Non-custodial trading vaults
on HyperEVM.

Anyone opens a vault. Depositors buy ERC-20 shares. The vault's capital trades on the vault's own HyperCore account — the default perp dex and HIP-3 builder markets alike — through a leader-controlled agent key.

That key can place orders. It has no code path that pays an arbitrary address.

A leaked agent key can trade badly. It cannot steal.

how it works

Three verbs.

Open

Deploy a vault, pick a performance fee, name it. The fee is fixed at creation and immutable — nobody can raise it on you later.

Deposit

Queue USDC, settle at NAV, receive ERC-20 shares in your own wallet. Cancel a queued deposit any time before it settles.

Exit

Burn shares at NAV, USDC comes home. Exits are structurally unpausable — there is no admin function that can close this door.

the part that matters

Who decides what your shares are worth?

Every pooled-custody failure in this category comes down to one of two things: a valuation the operator controlled, or an exit the operator could close. So those are the two powers the protocol does not have.

	the common design	Hokuto
NAV	computed off-chain by the operator's settlement service	read on-chain from the HyperCore precompiles
settlement	only the operator's gateway may trigger it	permissionless — the caller picks the block, the chain picks the price
pause	admin can freeze deposits and withdrawals	entries and custody can pause; exits never
trusting a valuation	required	not required

The one power a keeper has here is timing. It cannot choose a value.

design decisions

Written down, so they can be argued with.

01$1 seed at creation burns to dead shares. Kills the ERC-4626-class inflation attack before a vault is ever visible.
02Unreadable is not zero. If a precompile leg fails, valuation reverts and settlement waits. A failed read treated as zero is how we corrupted our own published figures once; it does not get to happen to a depositor.
03Custody-block guard. CoreWriter is asynchronous, so settlement refuses any block that moved bridge funds. NAV can never be read mid-flight.
04Dexes are append-only. A leader may list a new perp dex, so NAV can only become more complete. Nobody may delist one and hide equity from withdrawers.
05Rounding favours the vault in both directions. Dust accrues to holders, never to us.
06Non-USDC spot is not counted. Undercount, never overcount.

fees

We earn only when depositors do.

No management fee. Performance fee only, against a high-water mark, paid by dilution and crystallized at settlement — provably never twice for the same gain. The vault's fee is chosen by its leader and immutable afterwards.

The protocol takes a cut of that performance fee, capped at 30% of it. Not of your deposit, not of your assets, and never of a gain that has not happened.

status — read this part

Testnet only. The audit comes before the money.

The contracts are written and running on testnet. Mainnet configuration is deliberately not fillable from an environment variable: shipping custody has to be a reviewed commit, not a deploy-time switch.

What stands between here and mainnet:

→Full testnet end-to-end: bridging, precompile ABI shapes, agent registration, cross-dex moves, and a complete depositor round trip — USDC to shares and back.
→An independent security audit. Non-negotiable for pooled custody, and we are arranging it now rather than after there is third-party money at risk.
→Legal perimeter for pooled vaults.

There is no deposit button on this page, and there will not be one until those are done. If you found this page looking for somewhere to put money today, the honest answer is: not yet.

Non-custodial trading vaultson HyperEVM.