Skip to main content

Architecture

Hypercall uses a hybrid execution model: off-chain matching for speed, with on-chain settlement and account management for security.

Backend ArchitectureSingle Options Market, Multiple Order SourcesOther RoutersAdditional integrationsHypercall FrontendMM/Pro UI + MobileOrders / CancelsHypercall SDK / API Gateway• Auth / Keys• Order + Cancel• Market data + risk streamHypercall Options LayerOff-chainOrderbook& MatchingPricing /Vol SurfacesRisk EngineIM/MM, liquidationsSettlement /State SyncOracleIndex pricesSettlement TWAPDelta exposure /hedging flowsHyper EVMSettlement layerHIP-3 PerpsDelta hedging venueHyperCoreBase layer infrastructureLive integrationAdditional partners

Trust Boundaries​

Off-Chain (Hypercall Backend)​

Responsibilities:

  • Order matching and execution
  • Orderbook management
  • Pre-trade margin checks, including the portfolio check in front of every perp order
  • Liquidation orchestration
  • Market data and pricing
  • WebSocket streams

Trust assumption: you trust the operator for all of the above. See Trust Model.

On-Chain (Smart Contracts)​

Responsibilities:

  • Account ownership and manager control
  • Deposits and withdrawals
  • RSM commands (risk management operations)
  • Option tokens (OptionRegistry and OptionToken contracts)
  • Builder approval for perp orders (one-time approveZeroFeeBuilder from your Account)

Trust assumption: on-chain operations are recorded on Hyperliquid and cannot be changed by the operator alone. Who can upgrade the contracts is covered under Trust Model.

Order Execution Flow​

1. Order Submission​

User action: Submit order via POST /order with EIP-712 signature.

Backend validation:

  • Signature verification (EIP-712)
  • Pre-trade margin checks (scenario-based)
  • Order admission (tier, expiry, rate limits)

Result: Order is accepted (ACKED) and queued for matching, or rejected with reason.

2. Order Matching​

Process: Orders are matched on the orderbook using price-time priority.

Execution: When orders match, fills are created and positions are updated in engine state. Every state change is written to the engine's durable journal before it is acknowledged, and database tables are derived from that journal.

Not on-chain: Individual option matches are not recorded on-chain.

3. Position Updates​

Process: Option positions and cash are tracked in engine state and updated in real time. Perp positions live on your account's HyperCore ledger on Hyperliquid.

User access: Query positions via GET /portfolio or WebSocket portfolio channel.

4. Settlement​

Expiry settlement: Options settle in cash at expiry against a settlement price derived from the Hyperliquid oracle. The engine records the settlement price in its journal, computes intrinsic value for each position, updates cash balances and closes the positions.

For expiry times per underlying, how the settlement price is computed and what happens if the data is thin, see Settlement and Oracles.

Account Management​

Account Creation​

Process: The manager wallet calls createAccount on the Factory with a small HYPE creation deposit. The app does this for you when you enable perps or Portfolio Margin. See Onboarding (contracts).

Manager: Each Account has a manager (an EOA) who controls it and can authorize API wallets to sign orders and cancels.

Deposits and Withdrawals​

Deposits:

  • USDC: sent on HyperEVM to the Exchange contract (depositUsdcFor), which bridges it to the Exchange's HyperCore balance. Hypercall credits it once the HyperCore deposit is observed.
  • Option ERC20s: deposited through the Exchange contract, which burns them and credits the position.

Withdrawals:

  • Must pass Hypercall's margin check (sufficient margin after the withdrawal)
  • Signed by your wallet. Standard USDC withdrawals are paid out on HyperCore from the Exchange's balance through an RSM directive. Portfolio Margin withdrawals are a manager-signed send from your Account on HyperCore.

Trust boundary: Deposits and withdrawals are on-chain and verifiable.

Liquidation​

When an account's equity falls below its maintenance requirement, it enters pre-liquidation:

  • Risk-increasing orders are blocked; closing orders are still allowed.
  • The liquidator works partial liquidation orders to restore margin, with a liquidator bonus that ramps up over time.
  • If the account has not recovered within the escalation window, it moves to full liquidation, which the Hypercall engine runs.

See Liquidation for full details.

Hyperliquid Integration​

Perps​

Hypercall routes perp orders to Hyperliquid, including HIP-3 markets on the xyz dex. Every perp order is checked against your whole portfolio margin account first. After that there are two routes. The app uses TEE by default, with the smart contract route as an advanced setting; API clients choose a route by the endpoint they call:

Smart contract route (advanced setting in the app): you sign the order → Hypercall's engine checks it against your whole portfolio margin account → the order goes on-chain through your account contract to HyperCore → Hyperliquid matches it

TEE route (app default, opt-in over the API): you sign the order → the engine checks it → a secure enclave (TEE) that holds your account's Hyperliquid trading key signs the native order → Hyperliquid matches it

Only orders on the TEE route go through the enclave. Those orders carry Hypercall's builder address, so the account approves the builder once (Enable trading), and the enclave signs only engine-approved orders, cancels and leverage changes. See Perps on Hypercall.

Use cases:

  • Delta hedging options positions
  • Cross-margin: perp positions count toward portfolio margin

Cross-Margin​

HyperCore perp positions are included in portfolio margin calculations, and the requirement is the larger of the portfolio margin result and Hyperliquid's own margin. Portfolio Margin is open to every account; see Onboarding to Portfolio Margin.

RSM Commands​

RSM: the engine's replicated state machine. When engine state requires an on-chain action (a credit, a withdrawal, a liquidation step or a recovery order), the RSM signer signs a directive and Hypercall's sequencer submits it. Option expiry settlement is not an RSM directive: it is applied to cash in engine state. What each directive may do is listed under RSM Directives.

What You Can Verify​

On-Chain (Verifiable)​

  • Account ownership (manager address)
  • Deposits and withdrawals
  • Hyperliquid orders and perp positions (on Hyperliquid)
  • RSM commands (on-chain execution)

Off-Chain (Trust Required)​

  • Order matching fairness
  • Margin calculations
  • Settlement price computation (the Hyperliquid oracle inputs are public)
  • Position tracking accuracy
  • Market data accuracy
  • Liquidation trigger timing

Trust Model​

Mainnet Alpha is operator-run. You trust Hypercall to match orders fairly (price-time priority), ingest accurate market data, compute margin and settlement prices correctly, trigger liquidations on time, issue only correct RSM directives and respond to incidents. None of that is cryptographically verifiable yet; off-chain matching buys speed at the cost of that trust. The chain enforces the rest: Account ownership, deposits and withdrawals are on chain, an Account executes only directives signed by its manager, one of its API wallets or the registered RSM signer, and the contracts limit RSM directives to credits, withdrawals, liquidation state and constrained recovery actions. Perp orders on the TEE route (the app default) are signed inside an attested enclave that accepts only engine-approved orders. The RSM signer, the sequencer and the contract admin and upgrade keys are operator-controlled, and one Account upgrade applies to every Account. Exact powers, roles and addresses are in Trust and Permissions. The RSM decentralization roadmap will set out how state commitments, signer roles, dispute paths and operator controls become verifiable; Mainnet Alpha is the constrained first phase, not the final trust model.

See also:

Last updated on