Clearing V1
Architecture
The protocol is a small set of contracts, with market participants and open venues around them. This is the wiring: which contract holds what, who calls what, and where the price and the collateral actually live.
The contracts
Almost the entire protocol is one contract. Only two things sit outside the core, for different reasons.
- Clearing (the clearing core): a single contract for the whole protocol, and the hub. It mints the long and short ERC-1155 legs (a ticker, an asset, strike, and expiry, is a pair of token IDs inside it, not a separate deployment), holds the option bonds, tracks each writer's outstanding shorts against their cover, runs exercise and the resolution auction, and deploys a
Trader.solfor each writer. Every venue clears through it. There is no separate factory contract, the core is the deployer. - Trader.sol (one per writer, kept outside the core): the writer's own HyperCore account, where the perp cover lives, and the contract that acts on the core on their behalf. It is isolated so each writer's collateral is ring-fenced, one writer's liquidation can never reach another's, or the pool's. HyperCore margins and liquidates it natively. See HyperEVM & HyperCore.
- Insurance protocol (external, not part of the core): the last-resort bidder in the auction. The core treats it as just another trader; its only tie is a fee lever that can route a cut of auction excess to the insurance address. It steps in at max budget and takes the short on by perp- or spread-novation. See Insurance.
The participants
- Writer: opens a perp cover through their
Trader.sol, mints options against it (locking the option bond), and sells the premium on a venue. - Long trader: buys the long leg on a venue, then holds, transfers, or exercises it through the core.
- Spread trader: trades cash-secured credit and debit spreads, cleared through the core.
- Keeper / finder: watches for funding stress and, on an under-backed short, triggers the resolution auction (and may fill it). Paid the finder fee for opening it.
The venues
CLOBs and AMMs are the venues where an option, its premium, is priced and traded. They are external to the core and open to anyone to build or fork, and every order clears through the core. Frontends sit on top of the venues, the UI a trader actually uses, routing orders to a venue and earning builder-fee attribution for the flow they bring. The core itself does not run price discovery or hold the premium.
Hyperliquid
The whole thing sits on Hyperliquid. HyperCore holds the perps, provides the native oracle the core reads, and runs the native liquidation that force-closes a cover. The core reads it through precompiles and writes to it through CoreWriter. See HyperEVM & HyperCore.
The resolution auction
The auction is part of the core, not a separate contract, and it is how an under-backed short is made whole after HyperCore force-closes a cover. A keeper triggers it; from there it bids to close, funded by the seized margin from the closed perp plus the option bond, either buying back the long leg or handing the short to a fresh writer.
Its offerings plug back into the same markets. A keeper network can post the live auction offers as signed orders on a CLOB, and the buy-to-close side is flash-arbable: buy the long on an exchange and tender it to the auction in one transaction for more premium than it cost. Recollateralizing with a new perp (novation) cannot be atomic, though, the replacement cover has to be opened and confirmed on HyperCore first (the fire-then-verify rule), so that path is a two-step flow, not a flash. Full mechanics live in Recollateralization Auction.