HOKUTO

HOKUT

Non-custodial vaults on HyperEVM · testnet, pre-audit

A leaked agent key can trade badly. It cannot steal.

Read the trust modelLaunch app ↗

Status TESTNET audit before the money

北斗  ·  seven stars, one bearing

The problem

Pooled custody asks you to trust two things.

That the operator's valuation of your shares is honest. And that the operator will not close the exit while you need it.

Every failure in this category has been one of those two. Not a clever exploit — a discretionary power that existed and got used. So they are the two powers this protocol does not have.

the common designHokuto
NAVcomputed off-chain by the operator's settlement serviceread on-chain from the HyperCore precompiles
settlementonly the operator's gateway may trigger itpermissionless — the caller picks the block, the chain picks the price
pauseadmin can freeze deposits and withdrawalsentries and custody can pause; exits never
trusting a valuationrequirednot required

The left column is quoted from the leading live implementation's own documentation, verified 2026-08-25. Minimum deposits, HIP-3 access and high-water-mark fees are commodity features and we do not claim them as a moat. The trust model is the product.

The one power a keeper has here is timing. It cannot choose a value.

How it works

Three verbs. No fine print.

  1. OPEN

    Anyone deploys a vault.

    Pick a performance fee, name it, seed it. The fee is fixed at creation and immutable — nobody can raise it on you later. The vault trades on its own HyperCore account through a leader-controlled agent key.

  2. DEPOSIT

    Shares in your own wallet.

    Queue USDC, settle at NAV, receive ERC-20 shares. Cancel a queued deposit any time before it settles. NAV is read from the chain at the block you settle in.

  3. EXIT

    The door does not close.

    Burn shares at NAV, USDC comes home. Admin may pause entries and custody operations. There is no function that closes the withdrawal path.

Decisions written down, so they can be argued with.

Fees

We earn only when depositors do.

No management fee. Performance fee only, against a high-water mark, paid by dilution and crystallized at settlement — provably never twice for the same gain. The vault's fee is chosen by its leader and immutable afterwards.

The protocol takes a cut of that performance fee, capped at 30% of it. Not of your deposit, not of your assets, and never of a gain that has not happened.

Where the design came from

We ran the trading system first. That is why we know what to fear.

These contracts were written for our own use before they were a product. The rule that a failed precompile read reverts instead of returning zero exists because a failed read treated as zero corrupted twelve samples of our own published equity record.

That system still runs, still publishes every trade it makes — wins and losses alike — and still grades its own engines in public. It is not the product. It is the reason the custody is paranoid.

Read the system and its record ↗

Status — read this part

testnet only · audit in scoping

The audit comes before the money.

The contracts are written and running on testnet: factory, a minimum-seed vault, a deposit settling at exactly price 1.00, a funded core account, an agent registered, and NAV read on-chain matching the ledger to the cent. Mainnet configuration is deliberately not fillable from an environment variable — shipping custody has to be a reviewed commit, not a deploy-time switch.

What stands between here and mainnet: the remaining verification steps, one of which has no harness yet and either gets one or does not ship; an independent security audit, being scoped now; and the legal perimeter for pooled vaults.

There is no deposit button on this page, and there will not be one until those are done. If you came here looking for somewhere to put money today, the honest answer is: not yet.

Waitlist

Leave an address. We write when there is something to deposit into.

No newsletter, no launch sequence. One note when the audit is done and the first vaults open on mainnet.

Address only. Nothing else is stored, nothing is passed on.