Architecture overview
Contracts on HyperEVM by default, prices from Pyth Pro checked against Chainlink.
Contracts on HyperEVM (chain 999) by default; another chain (Arbitrum or Base) if that is where both oracles are available (D14). On HyperEVM, USDC is held on HyperCore, as Papertrade does. Prices come from Pyth Pro, checked against Chainlink. The main difference from Papertrade is the oracle and the two-step fill; the rest of the structure is the same.
Contracts
| Contract | Job |
|---|---|
| Exchange | Balances, positions, settlement, the payout queue, the pool, the loss-budget limits and circuit breakers. Opens and closes arrive only through the BatchExecutor. Withdrawals and maintenance calls can come from anyone. |
| BatchExecutor | Accepts batches only from the foundation's relayer keys, unpacks each signed order and sends it to the Exchange. |
| PriceOracle | Verifies Pyth price updates, checks publish time against the order's signature time (at least 1 second after) and freshness (no more than 3 seconds old), and rejects zero or invalid prices. |
| MarketRegistry | Per-stock settings: Pyth feed ID, tier, max leverage intraday and overnight, max position size, haircut positionMultiplier, stock fee floor, caps, retired flag, session calendar, corporate-action adjustments. |
| FundingIndex | Keeps a running time-weighted average of each stock's long and short open interest, sets each hour's rate from it at the lock, collects crowded-side funding hourly from margin into the stock's funding pot, and pays receivers only from the pot. The house receives only the pot's remainder and never pays. Collects weekend funding at the Friday 20:00 close. Anyone can trigger a lock once its time has passed; a keeper does it routinely. |
| FeeScorer | Stores account scores and stock floors posted by the scorer keeper. Enforces the 1% to 10% range and the rate-of-change limits. |
| SessionKeyManager | Registers and checks session keys. Registration goes through the relayer; revocation is a direct call from the user's wallet. |
| TradeToken | $TRADE. Non-transferable at launch except into and out of staking. |
| TradeStaking | Stake, unstake, claim. Reward-per-share accumulator. |
| TradeTokenomics | Mint curve and the staker share of pool gains (the 1% / 50–80% / 80% bands). |
| DepositProxyFactory and Create2DepositProxy | A deterministic deposit address per user; sweeps USDC from HyperCore into the Exchange. |
All contracts sit behind upgradeable proxies owned by a 7-day timelock, which is owned by a 2-of-3 multisig.
A trade, end to end
- The user's session key signs an order: market, side, margin, leverage, timestamp
t, and whether it is funded from available or queued balance. - The relayer collects orders.
- The fill keeper waits for the first Pyth update with publish time at least
t + 1s, attaches it to the batch, and submits through the BatchExecutor. - The Exchange checks session hours, the order's signature and expiry, leverage and size limits, the house's per-stock and market-wide net limits, the circuit breakers, and price freshness. It reads the account's current fee rate from the FeeScorer and locks it into the position.
- On a close, the Exchange applies the deadband, haircut and locked fee to a win, or credits the pool and mints $TRADE on a loss, then pays out, queues the unpaid profit, or harvests the queue.
Many users' orders can share one transaction. Each settles independently.
Off-chain services (run by the foundation)
| Service | Job |
|---|---|
| Relayer | Receives signed orders, batches them, pays gas. The contracts accept opens, closes, session-key registration, proxy deployment and staking only from relayer keys. |
| Fill keeper | Fetches Pyth updates and fills orders per the two-step rule. |
| Liquidation keeper | Watches every position's bust price and liquidates as soon as it is crossed. Highest gas priority. |
| Session keeper | Posts open and close times, half days and holidays. Runs the auto-deleverage before each session change and triggers the funding locks. |
| Risk keeper | Posts weekly betas and tiers. The limits themselves are computed on-chain from pool equity and the $2M floor, so no keeper sets them. |
| Tier keeper | Recomputes 20-day ADV weekly and moves stocks between tiers. |
| Scorer | Computes markouts, stock floors and account scores, and posts changes. |
| Corporate-actions keeper | Posts dividend and split adjustments, sets earnings blackouts and the 5x weekend cap for pending events, flags markets for retirement. |
| Fee keeper | Pushes accumulated staker fees and the stakers' share of pool gains to TradeStaking. |
| Sweeper | Detects deposits at user proxy addresses and drives the sweep and credit. |
If the relayer stops, nobody can open or close. Users can still withdraw available balance directly with their wallet.