Clearing V1
Risk
The model concentrates risk where it can be bounded. A writer’s downside is their perp and the bond behind it; a long holder’s risk is a force-closed counterparty, which the auction and insurance absorb. What is left is the tail of many covers failing at once, which is what the insurance pool and the admin failsafes are for.
The writer’s risk
A writer runs a perp on Hyperliquid, so their first risk is an ordinary liquidation: if the price moves against the cover past its rope, HyperCore closes the perp and the writer takes that loss like any perp trader. What is specific to writing is what the liquidation triggers here, a force-close of the option. On a clean exit or an out-of-the-money expiry the bond refunds; on a force-close it does not, it funds the recollateralization auction, so a liquidated writer forfeits the bond on top of the perp loss. Keeping rope healthy is how a writer avoids that.
Managing the cover
A writer opens, tops up, and closes their cover through their own Trader.sol account, and the core holds one rule over it: the cover can never drop below the writer’s outstanding shorts on that asset. reduceCover reverts WouldBreachCover if it would cross that floor, and closeCover reverts while any short is still outstanding. One perp backs every option a writer has sold on that asset (a shared cover), so the floor is the sum of those shorts, not any one of them. To free the cover, the writer first closes or settles the options resting on it.
Funding the cover
A perp cover accrues Hyperliquid funding, and keeping it paid is the writer’s job. In contango a long-perp cover (a call writer) bleeds funding, while a short-perp cover (a put writer) earns it. HyperCore charges it hourly straight to the writer’s Trader.sol margin, so a writer pays it by keeping that account funded, holding a buffer or topping up ahead of time (add-margin is a first-class cover op for exactly this). Let the margin drain and the cover is force-closed on carry alone, which is the more dangerous kind of force-close, see Liquidations.
Rope, and staying clear of liquidation
Rope is the drawdown buffer between the current price and the writer’s liquidation. The mint only admits a write with rope at or above the ticker’s minRope, but rope erodes as the price moves and as the writer stacks more shorts onto the same cover. A writer holds it up the usual perp way, more margin or less size, and because the cover is self-liquidating, the move that would liquidate it is the same move carrying their options out of the money.
Liquidation, whatever the cause
The core never reads Hyperliquid’s maintenance-margin math and does not care why a cover was liquidated. Keepers surface the fact of a liquidation, not its reason, so a cover force-closed by a price move, by a funding drain, or by a change Hyperliquid makes to the asset’s margin parameters is handled the same way: the now-uncovered short goes to the auction. A margin-rule change on Hyperliquid is not a special case the core models; it only changes when Hyperliquid would liquidate, and the core treats that liquidation like any other.
What the protocol does control is minRope, its own per-ticker leverage cap, set so the bond can recollateralize the short a liquidation leaves behind. Hyperliquid’s bare maintenance margin can be far too tight for that: liquidate a $2,000 cover after only a 2% move and the short is barely out of the money and still expensive, so the bond priced at mint may not cover the buy-back, least of all on a long-dated option whose low delta means a $40 move hardly cheapens it. Requiring a wider rope forces enough margin that a liquidation lands where the bond is reliably sufficient. It is also why longer tenors are the harder case: their low delta and high vega leave the bond most exposed to an IV spike, so their volatility floors are set most conservatively.
The long holder’s risk
A long holder’s counterparty can be force-closed. When that happens they may not be able to exercise against that position, a short mid-recollateralization is not a valid backing short, but they are not left holding an empty option: the long is bought back through the auction, with insurance behind it, so the holder is made whole even though the exercise path is closed. See Exercise & Settlement for when a long can and cannot be exercised.
Systemic risk
The tail is correlated: a large, fast move can force-close many writers on a ticker at once, and then everything routes through the auctions, where insurance is the last-resort bidder for whatever the bonds and the market cannot clear. That is the tail the pool is sized against, and it is capitalized by the same auctions it backstops. The admin holds the failsafes for it, halting new mints on a ticker, raising its IV so fresh bonds are fatter, or adjusting the smile, all of which touch only new writes, never the terms of options already open. See Insurance and Admin.
Solvency, stated plainly
At the center of the design is a trade the protocol does not hide: an ironclad "the buyer is always paid" guarantee is given up for capital efficiency and depth. On a fully-collateralized venue the buyer is always paid; here the buyer’s payout on a force-closed write is backstopped, in order, by the bond, the auction, and insurance. If a correlated tail exhausts the insurance pool, that backstop runs out, and options on the ticker become partially backed, not solvent for every long holder. That is the failure mode, and it is stated, not buried.
The mitigations are deliberate. The bond is over-collateralized on purpose, sized at a high floor IV even at the cost of writer capital efficiency, so the modal force-close is over-funded. And the insurance pool is fed aggressively early, a heavier cut of the auction excess while it is thin, so the backstop is deep before it is needed. The aim is that a real tail event reads as a stress test the protocol passed, not a protocol that blew up.