Failure Modes

System behavior during outages and degraded conditions.

Design Philosophy

Hypercall keeps trading where it can and fails closed where a price or margin input is missing. During failures:

Trading continues where the required inputs are valid
Failed components are isolated
Users receive explicit errors rather than stale data or made-up prices

L1 Downtime

If Hyperliquid L1 (HyperCore) becomes unavailable:

Function	Behavior
Options matching	Continues on Hypercall's book while price and volatility inputs stay valid
Perp orders	Unavailable. Perps execute on Hyperliquid.
Settlements	Delayed until enough oracle samples exist (see below)
Deposits	Blocked until L1 recovers
Withdrawals	Blocked until L1 recovers

Recovery is automatic once L1 is available again.

Oracle Failures

Price Oracle

If the price oracle becomes unavailable:

Impact	Behavior
Risk-increasing orders	Rejected once the last recorded spot price is more than 30 seconds old
Risk-reducing orders	Accepted, valued at the last recorded price
Margin and liquidation valuation	Continue at the last recorded price. No substitute price is produced.
Expiry settlement price	Never taken from the last recorded price. See Oracle Down at Expiry.

A healthy feed re-records an unchanged price at least every 10 seconds, so a flat market does not trip the 30-second limit. Recovery is automatic when the oracle returns.

IV Oracle

If the IV oracle fails:

Impact	Behavior
New Orders	Risk-increasing orders on the affected underlying are rejected
Option Pricing	No fallback price. Calculations that need the missing IV fail.
Margin Calculations	Fail closed rather than using a substitute volatility

See Volatility Oracle for the exact conditions.

Settlement Failures

Oracle Down at Expiry

Settlement prices use a 30-minute TWAP window before expiry. The outage rules for marks above do not apply to the settlement price. If oracle data is unavailable:

Partial outage: the TWAP is computed only if the window holds at least 500 samples. Hypercall can rebuild a short window from archived Hyperliquid oracle history, under the same minimum.
Complete outage: settlement waits until a window with at least 500 samples is available. It does not settle on the last recorded price, a partial window or a substitute price.

Settlement can also be delayed without an outage if the finalized TWAP is not available at the exact expiry tick. In that case, the instrument remains in Expired Pending Price, trading stays disabled, and settlement retries automatically until the finalized price exists.

The TWAP algorithm is designed to resist manipulation. See Oracles for details.

API Downtime

If the Hypercall API becomes unavailable:

Component	Status
Trading	Unavailable. Options orders, cancels and perp orders all go through the Hypercall API.
Positions and balances	Held in the engine's durable journal and restored on restart
Open Orders	Part of engine state and restored on restart. You cannot cancel them until the API is back.
Perp positions	Stay on your Hyperliquid account
WebSocket subscriptions	Disconnected

Recommendations

Implement reconnection logic with exponential backoff
Cache critical data locally
Check GET /health before trading
Assume resting orders stay live through an API outage, and size resting quotes for that

Health Endpoint

Endpoint	Purpose
`GET /health`	Basic liveness check
`GET /ready`	Full readiness including dependencies

Incident Communication

During incidents, check:

Design Philosophy​

L1 Downtime​

Oracle Failures​

Price Oracle​

IV Oracle​

Settlement Failures​

Oracle Down at Expiry​

API Downtime​

Recommendations​

Health Endpoint​

Incident Communication​