Skip to main content

Contracts

Mainnet Alpha

These are the current Hypercall Mainnet Alpha contract addresses. Launch scope is intentionally constrained while the venue widens.

Hypercall's on-chain components are deployed on HyperEVM (chain ID 999). Each user gets an Account contract; the Exchange holds venue USDC and option custody and executes signed directives against Accounts; the Factory creates Accounts; the Option Registry deploys and recognizes option tokens.

Contract Responsibilities​

Exchange​

Upgradeable proxy. Version 0.6.1 on mainnet.

  • Holds deposited USDC on HyperCore for the venue (depositUsdcFor, depositPmLiquidityFor).
  • Burns option ERC20s on deposit and emits Deposit for the engine to credit (depositOption).
  • Registers Accounts created by the Factory and tracks each Account's manager (getAccounts, getAccount, managers).
  • Executes signed directives. executeUserDirective forwards a manager- or API-wallet-signed directive to the Account. executeRsmDirective runs an RSM-signed system directive (credits, withdrawals, liquidation state). Both are callable only by Hypercall's sequencer; users sign, Hypercall submits.
  • Tracks used nonces per signer (isNonceUsed).

Account​

One per user, deployed as a BeaconProxy. Version 0.2.4 on mainnet.

  • Owns the user's HyperCore balances and positions. Perps and spot sit on the Account's HyperCore ledger.
  • Has one manager (the EOA that created it) and any number of named API wallets.
  • Verifies directive signatures. API wallets may sign orders and cancels; everything else needs the manager. See EIP-712 Signing.
  • Manager-only direct calls: transferTo(recipient, token, amount) moves HyperEVM tokens out of the Account, and approveZeroFeeBuilder(builder) approves a Hyperliquid builder at a 0% maximum fee. Hypercall perp orders carry the Hypercall builder code, so this approval is required once before the first perp order.
  • depositSpot bridges HYPE or a supported spot token from HyperEVM to the Account on HyperCore.

Factory​

Creates Accounts with createAccount(uint96 salt). The address is deterministic per manager and salt; predictAccount(manager, salt) returns it before creation. See Onboarding.

Router​

Funding helper. deposit(account, token, amount, isPerp) routes USDC to HyperCore through Circle's CoreDepositWallet, spot tokens through the Account, and option tokens through the Exchange. depositHype(account) bridges native HYPE.

Option Registry​

Deploys option ERC20s and is the source of truth for whether a token is a supported option (isSupportedOption).

Directive Types​

DirectiveSignerDescription
hl_limit_orderAPI walletHyperliquid limit order
hl_cancel_by_oidAPI walletCancel by Hyperliquid order ID
hl_cancel_by_cloidAPI walletCancel by client order ID
hc_update_api_walletManagerAdd, replace, or remove a named API wallet on the Account
hl_add_api_walletManagerApprove a Hyperliquid API wallet for the Account on HyperCore
hl_send_assetManagerSend assets from the Account on HyperCore
hl_set_abstractionManagerSet the Account's HyperCore account mode (unified only)

RSM directives (credits, withdrawals, liquidation start and stop, reduce-only recovery orders) are signed by the RSM signer and submitted by the sequencer. Users never sign them. See RSM Directives.

Liquidation​

Liquidation runs in the Hypercall engine. See Liquidation. The Exchange has hooks for an on-chain auction contract to transfer an Account's manager to a winning bidder, but no auctioneer is configured on mainnet.

Trust and Permissions​

This section is the reference for who can do what on chain. For the short version, see Trust Model.

Submission​

Only Hypercall's sequencer holds SEQUENCER_ROLE on the Exchange, so it is the only caller of executeUserDirective and executeRsmDirective. You sign; Hypercall submits. The sequencer cannot forge a user directive: the Account recovers the signer itself and accepts only its manager or an active API wallet.

RSM Directives​

When engine state requires an on-chain action, the RSM signer signs a directive and the sequencer submits it. The Exchange rejects any RSM directive not signed by the registered RSM signer (Exchange.rsmSigner). The current RSM signer is operator-controlled; the roadmap will publish how this role is decentralized or otherwise made more trust-minimized.

