Non-custodial vaults on HyperEVM · testnet, pre-audit
A leaked agent key can trade badly. It cannot steal.
北斗 · seven stars, one bearing
The problem
That the operator's valuation of your shares is honest. And that the operator will not close the exit while you need it.
Every failure in this category has been one of those two. Not a clever exploit — a discretionary power that existed and got used. So they are the two powers this protocol does not have.
| the common design | Hokuto | |
|---|---|---|
| NAV | computed off-chain by the operator's settlement service | read on-chain from the HyperCore precompiles |
| settlement | only the operator's gateway may trigger it | permissionless — the caller picks the block, the chain picks the price |
| pause | admin can freeze deposits and withdrawals | entries and custody can pause; exits never |
| trusting a valuation | required | not required |
The left column is quoted from the leading live implementation's own documentation, verified 2026-08-25. Minimum deposits, HIP-3 access and high-water-mark fees are commodity features and we do not claim them as a moat. The trust model is the product.
The one power a keeper has here is timing. It cannot choose a value.
How it works
Pick a performance fee, name it, seed it. The fee is fixed at creation and immutable — nobody can raise it on you later. The vault trades on its own HyperCore account through a leader-controlled agent key.
Queue USDC, settle at NAV, receive ERC-20 shares. Cancel a queued deposit any time before it settles. NAV is read from the chain at the block you settle in.
Burn shares at NAV, USDC comes home. Admin may pause entries and custody operations. There is no function that closes the withdrawal path.
Fees
No management fee. Performance fee only, against a high-water mark, paid by dilution and crystallized at settlement — provably never twice for the same gain. The vault's fee is chosen by its leader and immutable afterwards.
The protocol takes a cut of that performance fee, capped at 30% of it. Not of your deposit, not of your assets, and never of a gain that has not happened.
Where the design came from
These contracts were written for our own use before they were a product. The rule that a failed precompile read reverts instead of returning zero exists because a failed read treated as zero corrupted twelve samples of our own published equity record.
That system still runs, still publishes every trade it makes — wins and losses alike — and still grades its own engines in public. It is not the product. It is the reason the custody is paranoid.
Status — read this part
testnet only · audit in scopingThe contracts are written and running on testnet: factory, a minimum-seed vault, a deposit settling at exactly price 1.00, a funded core account, an agent registered, and NAV read on-chain matching the ledger to the cent. Mainnet configuration is deliberately not fillable from an environment variable — shipping custody has to be a reviewed commit, not a deploy-time switch.
What stands between here and mainnet: the remaining verification steps, one of which has no harness yet and either gets one or does not ship; an independent security audit, being scoped now; and the legal perimeter for pooled vaults.
There is no deposit button on this page, and there will not be one until those are done. If you came here looking for somewhere to put money today, the honest answer is: not yet.
Waitlist
No newsletter, no launch sequence. One note when the audit is done and the first vaults open on mainnet.
Address only. Nothing else is stored, nothing is passed on.