Hyperliquid's Microstructure Innovations

Chapter 7 defined the order as a complex vehicle that carries intent, risk, and information, and it systematically analyzed the signal strength and maximal extractable value (MEV) exposure of different order types. Building on this, Chapter 8 dissected the structural dynamics of the order book, revealing microstructural fragilities such as depth illusion and liquidation cascades, and traced the evolution of matching mechanisms from continuous auction to batch auction. Together, the analytical framework established by these two chapters points to a core question that remains unanswered: when a large number of buy and sell orders arrive within the same time window, whose order should be executed first? This ordering problem is decisive for the profits and losses of market participants, shapes the structure of the market ecosystem, and even defines market fairness. The central tension of market microstructure is that a market must simultaneously provide traders with ample liquidity and efficiently aggregate information into prices, and the ordering mechanism is precisely what mediates this tension. In a traditional centralized exchange (CEX), this core mechanism resides within an opaque, closed architecture. The matching engine processes orders at microsecond or even nanosecond speeds, and its internal ordering logic, latency compensation, and potential differential treatment are entirely opaque to the outside world. This opacity gives rise to the costly speed race analyzed in Section 8.8.1. Aquilina, Budish, and O'Neill (2022) found that the social cost of this speed race across the world's major exchanges amounts to billions of dollars annually ^[1]. Participants lay dedicated fiber-optic lines, build microwave towers, and colocate their servers in exchange data centers, all to gain a microsecond-level physical head start.

The advent of blockchain, and in particular the rise of general-purpose smart contract platforms such as Ethereum, transferred the power to order transactions from private exchange operators to networks of validators. A distinction is warranted here: decentralization in this context operates on two different levels — the protocol-level decentralization of rule definition (the ordering rules are encoded in open-source software rather than privately controlled by a single entity) and the operational decentralization of rule enforcement (the size of the validator set, the distribution of stake, and the governance structure). This open but semantically agnostic ordering paradigm created transparency, but it also gave rise to the problem of MEV. In a public mempool, all pending transactions are fully visible, allowing MEV searchers to bribe block producers to arbitrarily reorder, insert, or censor transactions, and thereby to execute predatory strategies such as sandwich attacks and front-running. In this environment, market makers face not only the adverse selection risk of traditional markets but also continuous value extraction from the MEV supply chain, leaving them exposed to greater risk than in the CEX environment.

It is against this backdrop that the emergence of Hyperliquid offers an important case study. It is not merely a decentralized exchange (DEX) but an open and observable microstructure experiment: all of its rules, trades, and order book states are recorded on-chain and can be audited and verified by anyone, in marked contrast to the black box of a CEX. Addressing the limitations of the first two paradigms, Hyperliquid's designers proposed an entirely new solution — semantic ordering: identifying the economic meaning of a transaction at the consensus-protocol level and ordering transactions differentially on that basis, placing liquidity-protecting actions ahead of liquidity-consuming ones (its definition and implementation are detailed in Section 9.1).

This chapter analyzes Hyperliquid's microstructure system layer by layer: the two mechanism innovations of semantic ordering and cancellation priority, and how the discrete-time property — an inevitable consequence of on-chain matching — provides their structural foundation. It examines how these elements operate in concert and how they trade off among liquidity, efficiency, fairness, transparency, and robustness, while also probing their boundary conditions and failure modes. Among these, the JELLY incident provides a critical stress test that exposes systemic fragilities lying beyond microstructural protection. Understanding these underlying ordering and matching mechanisms is also the key foundation for analyzing the higher-level liquidity incentive structures built on top of them, such as the HLP Vault.

9.1 The semantic ordering mechanism

How transaction ordering fundamentally determines the ultimate profits and losses of market participants is a core question in understanding market microstructure. The closed time-priority of the CEX, the open bribe-priority of the general-purpose DEX, and the semantic priority of Hyperliquid — these three paradigms lead to sharply different outcomes in the distribution of value. As the first layer and guiding design principle of Hyperliquid's mechanism innovations, semantic ordering interprets the economic meaning of transactions directly at the consensus-protocol level and, on that basis, makes explicit priority choices that embody a value judgment.

Semantic ordering refers to a mechanism in which the consensus protocol determines a transaction's execution priority within a block according to its economic intent, rather than by a bare timestamp or the fee paid. This marks a paradigm shift: from semantically agnostic processing that treats all transactions identically to semantically aware processing that treats different transactions differently.

