through at the last good prices with the venue's price spread doubled, so you pay for the staleness. Margin and liquidations keep running on the live spot price and the last good options data.
• Frozen. Options data is more than 10 minutes old, or the spot price more than 60 seconds old. Trading is paused: opens and closes are both refused (“Prices are stale — trading is paused.”). No one is liquidated on stale data, and funding accrual on open options stops for the frozen time. Withdrawals are paused and go through once prices are fresh again; this lifts by itself.
• Extended. If an asset stays frozen for more than 72 hours the venue may settle its open positions at the last good data, after 24 hours' public notice. Nothing settles automatically: the notice comes first.

Prices coming back moves the asset to the right state again without anyone acting. The state of each asset, how old its two clocks are and since when are published on the venue's health page. These limits are the venue's own rule and it may change them; the page will say so when it does.

Other risks#

• Contract risk. The ledger, the front and the margin run in contracts on a young chain. A bug can lose money. The next section says how they are checked, and what that does not prove.
• Custody. Your deposits sit in a HyperCore wallet the venue controls, and the ledger records whose money is whose. If that wallet or its key failed, withdrawals would fail with it. Daily withdrawal limits bound how much can leave in a day, and a continuous check compares what the ledger says with what the wallet holds.
• A loss the insurance fund cannot cover. A trader's loss is never collected from later money, so if an account goes below zero the fund pays. If the fund runs short, the rest is counted as a shared loss among the makers who were paid. A thin fund is a real risk for a maker (section 6).
• Admin powers. The venue's admin can pause withdrawals, change fee settings inside fixed contract ceilings, and upgrade the contracts. Moving these behind a multisig and a delay, so any upgrade is public before it takes effect, is under way; until it is done, treat the admin as trusted.
• It is a testnet. No real money moves. The venue may be reset, paused or upgraded, and the numbers on screen are for testing the mechanism.

What this means for you#

Only trade or quote with money you can afford to have stuck, closed late, or marked off stale prices. If a price on screen looks frozen, treat it as frozen.

How the contracts are checked#

There is no paid third-party audit. Security rests on automated and open checking instead, in four layers. Each is designed to be run by anyone, and none of them is a guarantee.

1. Rules that must hold after every step#

A fuzzer runs long random programmes against the real compiled contracts in a local copy of the chain: deposits, withdrawals, opens, partial closes, funding, liquidations, price moves, fee changes, and calls by strangers. After every single step it checks more than twenty rules, and it prints the seed, the step and the shortest trace of any rule that breaks. In plain words the rules say:

• Money is conserved. What the cells hold equals what came in from custody, less what went out, plus the perp results the venue posted, to the cent. Nothing is created or lost by a fill, a fee, a funding payment or a liquidation.
• A refused action changes nothing. If a transaction reverts, no balance, position, mark or flag moved.
• Closing is never blocked. A close that reduces risk is never refused for margin.
• Funding is charged once. Each stretch of time is charged exactly once, never twice and never skipped silently.
• No recourse. No account but the insurance fund ever carries a debt, and your wallet's cash only falls by your own signed act.
• A flagged account takes no new risk, and an open leaves an account above its initial requirement.
• PROTECT is all or nothing: the perp and its options open together or neither does.
• A round trip never profits, fees and spreads stay inside their fixed ceilings, and privileged calls need their role.

A rule set that has never failed proves little, so the suite is also run against ten deliberately broken copies of the contracts (the fund pays but books nothing, a fee credited twice, a withdraw that skips the margin test, and so on). Each one is caught.

2. Proofs of the model#

The venue's rules are also written as theorems and checked by a Lean prover: conservation, no farming of the spread, margin, backing, the order of a liquidation. Hundreds of statements are proved, and a handful of natural claims were proved false and are kept as refutations. Each statement is tied to the contract line and the rule above that it corresponds to. A proof is about the model, not the deployed code, so the two are tied together by the rules above and by tests that compare the contracts with the engine to a millionth of a dollar.

3. Attacker agents#

Agent attackers are given the contracts and the venue and told to take money, lock others' money, or break an invariant. Round 1 ran on 7 October 2026 and found real problems, some of them serious. Each is being fixed, and each fix is re-run against the attack that found it. The rounds repeat, and their reports are published.

4. Open to anyone#

The rules, the proofs and the harnesses are written to be read and extended: anyone can add a rule or an attack, and it runs on every change. If you find something, send it through the FEEDBACK tab (section 9).