Packages and settlement

The three packages

You pick the package on the desk, or the intake picks it from your words: asking for a hedge (“hedge it”) picks spot + hedge, and buying an asset with a stablecoin along with a short of its perp is cash and carry. Only tokens with a Hyperliquid perp can be hedged: wNEAR (NEAR) and BTC. A hedged package needs a maker bond of at least 1,000 USDC, so it makes sense from about 10,000 USDC of notional (see bonds).

Spot

You give one token and get another. Each side proves its own leg, and the pool applies both legs in one call, settle_swap: four notes spent and four made, or nothing at all. There is no escrow and no moment when one side has paid and the other has not, so a spot deal needs no bond.

The maker submits both legs, after you have handed it yours, so it has a last look: it can wait until the deal expires and settle only if the price still suits it. That costs it no bond on a spot deal, but the lapse is public and costs it future requests. See last look.

The receipt says settled, with the pool's leaf index and the new root as evidence.

Spot and hedge

The spot leg settles exactly as above, and you hold what you bought. Then the maker's hedge order goes to Hyperliquid testnet: a short of the perp for the size the maker gave you, immediate or cancel, at the limit in the deal record. NEAR Chain Signatures (v1.signer-prod.testnet) sign it from an address derived from the path hushd/hedge/<deal id>.

That address holds no margin of its own. The maker's Hyperliquid account approves it as an agent, so the order trades for the maker's account: the position, its margin and its profit or loss are the maker's, not yours. Hyperliquid books an agent's orders on the account that approved it, so all of one maker's hedges show on that maker's account there, whatever address signed them.

The keeper cannot change the order: the desk rebuilds it from the deal record (immediate or cancel, the package's side, size and limit price, the block time as nonce). The keeper or the deal's maker asks for it with sign_hedge_order, and only one opening order is out at a time. When the keeper reports that an order did not fill and the deadline has not passed, the order can be signed again, up to three opening orders per deal.

The keeper alone reports how the order went, and the desk releases or slashes the bond on that report (record_hedge). So the outcome rests on the keeper: a false fill would release the bond, and a false miss would pay it to you. If the keeper reports nothing, anyone may slash the bond once the deadline has passed (slash_overdue).

Cash and carry

You buy the asset with a stablecoin, and the maker commits to the same bonded hedge order: a short of its perp for the size you bought, placed for the maker's own account. You hold the asset; the short is not yours. It settles the same way as spot + hedge, with the same bond, the same receipt and the same experimental status.

Bonds and slashing

A maker posts a bond in the desk's bond token (test USDC) before it can quote hedged packages, and each hedged quote says how much of that bond it puts on the deal. The desk locks that much when the deal is matched, and accepts the match only if the maker's free bond covers it.

The desk's min_bond is 1,000 USDC: a hedged quote must bond at least that much, so hedged packages make sense from about 10,000 USDC of notional. Bonds come only in steps of min_bond (1, 2, 5, 10, 20, 50 and so on times it), so a public bond does not give a trade's size away; the reference makers bond a tenth of the trade's value, rounded up to the next step.

• The hedge fills. On the keeper's report, the bond is released and the receipt says settled, with the fill as evidence.
• The hedge does not fill. The keeper records each miss. Before the deadline the order is signed again, up to three opening orders in all; the third miss, or a miss after the deadline, slashes the bond. Once the deadline has passed with no fill recorded, anyone may call slash_overdue. Either way the desk pays the bond into the pool as a private note to you, made from the payout key in your request, and the receipt says recovered. Your wallet watches for that note and adds it to your balance when it lands.
• The pool cannot take the payout. The desk holds the bond for you and the receipt says unresolved. Anyone may call retry_slash_payout to send it to the pool again, as the same note for you.

Closing the hedge

Your request carries a public key made for this deal alone, derived from your spending key. Only that key can ask for the hedge to be closed: you sign hushd.close:<desk account>:<deal id> (for example hushd.close:desk.hushd.testnet:42), the relayer sends it to close_hedge, the desk checks the signature, and the MPC signs a reduce-only order the other way. That order trades for the maker's account too: it closes the maker's hedge position and pays you nothing. You can close once, after the deal has settled, from the deal's page in Deals.

Receipts

Receipts are public, like the deal record they belong to. The amounts are not in them. To show a receipt's amount to someone, prove it to them.