Directives the Exchange runs itself:

  • Sends of USDC or spot tokens from the Exchange's HyperCore balance, including standard USDC withdrawals
  • Minting option ERC20s to an address when options are withdrawn
  • Starting and stopping liquidation on an Account

Directives an Account accepts from the RSM, enforced by the Account contract:

  • Reduce-only IOC orders, or near-market IOC spot sells into USDC, on the Account's Hyperliquid balance
  • Asset sends from the Account on HyperCore, to the Exchange only (for example to cover a negative balance)
  • Order cancels

RSM directives still run while an Account is in liquidation. Option expiry settlement is not an RSM directive: it is applied to cash in engine state. The RSM signer address and every directive execution are visible on chain.

Upgrades​

  • Exchange and Option Registry are upgradeable proxies.
  • Account and Option Token are BeaconProxies. Every Account runs the same implementation, so one upgrade of the Account Beacon changes every Account at once. The same holds for option tokens and the Option Token Beacon.
  • The Timelock owns the Exchange proxy admin and the Account, Option Token and Option Registry upgrade paths, with a 30-second minimum delay.
  • The Admin Safe multisig holds the Exchange admin and governor roles and the Factory owner role.
  • The governor role, held by the Admin Safe, can replace the RSM signer and the auctioneer and move the Exchange's USDC (rescueUsdcToEvm). It moves under the timelock in step 1 of the trust plan. As Exchange default admin, the Safe can also grant or revoke SEQUENCER_ROLE and every other Exchange role directly, without the timelock.

Their addresses are in the Mainnet Configuration table below. Account ownership changes only through an on-chain transaction.

Deployed Addresses​

Mainnet Alpha​

ContractAddressDescription
Exchange0xE6b7FaA216cabb2b38B392f577C9c826378b2240Main exchange contract
Exchange Implementation0xF7F0610aC612d140bdb34DCD2872828Bc67349cDExchange implementation behind the proxy
Account Implementation0xCD87F572bef2855c8Ffb69A6Da3D9785d6017791Account implementation
Account Beacon0x1b96D6a48d1fB34dC45953697414656D2851Ca93Account beacon
Fetcher0x8654912Eae1554662665C13EeD4f1D8A4b028aDBRead helper contract
Option Token Implementation0x6D0C7a116f9561A8De692c23c4C11682738ed206Option token implementation
Option Token Beacon0xfb320352B25Dba7f139EA9Bf8966891CCa12dC35Option token beacon
Factory0x2CeeAC2E032e4cCb05FF744619BfAb8cC75efE1bAccount factory
Router0xF41FF41B6F007dE851ACc9F43Bd2f597Da741E2DFunding and routing helper
Option Registry0x8C8efdd5F78C25215d03c8BbD5D1f6f0F1BB0598Option token registry
Option Registry Implementation0xF222421a93df1086E329503723b3cC4c30546C46Option registry implementation behind the proxy
Hypercall Fee Collector0x406ceBfC7063e55761007D1C4b66B29308016602Hyperliquid builder address on perp orders (also hl_builder_address in GET /exchange-info)

Mainnet Configuration​

ParameterAddress or ValueDescription
USDC0xb88339CB7199b77E23DB6E890353E22632Ba630fHyperEVM USDC used by Hypercall
Core Deposit0x6B9E773128f453f5c2C60935Ee2DE2CBc5390A24HyperCore deposit helper
RSM Signer0x502E7fAbF34E84EeB115C34FE947b79A94dF886ECurrent operator-controlled RSM signer
Sequencer0x56a2924217C91EB4d6989Cf4C7b4dF03020E8944Current sequencer
Timelock0x96f17e6f7269cA4300a391514c109eBA70661674Owns the Exchange proxy admin and the Account, Option Token and Option Registry upgrade paths. 30-second minimum delay.
Admin Safe0xF741246D2e0ADD4EFa7e88BE0961cccf3562b502Multisig holding the Exchange admin and governor roles and the Factory owner role

Source Code​

Contract source code will be made available after audit completion.

Last updated on