9.1.1 The limitations of traditional paradigms

In a traditional CEX, the matching engine is a highly optimized piece of software whose primary design goals are throughput and low latency. To achieve high performance, the engine must be kept as simple as possible, treating every incoming instruction — whether a new order, a cancellation, or an amendment — as a data packet devoid of economic meaning. Minimizing per-order semantic processing has long been regarded as advantageous for matching speed. The engine's ordering logic follows a strict price-time priority principle: at the same price, the timestamp at which an order reaches the server determines its priority. This ordering process takes place in a fully closed, opaque black box; outside participants can neither observe nor audit its internal workings, which in principle leaves room for the exchange to treat clients differentially. This semantically agnostic plus closed ordering paradigm made the speed race the primary dimension of market competition — the source of the billions of dollars in social cost noted at the start of this chapter ^[1]. In a continuous-time black-box game, speed directly determines profitability.

The emergence of general-purpose blockchains such as Ethereum transformed the closed ordering regime of the CEX. On an on-chain DEX, transactions are broadcast to a public mempool, and the validators responsible for assembling blocks determine the final ordering. This semantically agnostic plus open ordering paradigm achieved procedural transparency but also introduced the problem of MEV. Anyone can observe the pending transactions in the mempool, and this transparency creates significant opportunities for MEV extraction. Typical MEV strategies include sandwich attacks, front-running, and back-running. Daian et al. (2020) first systematically described this phenomenon and warned that it could threaten the consensus stability of blockchains ^[2]. Under this paradigm, block producers effectively act as allocators of ordering rights, and the highest-bidding MEV searcher obtains a priority position in the transaction ordering. Value is transferred from ordinary users and liquidity providers to a complex supply chain composed of searchers, builders, and proposers. For market makers, this environment is harsher than the CEX: they face not only traditional adverse selection risk but also additional value extraction from the MEV supply chain.

Figure 9-1. Comparison of the three ordering paradigms (conceptual architecture, not empirical data; the MEV and bribable mechanisms follow Daian et al. 2020 ^[2], and the social cost of the CEX speed race follows Aquilina et al. 2022 ^[1]; the multi-level ordinal ranking of semantic priority is an analytical characterization, whereas what the documentation records is cancellations and post-only orders ahead of GTC/IOC)

As shown in Figure 9-1, the three paradigms evolve progressively — ordering rights move from an unauditable matching engine, to a bribable block producer, and finally to public information hardcoded in the consensus protocol. The core trend is that ordering power moves from implicit to explicit and from private to public.

9.1.2 Definition and implementation

Hyperliquid's designers recognized that the core problem of the first two paradigms is rooted in semantic agnosticism. Whether the closed black box of the CEX or the open auction of the general-purpose DEX, both treat all transactions as homogeneous data packets, entirely disregarding the fundamental economic differences among transaction types. A market maker's cancellation instruction and an arbitrageur's aggressive order are economically very different in meaning, yet under both paradigms they are treated as entirely equivalent.

Hyperliquid's solution embeds this capacity for distinction directly into the blockchain's consensus protocol. When its layer-1 (L1) blockchain protocol processes the transactions within a block, it does not order them by time or fee but first performs a semantic classification. Each transaction is parsed for its type tag — the order types defined in Chapter 7, such as Cancel, post-only, GTC, and IOC — and is then explicitly sorted into two priority categories ^[3], as shown in Table 9-1.

Table 9-1. Hyperliquid transaction priority classification (Data source: compiled by the author)

The priority tiering in Table 9-1 reflects a fine-grained design trade-off. Placing liquidation engine orders at standard priority rather than high priority carries important implications: if liquidation orders were given too low a priority, solvency protection would be delayed and systemic risk would rise; if too high, an attacker might deliberately trigger liquidations to obtain high-priority execution, creating a new attack vector. Standard priority allows market makers to withdraw their quotes before liquidation orders execute; this protects market makers but may also degrade the quality of liquidation execution, a trade-off examined concretely in the JELLY incident in Section 9.4.3. An Amend/Replace order is semantically equivalent to the atomic operation of a Cancel plus a new order; it inherits high priority because its core intent is still to adjust an existing supply of liquidity rather than to consume liquidity. Hyperliquid's official documentation and its January 2024 technical blog post ^[4] explicitly record a protocol-level rule that orders transactions by semantic type: cancellations and post-only orders execute ahead of GTC/IOC taker orders. (The documentation describes within-block ordering as three classes: (1) actions that do not send a GTC/IOC order to the book, (2) cancellations, and (3) actions that send a GTC/IOC order.) The listing above, which places system-maintenance transactions and the liquidation engine in separate System and Standard tiers, is an interpretive reconstruction made in this chapter for analytical convenience; the documentation does not explicitly frame mark price and funding rate updates and liquidation as ordered priority tiers. The claims below that liquidation sits at standard priority and that market makers can cancel before a liquidation fills actually rest on the documented mechanism that cancellations precede all fillable orders, and a liquidation fill is a fillable order, rather than on the four-tier ordinal ranking itself, which the documentation does not confirm.

