Transparency & Security | HyperFlow Docs

HyperFlow Perps pools user funds to unlock institutional fee tiers — a model that only works if its custody is verifiable. These are the safeguards, and how you can check them yourself.

On-chain proof: HyperflowProof

HyperFlow mirrors its internal ledger to the public HyperflowProof smart contract on HyperEVM:

Per-wallet balances and open positions are published on-chain in batches of up to 50 records, roughly every 10 minutes, with heartbeat and watermark mechanisms so a stale or stalled mirror is itself detectable on-chain.
An append-only action log records ledger changes, with versioning that can only move forward — the history cannot be silently rewritten.
Anyone can read the contract and compare the published state against what the app reports.

This turns “trust us” into “check the chain”: a discrepancy between the platform ledger and the on-chain mirror would be publicly visible.

Verify it yourself

The HyperflowProof contract is deployed on HyperEVM mainnet at 0xe6c0d2b5191ae4448b75d8e28700e4bcde60e760.

Open the contract on the explorer

Use the link above to view the contract’s published state on HyperEVMScan.

Read your mirrored state

Query the published balance and open positions for your wallet address.

Compare with the app

Check the values against your Portfolio page. Record versions can only move forward, so any divergence between the ledger and the mirror is publicly visible and permanent.

Custody safeguards

Safeguard	What it does
2-of-4 multisig withdrawals	No single key — human or automated — can move user funds out of custody. Every withdrawal is reviewed by independent signers.
Distributed signing	Keys able to act on the master account are split across separate trust domains; no single service holds enough keys to act alone.
Insurance Fund	Absorbs liquidation shortfalls so bankruptcies are never socialized. See Liquidations.
Escalating solvency response	If the Insurance Fund is stressed, the platform degrades safely: warnings → no new positions → withdrawals frozen — never silent insolvency. These steps exist to stop losses from socializing while every account’s balance remains recorded on the on-chain mirror. A formal wind-down and recovery policy for a platform-failure scenario is an acknowledged open item — it has not yet been published, and nothing here should be read as a recovery guarantee.

Session security: trading keys

Enabling trading signs a free, off-chain message that mints a scoped trading key:

Valid for 7 days, then it must be re-minted.
A trading key can only trade — it can never move funds out of custody. Every withdrawal is a request you sign yourself, and it must then clear the 2-of-4 multisig review before funds move.
Revocable instantly from settings.
Every order is individually signed with EIP-712 (a human-readable wallet signature standard) — there are no blanket approvals.

Your wallet’s primary key is never used for order flow.

What HyperFlow can and cannot do

Can: execute the orders you sign, apply the fee schedule, pass through funding, run the liquidation engine by its published rules.

Cannot: bypass the multisig to withdraw, or rewrite ledger history without it being visible on-chain.

Detectable: the platform’s venue position is designed to mirror aggregate user positions. Because both the ledger mirror and the venue account are publicly observable, any divergence — such as trading directionally with user funds — would be publicly detectable, not merely against policy.

Alpha status

Perps trading is in alpha: access is gated by invite/access code, and conservative limits (like the per-order cap) are in force. Alpha is real trading with real funds — start with sizes you’re comfortable with, and report anything odd in the Discord.

Next: Perps FAQ