Skip to main content
The vault receives half of each activation premium and half of each subscription fee. Idle capital placed in Hyperlend can also earn interest. These flows raise share value, but do not guarantee a positive net return. Losses can run the other way. Every funded account carries a buffer B posted by its backer, and a principal loss consumes B before it touches LP capital. The risk engine starts closing at a floor breach, but the final execution price is not guaranteed. If a principal loss exceeds B, the part beyond it is reserveDeficit, which reduces LP assets.

What pays the vault

A close pays the vault nothing. When an account closes for expiry, cancellation, admin action or a reached target, profit is split between trader and backer by builderPoolBps. When it closes on a drawdown breach or the trader’s own request, the forfeited profit is split between the backer and the protocol. The vault’s share is zero either way. Do not model LP return as a cut of trader profit.

What the vault does not earn

Where a loss can reach you

The trailing floor starts at A − B and rises as accepted profit locks in. A backed account may close earlier because its daily floor is higher. The buffer covers principal loss down to A − B; a floor breach starts closing but does not guarantee that price. Settlement compares Q, the snapshotted Core USDC used for the return, against account size A:
reserveConsumed is the backer’s money. reserveDeficit is the principal loss borne by LPs: it reduces vault NAV by that USDC amount. The effect on the price of one share depends on the number of shares outstanding. A deficit arises when Q is below A − B, for example after a gap, HyperCore liquidation or slippage during a forced close. The settlement formula provides no reimbursement beyond that account’s buffer. Fees and interest already earned contribute to NAV, but are not a guarantee against losses.

Risks

Placing capital in the vault involves several risks that affect share value and LP yield.
In extreme volatility a position may realize a loss below the floor before the risk engine’s close completes, and the engine is off-chain, so anything that delays its close widens the overshoot. Everything down to A − B is covered by the backer’s buffer; the overshoot is reserveDeficit and lands on the share price directly. The vault’s half of the activation premium partially absorbs this, but does not guarantee full coverage. Several overshoots in one market move add up, and a deficit is not netted against the buffers of accounts that closed whole.
LPs do not participate in trader selection or activation parameter decisions; these are made by backers. The protocol does not require backers to register or obtain approval before direct activation, but each activation must satisfy the vault’s parameter, liquidity and utilization limits. A backer’s choices affect LP returns through its accounts’ fees and any losses beyond their buffers.
MainVault and FundedAccount carry smart-contract risk. The codebase has had an independent audit, but residual risk cannot be eliminated, and the audited implementation is not frozen. See governance risk below. The vault also reads equity from HyperCore precompiles and settles through Hyperliquid’s bridge. An outage in either delays closes and settlements, and a loss that results is borne by vault capital.
Idle USDC placed in Hyperlend is exposed to that pool’s contract and liquidity risks. The vault includes hUSDC in NAV, but an LP exit that needs to redeem it can fail if the pool cannot return the required USDC. Backer buffers and payout liabilities are not parked there.
Shares are not locked against open funded accounts, for any LP. What limits an exit is utilization after the burn, unencumbered EVM cash plus USDC redeemable from Hyperlend, and whether the protocol is paused. Allocated trading capital cannot be recalled to serve a withdrawal, so a full exit may be unavailable until accounts close.
The owner, a multisig, can change the risk configuration. Utilization, the per-account share of NAV and maximum drawdown have fixed bounds. Account sizes must remain positive and ordered, but they and the vault cap have no fixed economic upper limit. The owner can also replace the vault implementation; both actions wait 72 hours in the timelock. A pause disables LP withdrawals while leaving payout claims available. The owner or relayer can pause, and only the owner can unpause.

Next

Vault

What the vault holds, what limits allocation, and what limits an exit

Security

Audit, upgrade authority, and administrative safeguards

Account Parameters and Fees

How B and P are priced on the account the vault funds