When a block is processed, transactions execute in strict sequence according to the priority tiers above. These rules are encoded in the open-source software run by all validator nodes, and changing them requires the majority consensus of the validator set rather than the unilateral decision of any single entity. However, as Section 9.4.7 will analyze, the size of the validator set and the distribution of stake determine the actual strength of this safeguard. In economic terms, this semantically aware plus open ordering paradigm amounts to an explicit value judgment made at the consensus level: actions that protect and provide liquidity take priority over actions that consume it. Table 9-2 provides a systematic comparison of the three ordering paradigms.

Table 9-2. Systematic comparison of the three ordering paradigms (Data source: compiled by the author)

A key pattern emerges from the comparison in Table 9-2: in the CEX value accrues to the fastest, in the general-purpose DEX to the highest briber, and in Hyperliquid it is systematically directed toward liquidity providers. The three paradigms also handle MEV risk in sharply different ways: the CEX internalizes it as the exchange's private informational advantage, the general-purpose DEX externalizes it as open rent-seeking competition, and Hyperliquid compresses it to a structural residual through semantic rules.

To make the differences among these three paradigms concrete, the following analysis traces how ordering determines trading outcomes by comparing the results of an identical set of trading instructions under the three ordering regimes. In a hypothetical scenario, the price of ETH on Binance drops suddenly from $2,000 to $1,980 at t = 0. At this moment, on a given trading platform, three participants issue instructions almost simultaneously (Table 9-3). The three instructions reach the platform within an extremely short time window (< 200 ms), and the different ordering rules determine the final distribution of profits and losses.

Table 9-3. The three core participants and their actions (across the CEX, general-purpose DEX, and Hyperliquid paradigms) (Data source: compiled by the author)

Under the traditional CEX's speed-priority paradigm, Bob holds the latency advantage: his IOC sell order reaches the matching engine before Alice's Cancel instruction and executes 10 ETH at $1,995. Bob immediately hedges by buying back on Binance at $1,980, earning a profit of $150. Alice's cancellation arrives too late; her $1,995 bid is passively filled at a stale price, buying 10 ETH worth only $1,980, for a loss of $150. Bob's profit comes entirely from a physical latency advantage. Under the general-purpose DEX's bribe-priority paradigm, both Bob's IOC sell order and Alice's Cancel are broadcast to the public mempool. An MEV searcher, Dave, spots the opportunity and pays a bribe to the block builder to place his own sell order ahead of Alice's Cancel. Dave sells 10 ETH at $1,995 into Alice's stale bid, and Alice's cancellation fails because her order has already been filled. Dave profits (net of the bribe), while Alice again loses $150. Under Hyperliquid's rule-priority paradigm, the three instructions arrive within the same block window. The consensus protocol automatically groups them by category: Alice's Cancel is high priority, while Bob's IOC and Carol's GTC are low priority. The execution order is as follows: Alice's Cancel is executed first, her $1,995 bid is successfully withdrawn, and she suffers no loss. Bob's IOC sell order cannot execute because the counterparty no longer exists. An MEV searcher's aggressive order would likewise be ranked behind Alice's Cancel, so a sandwich attack is structurally infeasible. Table 9-4 summarizes the profit-and-loss outcomes for each participant under the three paradigms.

Table 9-4. Summary of profit-and-loss outcomes for each participant under the three paradigms (Dave exists only in the general-purpose DEX scenario) (Data source: compiled by the author)

This case reveals not merely a technical difference but a fundamental question about who value belongs to: when a price dislocation occurs, to whom should the economic value it generates accrue? The first two paradigms assign it to the fastest participant and to the one best at manipulating ordering, respectively (as in Table 9-2 and the discussion above), whereas the answer of the third paradigm is that this value is captured by no one — it is not transferred away from the liquidity provider (Alice) but remains in the market (in the Hyperliquid column, every party's profit and loss is $0). In other words, Hyperliquid protects liquidity providers from predation rather than redistributing value to market makers. Its design embeds a core assumption: the adverse selection risk borne by market makers constitutes the supply cost of liquidity as a public good, and the protocol should compensate for this structurally.

Crucially, the protection above holds only when Alice's Cancel instruction and Bob's IOC order fall within the same block. If Bob's aggressive order is included in block N while Alice's cancellation falls into block N+1 owing to network latency, then Alice's stale quote is still executed in block N, and the market maker's adverse selection loss is no different from the CEX scenario. The probability of this cross-block failure scenario depends on the network latency between the market maker and the validator nodes and on the timing relationship at the block boundary, which Section 9.3.7 analyzes in detail.

