How the HIPs compose

HIP-3 and HIP-4 each open one dimension of market design and close another.

	HIP-3 perp	HIP-4 outcome
Payoff	linear, leveraged, no expiry	bounded between 0 and 1 per contract, dated, fully collateralised
Underlying	any series the deployer publishes through its own oracle	whatever an approved template names
Who defines the semantics	the deployer	validators, by voting templates in
How the price reaches the contract	deployer pushes oracle and mark inputs every 3 seconds	deployer settles once, reading the source the template names
Stake	500k HYPE, 183 days	500k HYPE on mainnet, 183 days; the two stack

Neither alone offers a bounded payoff on an arbitrary series: HIP-3 cannot express the payoff, and HIP-4 cannot name the series. On mainnet the scalar template’s semanticRestriction requires the underlying to be the price of a Hyperliquid perp.

Take a band with low 5 and high 5.25 on a HIP-3 perp. If the TWAP settles at 5.1, Long pays (5.1 - 5) / 0.25 = 0.4 and Short 0.6.

One keyword type bridges the two

Template keywords are typed and validated per type, not per template. hlPerp is documented as the “coin name of an existing perp, e.g. "ABC" or "test:ABC"”, and values may contain : so HIP-3 names fit. binaryPrice, priceTouch and scalarPrice all take a perp keyword of that type.

hlPerp accepts a dex-prefixed coin, so one deployer can list bands on another's perp. Proven on testnet by transaction.

A band is a call spread

scalarPrice has sides Long and Short and 6 keywords, and settles on the seconds-second TWAP of the price in priceDescription, ending at time:

long(P)  = min(max(P - low, 0), high - low) / (high - low)
         = (max(P - low, 0) - max(P - high, 0)) / (high - low)
short(P) = 1 - long(P)

The second line is a call spread struck at low and high, per unit of band width. n adjacent bands of width w from L0 sum to min(max(P - L0, 0), n * w) / w: a capped linear exposure, so a ladder rebuilds a bounded perp, and a single band gives option-like exposure no HIP-3 perp can.

The outcome deployer need not own the perp

Read, 2026-09-20	Finding
Mainnet	35 of 228 active outcomes named a dex-prefixed coin in perp; none of the 228 was a scalarPrice instance, so the scalar half was unused
Mainnet	every venue listing outcomes on a HIP-3 dex was run by an account other than that dex’s deployer
Testnet, by transaction	4 standalone scalarPrice3 outcomes (ids 20351 to 20354), bands 0.25 wide from 4.5 to 5.5, on a HIP-3 perp tracking a US 10-year yield, on a dex the outcome deployer did not own; settlement on the 3600-second TWAP ending 20261015-1600; all 4 accepted first time and read back from outcomeMeta
Testnet, earlier	a third-party outcome (12393, template scalePrice) had already used a dex-prefixed coin in a scalar template

The numbers

Stake by structure, at an illustrative 91.25 USD per HYPE:

Structure	HIP-3 stake	HIP-4 stake	Total locked
One party runs the perp and lists the bands	500k HYPE	500k HYPE, stacked	1M HYPE, about 91.3M USD
Bands on someone else’s perp, from a new venue	none	500k HYPE	500k HYPE, about 45.6M USD
Bands on someone else’s perp, from an existing venue	none	none additional	none additional

scalarPrice keywords and their value rules:

Keyword	Type	Rule
perp	hlPerp	an existing perp; dex:COIN accepted
low, high	uDecimal	no sign, exponent, or leading or trailing zeros
seconds	uInt	non-negative integer, no leading zeros
priceDescription	string	free text, at most 100 characters, no braces or pipe
time	dateTime	UTC YYYYMMDD-HHMM, within the next year

Both deployers stand behind a band

A band on a HIP-3 perp carries two deployers’ risk:

• The HIP-3 deployer sets the price: the oracle and part of the mark (clamped to 1 per cent per update), and it can halt the perp and settle at the mark.
• The HIP-4 deployer sets the payout, reading the TWAP the template describes.

Check both, and read priceDescription, which names the TWAP’s price. Outcome fees go only to the HIP-4 deployer and the protocol, never to the HIP-3 deployer.

Listing a band from code

A band is one registerStandaloneOutcomeFromTemplate, keywords signed as pairs sorted by keyword:

{
  "type": "outcomeDeploy",
  "venue": "ab",
  "operation": {
    "registerStandaloneOutcomeFromTemplate": {
      "id": "scalarPrice",
      "keywordToValue": [
        ["high", "5.25"],
        ["low", "5"],
        ["perp", "test:ABC"],
        ["priceDescription", "the test:ABC mark"],
        ["seconds", "3600"],
        ["time", "20261015-1600"]
      ],
      "deployerFeeScale": "1"
    }
  }
}

• uDecimal values must be canonical. A generator’s "95.000" signed correctly but was rejected on submission (the exchange wants "95"), a server-side check no dry run catches.
• Template ids differ by network. Mainnet has scalarPrice; testnet has scalePrice, scalePrice2 and scalarPrice3 (same 6 keywords) and no scalarPrice. Test on a testnet id, deploy the mainnet one (templates).

What the design leaves open

• Perp halts are undefined. scalarPrice says nothing about a band whose perp is halted, settled or recycled before time. State it in the market’s terms before listing.
• Manipulation resistance caps safe open interest, since a bounded payoff makes an attacker’s gain exact. On a HyperCore borrow-rate perp, an 8-hour smoothing window defended about 3,300 USD and a month-long one about 296,000 USD (20 per cent attacker hurdle, 3x safety margin); see options on the borrow rate.
• Quote rates as 100 - rate. A HIP-3 external price moving over 50 per cent in a day triggers validator review: a rate going 5 to 10 per cent moves 100 per cent, but 95 to 90 only 5.3 per cent.
• Risk passes through, stake does not. The outcome deployer bears no slashing for the perp’s oracle and has no control over it.

For each half on its own, see HIP-3 and HIP-4. For what each stake costs, see deployer economics and risk.