How Does Hyperliquid HLP Work?
Hyperliquid HLP is the protocol-owned market-making vault on Hyperliquid, a custom L1 perpetual futures exchange with ~$450M in vault deposits. Its C grade reflects novel vault mechanics that automatically inherit liquidated positions across all markets, the March 2025 JELLY manipulation incident, and centralization concerns around a small validator set that can delist tokens and settle positions within minutes.
TVL
$395M
Sector
Derivatives
Risk Grade
C
Value Grade
B
Core Mechanisms
4.4.1
On-chain order book on custom L1 (HyperBFT consensus)
Central limit order book similar to dYdX v4 but on proprietary L1
4.1.5
NovelHLP vault as protocol-owned market maker and liquidation backstop
Novel: vault automatically inherits all liquidated positions and acts as counterparty
6.3.4
NovelSocialized bad debt via HLP inheritance of underwater positions
Novel modification: HLP depositors take on directional exposure from inherited positions
2.1.2
Percentage-based trading fees with 97% to Assistance Fund
Standard percentage fee model with buyback mechanism
1.3.2
Assistance Fund buyback and burn of HYPE tokens
Standard buyback-and-burn using trading fee revenue
5.4.1
Validator-controlled emergency actions
Small validator set can rapidly intervene to delist tokens and settle at chosen prices
How the Pieces Interact
Illiquid token listings can be manipulated to force HLP to inherit massive directional positions it cannot exit, as seen in the JELLY attack
Small validator set can unilaterally delist assets and settle positions at arbitrary prices within minutes
HLP depositors are exposed to tail risk from every listed perpetual market simultaneously with no isolation
97% of fees flowing to Assistance Fund creates predictable buyback patterns that can be front-run
Proprietary consensus creates potential for validator-level MEV extraction through order sequencing
What Could Go Wrong
- HLP vault automatically inherits liquidated positions, including illiquid tokens where market manipulation can force the vault to absorb outsized losses — as demonstrated in the March 2025 JELLY incident where the vault faced $12M in unrealized losses.
- The protocol's validator set is small (~20 validators), enabling rapid consensus actions like delisting tokens and settling positions at arbitrary prices within minutes, raising centralization concerns around emergency interventions.
- Socialized loss mechanism means HLP depositors bear counterparty risk from all perpetual trading on the platform, with no per-asset exposure caps limiting concentration risk on illiquid listings.
- Custom L1 chain with proprietary consensus means the entire derivatives stack runs on infrastructure that has not been independently replicated or battle-tested by other protocols.
Coordinated Illiquid Token Manipulation Draining HLP
ElevatedTrigger: A whale opens large short positions on 2-3 illiquid perpetual listings simultaneously while pumping spot prices on external exchanges, forcing HLP to inherit multiple underwater shorts exceeding $50M
- 1.Attacker opens leveraged short positions worth $10-20M each on low-cap perpetual listings — HLP vault is exposed to concentrated directional risk on illiquid assets
- 2.Attacker pumps spot prices on external exchanges creating oracle divergence — Short positions become deeply underwater triggering margin calls
- 3.Positions liquidated and inherited by HLP vault with no ability to exit at reasonable prices — HLP vault faces $50M+ unrealized losses across multiple positions
- 4.HLP depositors begin withdrawing to avoid further losses — Reduced vault capacity increases per-depositor loss exposure
- 5.Validators face pressure to intervene but delist-and-settle creates trust crisis — Market confidence in platform neutrality erodes
Risk Profile at a Glance
Overall: C (47/100)
Lower score = safer