HIP-3: builder-deployed perpetuals

On a HIP-3 dex the deployer defines and runs the market. It writes the oracle definition and contract specification, publishes prices, sets leverage limits and settles if needed; HyperCore supplies margining, books and liquidation.

Validator-operated perps list on “community request and organic demand” (docs FAQ). HIP-3 hands listing to builders.

The deployer publishes the price, the protocol clamps it

The deployer, or an oracleUpdater it names, pushes oracle prices, mark inputs and external perp prices through setOracle. The mark for margin and liquidation is the clamped median of up to 2 deployer marks and the book’s local mark (median of best bid, best ask, last trade); see oracles.

Say the deployer’s mark inputs are 100 and 102 and the local mark 101. The median is 101. From a previous mark of 100, that is the most the 1 per cent clamp allows in one update.

Each dex is its own venue

A dex has its own margining, books and settings, and names assets dex:COIN. Any quote asset can be collateral; if validators revoke that status, dexes using it are disabled, but their deployers are not slashed. Assets after the first 3 go through a Dutch auction shared across dexes, with HIP-1 parameters, or spend a reserve deployment.

Trading uses the same order action as any perp; only the asset id differs. Docs example: testnet test:ABC, dex index 1, meta index 0, is asset 110000 (asset ids).

haltTrading settles and recycles an asset

haltTrading cancels an asset’s orders and settles every position at the current mark. The same action resumes trading on the recycled asset, so dated contracts need no new auction. Once every asset is settled, the stake can be unstaked (what it costs).

Cross margin is earned, and permanent

Cross margin is enabled per asset, irreversibly, and only with observable liquidity, a reliable external oracle and manipulation resistance. Each 50 per cent move triggers a validator manipulation review; assets expected to do that more than once a month are ineligible and themselves slashable. The backstop liquidator absorbs cross-margin positions only, falling back to auto-deleveraging.

Slashed stake is burned, not paid out

Stake above the requirement can be unstaked. Slashing is a stake-weighted validator vote, the amount the stake-weighted median, and the HYPE is burned, not paid to affected users.

It guards correctness, uptime and performance, and per the docs anything slashable should come with a protocol bug fix. It cannot tell malice from incompetence, a bad spec or stolen keys. Malicious attempts are slashable even if harmless, ordinary inputs that hit a bug are not, and subjective disputes go to the application and social layers.

The numbers

Parameter	Value
Stake	500k HYPE, at least 183 days after deployment
Unstaking queue	7 days, still slashable
Dexes per deployer	1
Assets without auction	first 3 per dex
Reserve deployments	7 + 0.2 * n_auction_deployments
Dex name	2 to 4 lowercase characters
Asset id	100000 + perp_dex_index * 10000 + index_in_meta
Oracle updates	expected every 3 s; at least 2.5 s apart
Mark price clamp	1% per update; 10x start-of-day value
Max leverage	1 to 50, per margin tier
Deployer fee share	0 to 300%; 0 to 100% in growth mode
Slashing guideline	up to 100% for invalid state transitions or prolonged downtime; up to 50% for brief downtime; up to 20% for degradation
Cross margin review trigger	external perp price moves more than 50% from start of day
Backstop liquidator	0x4000...0000 + dex_index

What changes when you trade a HIP-3 perp

• Fees can reach 6 times normal. Above a 100 per cent deployer share the protocol fee rises to match: 3 units each at the maximum. Growth mode cuts all-in fees by at least 90 per cent, only on markets disjoint from validator-operated perps (fees).
• The deployer shapes your price and exit. It supplies part of the clamped mark, and haltTrading settles you at the mark at its discretion.
• Margin is per dex in Standard mode; unified and portfolio margin share collateral across dexes with the same collateral token (account modes).
• Many assets are isolated only. Mainnet rate and volatility underlyings run without cross margin, so the backstop liquidator skips them and auto-deleveraging is likelier in fast markets.

Creating and reading a dex from code

Creating a dex is one signed registerAsset2 (deploying a perp dex). To read one, perpDexs lists every dex (entry 0 is null, the validator-operated dex), meta with a dex field returns its universe with prefixed names, and perpDexLimits its caps.

What mainnet shows

• The lock holds. On mainnet (2026-09-20) every dex with open interest or volume had a deployer with at least 500k HYPE in its own staking account; 4 dormant dexes’ deployers released stake 189 to about 418 days after depositing.
• Several dexes, one stake may come in a future upgrade. One mainnet address carries 2 dexes on 586,072 HYPE, but one had no open interest, so a shared bond is unresolved.
• Collateral is fixed. No action alters collateralToken; migration is only a documented future upgrade.
• No slash on record. The docs say slashing “never happens” in the most likely outcome; in all 12 mainnet HIP-3 and HIP-4 deployer accounts (2026-09-20), HYPE left only by requested withdrawal.

To run a dex day to day, see operating a perp dex; for bounded payoffs on one, see how the HIPs compose.