Hyperliquid’s HIP-3 is changing the game by allowing anyone to launch perpetual futures contracts if they’re willing to stake $20 million. The big question is: will the built-in safety measures be enough to handle the potential risks?
Launched in October 2025, HIP-3 on the Hyperliquid mainnet introduces a new system where creators can independently set up perpetual futures markets, bypassing the need for committee approvals.
To launch a market, deployers are required to lock up 500,000 HYPE tokens. At current market values, this translates to approximately $20 million, serving as security against any harmful actions.
Validators have the power to reduce or completely eliminate the staked amount if a builder provides false pricing information, manages a market irresponsibly, or jeopardizes the stability of the network. This slashing potential remains even during the seven-day unstaking period.
Instead of distributing the slashed HYPE to users, the protocol destroys it. This prevents any motivation for making false accusations.
Addressing the Oracle Challenge
Builders have complete control over their market’s pricing data source (oracle) and its update mechanisms, opening the door to listing almost any asset.
However, this introduces the risk of oracle manipulation, a vulnerability that led to a $112 million exploit on Mango Markets in 2022. In that instance, an attacker exploited a weak price feed to empty the platform.
Hyperliquid combats this risk by making builders stake a significant amount of capital, aiming to discourage manipulation. Furthermore, the protocol incorporates sanity checks through dependable price references and validator oversight.
Should a market’s price feed fail or a contract reach its expiration, builders can activate a “halt” function. This allows them to settle positions at a fair price and suspend trading.
The system operates on the premise that builders will choose reliable oracle sources because their stake is at risk. Validators are constantly monitoring the markets and can penalize deployers who utilize easily manipulated data feeds or allow irregular activity.
Isolation and Risk Mitigation
Each market deployed by a builder operates as a separate perpetual exchange, complete with its own order books, margin requirements, and risk settings. Cross-margining with other assets is not allowed, preventing issues in one market from affecting others.
HIP-3 enforces two types of open interest limitations. The first is notional caps, which limit the total dollar amount of positions. The second is size caps, which restrict the absolute size of positions.
These limits are applied both for individual assets and for all assets listed by a specific builder. Builders can adjust these caps within the boundaries defined by the protocol, but validators expect conservative limits, especially for volatile or new assets.
Deployers also determine leverage limits and initial margin needs. This design ensures that no new market can become systemically crucial overnight.
New markets are launched using a Dutch auction, which occurs every 31 hours. Builders bid HYPE to secure deployment slots. To make it easier for new participants, the first three markets a builder launches are exempt from the auction process.
Beyond winning an auction and staking 500,000 HYPE, no approvals are needed. Any asset can be listed if the deployer supports it with a stake. The protocol has very few explicit listing rules.
For instance, if a token used as collateral becomes insecure, validators can vote to revoke its status. This would automatically disable any markets that use the token.
The substantial staking requirement effectively filters for serious projects that have adequate capital and expertise. Hyperliquid’s documentation indicates that the objective is to ensure “high quality markets and protect users” from short-lived or unreliable listings.
Comparison of Strategies
dYdX v4 is shifting towards permissionless markets but still relies on governance votes for new asset listings. The platform plans to implement isolated margin for risky assets and enforce strict oracle standards. Assets must be traded on at least six major exchanges to guarantee robust price feeds.
Chaos Labs has suggested a “probationary asset” phase with separate insurance funds and tighter trading limits for new markets.
GMX v2 addresses similar concerns through isolated liquidity pools for each trading pair and Chainlink oracles for pricing. The platform incorporates Chaos Labs’ Edge Risk Oracle system, which dynamically adjusts open interest limits and price impact coefficients based on current market conditions.
Additionally, each GMX market is independently protected, so issues in one pool do not affect others.
Drift Protocol on Solana utilizes Switchboard’s permissionless oracles for rapid asset listing, but it implements a 10% circuit breaker.
If the market price deviates from the oracle’s five-minute time-weighted average by more than 10%, the market prevents new orders outside that range. Drift also restricts single trades to a maximum of 2% price impact.
During the testnet evaluation of HIP-3, no major problems were identified. A $21 million theft from Hyperliquid around the same time was due to a compromised private key, unrelated to market operations, stemming from user error.
The real test for the protocol will be when independent builders launch innovative markets for exotic indices or real-world assets.
Mango Markets collapsed because it allowed a thinly traded token to be used as collateral with a single price source. GMX v1 lost $565,000 when an attacker manipulated AVAX prices off-platform and exploited zero-slippage trading.
HIP-3’s design combines financial disincentives through staking with technical limitations through caps and isolation. Validators act as a final safeguard, with the authority to penalize up to 100% of the stake for violations that threaten network correctness or stability.
This design effectively turns Hyperliquid into a financial infrastructure rather than just an exchange. Each new market functions as a self-contained mini-exchange, protected by the network.
QuickNode’s analysis pointed out that HIP-3 “replaces gatekeepers with code while keeping quality and user safety intact through on-chain rules and incentives.”
Who Ensures Safety?
The responsibility is shared. Builders protect markets because their capital is on the line. Validators maintain market integrity through monitoring and the potential for slashing. The protocol safeguards markets through automated limits, isolation, and sanity checks.
This model relies on the assumption that a $20 million stake will be more effective than a committee in preventing manipulation. It also assumes that validators will take action when necessary, but the system is designed to be robust enough that slashing should “never” be required on the mainnet, according to the Hyperledger team.
Lessons from Mango and GMX directly influenced these safeguards. Whether the combination of stake, isolation, and oversight can effectively handle all unforeseen scenarios will be determined by real-world market activity.
For now, Hyperliquid offers a simple proposition: any asset can become a perpetual market if someone is willing to risk $20 million on its success.
The protocol believes that this financial commitment will separate serious builders from those who are less committed, and that the layered defenses will address any shortcomings in the economic incentives.