Skip to navigation
Perpetuals

Transparency & Security

HyperFlow Perps pools user funds to unlock institutional fee tiers — a model that only works if its custody is verifiable. These are the safeguards, and how you can check them yourself.

On-chain proof: HyperflowProof

HyperFlow mirrors its internal ledger to the public HyperflowProof smart contract on HyperEVM:

  • Per-wallet balances and open positions are published on-chain in batches, roughly every 10 minutes. Heartbeat and watermark mechanisms mean a stale or stalled mirror is itself detectable on-chain.
  • An append-only action log records ledger changes, with versioning that can only move forward — the history cannot be silently rewritten.
  • Anyone can read the contract and compare the published state against what the app reports.

This turns “trust us” into “check the chain”: a discrepancy between the platform ledger and the on-chain mirror would be publicly visible.

Verify it yourself

The HyperflowProof contract is deployed on HyperEVM mainnet at 0xe6c0d2b5191ae4448b75d8e28700e4bcde60e760.

1

Open the contract on the explorer

Use the link above to view the contract’s published state on HyperEVMScan.

2

Read your mirrored state

Query the published balance and open positions for your wallet address.

3

Compare with the app

Check the values against your Portfolio page. Record versions can only move forward, so any divergence between the ledger and the mirror is publicly visible and permanent.

Custody safeguards

Four safeguards stand between a deposit and a loss it should never have suffered.

Multi-signature withdrawals. No single key — human or automated — can move funds out of custody. Every withdrawal is approved by a quorum of independent signers before it is released.

Distributed signing. The keys able to act on the master account are split across separate trust domains, so no single service holds enough of them to act alone.

Insurance Fund. It absorbs liquidation shortfalls so a bankruptcy is never socialized across other traders. See Liquidations.

Escalating solvency response. If the Insurance Fund comes under stress the platform degrades in visible stages — warnings, then no new positions, then a withdrawal freeze — rather than letting an insolvency grow silently, and every account’s balance stays recorded on the on-chain mirror throughout. Perps trading carries risk, and none of this is a guarantee of recovery in a platform-failure scenario.

Session security: trading keys

Enabling trading signs a free, off-chain message that mints a scoped trading key:

  • Valid for 7 days, then it must be re-minted.
  • A trading key can only trade — it can never move funds out of custody. Every withdrawal is a request you sign yourself, and it must then clear the multisig review before funds move.
  • Revocable instantly from settings.
  • Every order is individually signed with EIP-712 (a human-readable wallet signature standard) — there are no blanket approvals.

Your wallet’s primary key is never used for order flow.

What HyperFlow can and cannot do

Can: execute the orders you sign, apply the fee schedule, pass through funding, run the liquidation engine by its published rules.

Cannot: bypass the multisig to withdraw, or rewrite ledger history without it being visible on-chain.

Detectable: the platform’s venue position is designed to mirror aggregate user positions, and both the ledger mirror and the venue account are publicly observable. A divergence between them would be visible to anyone watching — the safeguard is observability, not just policy.

Next: Perps FAQ