Clearing V1
Liquidations
A writer’s cover is a perp on Hyperliquid, and Hyperliquid liquidates it, not the clearing core. The cover is hedged so it can only be liquidated on the price move that puts the option out of the money, the move on which the writer owes nothing. When that happens the short is left unbacked and the position hands off to the recollateralization auction.
HyperCore liquidates, the core reads
The clearing core runs no liquidation engine of its own. The cover lives on the writer’s HyperCore account, and HyperCore margins and liquidates it natively, on its own maintenance-margin rules and its own oracle. The core only reads the result through precompiles, the perp’s size, the account’s margin, and the oracle price. A liquidation is something the core observes, never something it performs.
The self-liquidating cover
The point of the hedge is that it can fail in only one direction, the harmless one. Every mint checks that the perp points the right way, a long perp for a call, a short perp for a put, so:
- A covered call writer is long the perp. HyperCore can only liquidate that on a move down, and a move down is what pushes the call out of the money.
- A perp-backed put writer is short the perp. HyperCore can only liquidate that on a move up, and a move up is what pushes the put out of the money.
So a force-close driven by the price always lands on the move where the option is going out of the money and the writer owes no intrinsic. The naked short it leaves behind is out of the money, which is why the auction can usually buy it back for little and why the bond is sized to cover that case. The stress case is a whipsaw back the other way before the auction clears, or a bond the smile underpriced, either way insurance stands behind the shortfall.
The other force-close: funding drain
There is a second way a cover dies, and it is the dangerous one. A perp cover accrues funding, and a call writer’s long-perp cover bleeds it in contango (see Risk). If a writer lets their margin drain, HyperCore force-closes the perp on carry, not price: the perp died because it ran out of margin, not because the option went out of the money. So this force-close can land with the option still near the money and still rich, exactly where the bond can fall short and the auction leans on insurance. Keeping the cover funded is what keeps a writer out of it; the protocol’s job is to detect the now-uncovered short and open resolution promptly.
Rope: the buffer before liquidation
Rope is how far the price can move against a cover before HyperCore liquidates it, expressed as a fraction. The core reads it from the account’s value, the position’s notional, and the asset’s max leverage (which sets the maintenance margin, about one over twice the max leverage), and it holds a short cover to a slightly tighter rope than a long one.
Every mint requires rope of at least the ticker’s minRope, the rope gate in writing an option. This is also how the admin caps leverage without touching Hyperliquid: the contract cannot set a writer’s leverage, but by requiring a minimum drawdown buffer it fixes how large an adverse move the cover has to survive, and a larger required move admits less leverage.
What a force-close looks like to the core
The core detects a force-close by comparing the cover to the writer’s outstanding shorts: if the perp’s size has dropped below what the writer owes (coverSize < outstanding), HyperCore has closed part of the cover. There is no ambiguity, a writer cannot voluntarily reduce their cover below their outstanding shorts (the cover-management gates forbid it), so a deficit can only mean a liquidation.
A detected deficit is what opens resolution: the naked short is quarantined and made whole through the auction, buy-to-close or novation, with insurance behind it. See Recollateralization Auction.