Skip to main content
Three flows reach the vault and raise the share price: half of each activation premium, half of each subscription fee, and the vault’s residual on a forfeiting close. None of it is guaranteed, and any of it can be zero. One flow can run the other way. Every funded account carries a buffer B posted by its builder, and a principal loss consumes B before it touches LP capital. The risk engine closes the account when it breaches its floor, which is where B runs out, so in the ordinary case the loss stops there. If a loss overshoots B, the part beyond it is reserveDeficit, and that lands on you.

​
What pays the vault

An ordinary close pays the vault nothing. When an account closes for expiry, cancellation, admin action or a reached target, profit is split between trader and builder by builderPoolBps and the vault’s share is zero. The residual in the last row exists only on a forfeiting close. Do not model LP return as a cut of trader profit.

​
What the vault does not earn

​
Where a loss can reach you

The risk engine closes an account when its equity falls below its floor. The trailing floor starts at exactly A − B and rises only as accepted profit locks in, so the buffer is sized to cover the whole of the designed fall and the engine is meant to act before LP capital is touched. Settlement then compares Q, the capital actually recovered from HyperCore, against the account size A:
reserveConsumed is the builder’s money. reserveDeficit is yours, and it is the only way a closing account can move the share price down. The fall is exactly reserveDeficit. A deficit appears only when the risk engine cannot close the account at its floor: a gap, a HyperCore liquidation, slippage during a forced close, or a settlement that recovers less than the snapshot. Nothing reimburses it, and the premium already collected on that account is the only sum ever charged against the possibility.

​
Risks

Placing capital in the vault involves several risks that affect share value and LP yield.
In extreme volatility a position may realize a loss below the floor before the risk engine’s close completes, and the engine is off-chain, so anything that delays its close widens the overshoot. Everything down to A − B is covered by the builder’s buffer; the overshoot is reserveDeficit and lands on the share price directly. The vault’s half of the activation premium partially absorbs this, but does not guarantee full coverage. Several overshoots in one market move add up, and a deficit is not netted against accounts that closed whole: their unused drawdown goes back to their builders.
LPs do not participate in trader selection or activation parameter decisions; these are made by builders. Activation is permissionless: any wallet that can pay B + P becomes the builder of record, with no registration and no approval. Deterioration in underwriting quality by any builder affects vault yield in proportion to their share of active issuance.
MainVault and FundedAccount carry smart-contract risk. The codebase has had an independent audit, but residual risk cannot be eliminated, and the audited implementation is not frozen. See governance risk below. The vault also reads equity from HyperCore precompiles and settles through Hyperliquid’s bridge. An outage in either delays closes and settlements, and a loss that results is borne by vault capital.
Shares are not locked against open funded accounts, for any LP. What limits an exit is the utilization ceiling measured after the burn, the EVM cash left after what is reserved for builders’ money on open accounts and for unclaimed refunds and payouts, and whether the protocol is paused. Allocated capital cannot be recalled to serve a withdrawal, so a full exit may be unavailable until accounts close.
The account-size band, the drawdown band, the utilization ceiling, the per-account ceiling and the vault cap are set by the owner in one call. The utilization and per-account ceilings, and the top of the drawdown band, have bounds compiled into the contract; the account-size band and the vault cap do not. The owner can also replace the vault implementation. Neither carries an observation window today. Separately, a pause disables every LP withdrawal path while leaving payout claims working; the owner or the relayer can trigger one, and only the owner can lift it.

​
Next

Vault

What the vault holds, what limits allocation, and what limits an exit

Security

Audit, upgrade authority, and administrative safeguards

Account Parameters and Fees

How B and P are priced on the account the vault funds