How it works.

Honeydew is one vault. It quotes new HIP-3 perp markets, captures spread and funding, and pays what it earns to depositors and to HONEY stakers. Every decision below follows from something measured on HyperEVM.

The words

What each term means here.

Most of the confusion around this is vocabulary rather than mechanism. The mechanism is one paragraph: anyone can list a perp market on Hyperliquid, most of them open with nobody quoting a price, and Honeydew is a vault that quotes them and passes on what that earns. Everything below is a name for a piece of that.

Perp marketA place to bet on a price going up or down with leverage, with no expiry date. Hyperliquid runs hundreds of them.

HIP-3The rule that lets anyone who stakes enough HYPE launch their own perp markets, instead of waiting for Hyperliquid to list them. It is why there are suddenly 274 of these and why most are empty.

DexOne person's or team's whole set of markets, with its own price feed and its own risk settings. There are 10 of them. Treating one as a counterparty rather than as infrastructure is why the vault caps how much it puts on any single one.

Making a marketPosting a price to buy at and a price to sell at, and waiting. You earn the gap between them, and you carry whatever you end up holding.

The vaultOne contract that holds everyone's HYPE and does the quoting. It is also the account that HyperCore sees, which is why the two cannot be separate contracts.

JUICEYour share of the vault. Deposit and you get some; the number you hold never changes on its own, but what one is worth in HYPE does.

HONEYThe protocol token. Stake it and you receive a cut of the fee the vault charges, paid in JUICE.

The keeperWhoever decides the prices and sizes to quote. A contract cannot do that, so a person or a bot does, inside limits the contract enforces.

FundingA small payment that flows between the long and short sides of a perp every hour, to keep its price near the real one. A market maker collects or pays it depending on which side it ends up holding.

High water markThe best the vault has ever been worth per share. The fee applies only above it, so a loss has to be earned back for free before anything is charged again.

The guarantee

The keeper can trade it. It can never withdraw it.

Somebody has to decide prices and sizes, and no contract can do that. So the question is not whether a vault has an operator, it is what an operator is physically able to do with your money. Here is every path the money can take.

The vault and the trader are the same contract, because CoreWriter attributes an action to the address that emitted the log: the account holding collateral is necessarily the account sending orders. A separate strategy contract would have to be sent the money first, and that transfer is the hole this refuses to open.

One spotSend, and its destination is a constant: the HYPE bridge, which credits this same contract back on the EVM. No argument names anybody.
Both sendAsset calls address address(this).
Quotes are forced post only. The vault cannot cross a spread. The only order allowed to take is flatten, and it is reduce only.
No withdraw, no sweep, no rescue, no arbitrary call. The deploy script asks the deployed contract for each of those selectors and aborts if any answers.

The caps

Where the vault is allowed to be.

Both are enforced on the call that moves the money, not on a dashboard, and the outer bounds are constants in the bytecode: a ceiling an owner can raise is not a ceiling. Equity on a dex counts toward the vault, so the rule that actually binds is E ≤ bps × (everything else + E): a true share of the vault, not a limit on the amount added.

The fee

Charged on new highs, and on nothing else.

The mark only ever steps up, so a recovery back to a level you were already paid on is free: never on a deposit, never on principal, never twice on the same gain. And the fee is minted as shares rather than taken in cash, because a fee paid in HYPE would have to be raised out of the redemption buffer at the worst possible moment. What a staker receives is a claim on the vault itself.

What the chain allows

Four measurements, read off the live chain.

Measured	Consequence
accountMarginSummary(dex, addr) answers for HIP-3, USDC 6dp	nav() is a view with no oracle, no reporter, no signature
markPx / oraclePx / position revert on HIP-3 asset ids	no cap can be written in a price. Every limit is equity per dex
oraclePx(159) is the HYPE price and matches spotPx(107) to 0 bps	the vault is denominated in HYPE with no external oracle
USDC's ERC-20 reverts on balanceOf	a USDC vault would be dead on arrival

A correction

The asset id that was not what it looked like.

The reference this started from held that a HIP-3 order is addressed dexIndex * 10000 + marketIndex, on the evidence of a live order carrying asset 10107, read as market 107 on dex 1. Decoding three real orders by their price settles it: 10107 was 82.692, which is HYPE; 10151 was 2433.30, which is ETH; 10142 was 77286.00, which is BTC. Spot is 10000 + pairIndex. Those were spot orders, and the HIP-3 order encoding has never been observed on chain.

So the contract does not compute it. The registry stores each market's asset id explicitly at listing, checked against a real market first. A formula nobody has measured has no business in a contract that quotes with real money.

Risks

Worth saying out loud.

Deposits are HYPE and perp margin is USDC, so the vault carries a HYPE against dollar leg between converting and unwinding. It is real and the contracts do not hedge it.
Making markets on new perps means holding inventory in them. A cap limits how much, it does not make a loss impossible.
A HIP-3 dex deployer controls its own oracle and risk parameters. That is a counterparty, which is why the ceiling is 40% and not something braver.
Nothing is deployed. The keeper is not written. Each market's asset id has to be verified against a real market before it can be listed.

Open the app ›