Clearing V1
Writing Options
An option can be backed by a Hyperliquid perp (the capital-efficient default) or, for a put, by a cash lock. To write the perp-backed kind, the writer opens a perp cover and mints against it: the mint checks four gates against their live HyperCore account, and if all hold, the core locks the option bond and mints the long and short pair.
A covered call, end to end. A writer already long ETH sells a call against that perp and mints, and the two branches show what each piece of collateral does next: the bond backstops a force-closed short through the auction, and the perp itself pays the holder when the option lands in-the-money.
Collateral modes
An option can be backed two ways, and the choice is the writer’s:
- Perp-backed (the default, and where the capital efficiency lives). The cover is a Hyperliquid perp, a long perp for a call, a short perp for a put. The writer posts margin, not the full notional, so a 1x perp fully backs the option and any leverage above that is just how they write cheaper. This is the path the four gates below describe, and the one that can be force-closed.
- Cash-secured puts. A writer who would rather not run a perp locks the cash they would owe if the put is assigned (the strike, in the stablecoin the protocol settles in). It is fully collateralized from the start, so it needs no perp cover, clears none of the perp gates, and can never be force-closed, it only exercises or expires, like a spread.
There is no asset-secured call (locking spot ETH to back a call). Because the protocol is cash-settled, a call writer owes the intrinsic in the stablecoin, so backing a call with the base asset would force a swap on exercise and a token address per asset; the 1x perp is the fully-backed call instead.
A writer holds one perp direction per asset at a time, they cannot be long and short the same perp at once, so to sell both a call and a put on one asset they write the call perp-backed (long perp) and the put cash-secured, at the same time.
The four gates
Every mint reads the writer’s account straight from HyperCore through precompiles, the perp position, the asset info, the margin summary, and the oracle price, and requires all of the following. (It also reverts up front on a ticker that does not exist or has expired, or a zero size.)
- Hedge sign. The perp must point the right way: a long perp for a call, a short perp for a put. This is what makes the cover self-liquidating, the perp funds the option’s intrinsic when it is in-the-money and can only be force-closed on the move where the writer owes nothing. Reverts
BadHedge. - Cover covers the shorts. One perp can back many options on the same asset, so the cover, the perp’s size, must be at least the writer’s total outstanding shorts plus this new one. Reverts
CoverTooSmall. - Enough rope. The ticker presets a minimum drawdown buffer: how large an adverse price move the writer’s margin must be able to absorb before HyperCore would liquidate the cover, and the mint checks the account clears it. Writers open and margin their perp on Hyperliquid themselves, and the contract cannot set their leverage, so this buffer is how the admin caps the effective leverage a ticker will accept: a larger required move admits less leverage. Reverts
InsufficientRope. - Bond clears the floor. The option bond the writer posts must be at least the floor, the Black-Scholes value at the SVI smile’s implied vol, plus the finder fee reserved on top. Reverts
BelowFloor.
No deep-in-the-money writes
One more check applies to both modes: an option cannot be written deep in the money. From the oracle price against the strike, the mint rejects a write whose intrinsic is more than a governance-set fraction of the notional. Near-the-money writing is fine; deep-in-the-money writing is not. It has no capital-efficiency use (the floor is already the whole notional, so it is a delta-one instrument, trade the perp instead), and it is where any oracle or model error is largest in absolute terms, exactly the spot adverse selection would target. Existing positions are untouched; the gate only blocks new deep-in-the-money mints.
What mint does
Once the gates pass, the core:
- Locks the option bond the writer posted in the contract.
- Mints the pair: the long leg to the recipient the writer names, the short leg to the writer.
- Records the new short against the writer’s cover, raising the outstanding-short floor the cover must stay above from now on.
The long and the short
The two legs behave differently by design.
- The long is a plain ERC-1155 asset. The writer directs it to a buyer, who can hold, transfer, or exercise it.
- The short is bound to the writer’s cover. It can only be minted or burned, never transferred, so the obligation can never leave the account that backs it.
Financing the bond
Because the long is a plain asset the writer can sell the moment it exists, the writer does not have to front the bond themselves. They bring their own perp, opened and margined on Hyperliquid beforehand, then mint and pay the bond out of the premium in one transaction: the mint delivers the long, the writer sells it on a venue, and the proceeds settle the bond.
What the writer actually puts up is the perp margin plus any gap between the bond and what the long fetches, and the bond is refundable float that returns on a clean close or an out-of-the-money expiry. So a writer can stay capital-light on the bond and hold mainly the margin, which is their real risk capital on the cover. Opening the perp is the one step that sits outside the mint transaction, HyperCore confirms it on the next block, but once the cover exists, minting, selling the long, and funding the bond all settle together.