Security
Hypercall is committed to building a secure trading platform. Mainnet Alpha is live, and security remains a core focus as the venue expands from constrained launch scope toward more verifiable protocol operations.
Current Status
Hypercall is currently in Mainnet Alpha. Users can deposit real USDC and trade options and Hyperliquid perps, but the venue is intentionally constrained while the team gathers production evidence.
Mainnet Alpha uses real funds. Only deposit what you are prepared to risk. Options and digital asset trading can result in loss.
Current Trust Boundaries
Account ownership, deposits, withdrawals and contract calls are on chain and directly verifiable. Matching, market data ingestion, margin checks, settlement price computation, RSM command issuance and operational response are run by the Hypercall operator today. See Trust Model for what you trust, what the contracts enforce and who holds which keys. RSM decentralization will reduce operator trust over time; see the Roadmap.
We will publish additional audit, verification, and decentralization materials as those workstreams are ready.
Architecture Security
Hypercall's hybrid architecture separates concerns:
| Component | Security Model |
|---|---|
| Matching Engine | Off-chain. Every order is an EIP-712 signed action, and every state change is written to a durable journal. |
| Settlement | Settlement price computed off-chain from public Hyperliquid oracle prices. Cash settlement is applied in engine state. |
| Accounts | Per-user Account contracts controlled by your manager wallet. Withdrawals need the manager's signature and Hypercall's margin check. |
| Perp signing | TEE route (app default, opt-in over the API): attested enclave holding the account's Hyperliquid trading key; signs only engine-approved orders, cancels and leverage changes. Smart contract route (advanced setting): your account contract. |
See Architecture for details.
Reporting Vulnerabilities
If you discover a security issue:
- Do not disclose publicly
- Email [email protected] with details
- Include reproduction steps and potential impact
- Allow reasonable time for remediation before disclosure
We appreciate responsible disclosure and will acknowledge researchers who help improve our security.
Contract Addresses
See Contracts for current mainnet addresses.