9.1.3 Effects on market makers

The deeper effect of semantic ordering on market makers is that it systematically alters the cost structure of the market-making business. A market maker's equilibrium spread must cover the various costs it faces. According to the classic model framework established by Glosten and Milgrom (1985), these costs consist mainly of adverse selection costs, inventory risk costs, and order processing costs ^[5]. In the CEX environment, one must add the high infrastructure cost of maintaining a speed advantage. In the general-purpose DEX environment, adverse selection costs are amplified by the presence of MEV.

By granting market makers' defensive instructions (such as cancellations) high priority, semantic ordering directly reduces the adverse selection risk they face. Under normal market conditions, a market maker can, with high probability, successfully cancel before informed traders exploit its stale quote, thereby protecting itself from loss. However, this protection probability drops significantly during network congestion or near a block boundary, where a cancellation instruction may fall into the next block owing to transmission latency, leaving the market maker exposed to adverse selection in the current block. In its pricing model, a market maker should reserve a buffer for this tail risk rather than treat cancellation priority as unconditional protection. This protocol-level protection means market makers no longer need to invest heavily to compete in the speed race, which significantly lowers infrastructure costs. The decline in these two core costs allows market makers to remain profitable even while quoting narrower spreads. Drawing on the model framework of Glosten and Milgrom ^[5], Figure 9-2 conceptually presents the decomposition of a market maker's equilibrium spread across the three market environments. In the semantic ordering environment, the substantial reduction in adverse selection and infrastructure costs significantly compresses the total spread, ultimately benefiting all traders.

Figure 9-2. Decomposition of a market maker's equilibrium spread across three market environments (conceptual illustration; relative heights are assigned by the author and are not empirical data; the spread-decomposition framework follows Glosten and Milgrom 1985 ^[5], where ^[5] supports the adverse selection component, while the infrastructure cost is an extension added in this chapter and is not part of ^[5]; for the general-purpose DEX, the adverse selection segment is folded into the MEV loss)

As Figure 9-2 shows, the compression of the equilibrium spread in the semantic ordering environment comes mainly from two components: adverse selection costs fall sharply owing to protocol-level protection, and infrastructure costs approach zero as the speed race loses its purpose. Inventory risk and order processing costs differ little across the three environments and are only weakly linked to the ordering mechanism.

9.1.4 Effects on arbitrageurs

Semantic ordering does not eliminate MEV; rather, it structurally redefines and redistributes it. Traditional sandwich-attack and front-running MEV is largely suppressed because aggressive orders have lower priority than market makers' defensive orders. MEV does not vanish entirely, however, but persists in a more constrained form. Because the ordering of transactions within a single priority category is still determined by the block proposer, the proposer retains a degree of ordering power. This ordering power held by the block proposer within the framework of the protocol's rules is termed residual MEV in this chapter; it also corresponds to the Monarch category in the {Monarch, Moloch, Mafia} extractable-value framework proposed by Sun (2022) ^[25] in the MEV literature — the value extracted by a single sequencer by virtue of its ordering monopoly (the term is not official Hyperliquid terminology, nor is it equivalent to residual MEV in the generic sense).

MonarchEV is far smaller in scale than traditional MEV and arises mainly in the following scenario: when two arbitrageurs submit identical arbitrage transactions within the same block, the block proposer can choose which executes first. This power can be sold, with an arbitrageur paying part of its profit to the block proposer as an ordering fee. But because such arbitrage opportunities are themselves greatly reduced by the protection afforded to market makers, the absolute scale of MonarchEV is very limited. It is closer in nature to a theoretical residual risk than to a serious problem in practice. This mechanism pushes high-frequency traders away from latency arbitrage that relies on micro-timing advantages and toward the discovery of cross-market price discrepancies based on information analysis, a behavior pattern closer to traditional cross-market arbitrage (Section 9.2.3 further analyzes the positive effect of this strategic shift on price discovery).

9.1.5 Theoretical foundations

The design of semantic ordering is supported by well-established theory in financial economics. As noted earlier, the model of Glosten and Milgrom (1985) shows that a market maker's spread is directly related to the adverse selection risk it faces ^[5]. By granting priority to cancellation operations, semantic ordering systematically lowers the probability of adverse selection faced by market makers, thereby allowing them to quote tighter spreads. Viewed through Harris's (2003) framework for analyzing market microstructure, semantic ordering is in essence a major innovation at the level of trading rules ^[6]. It elevates the protection of liquidity providers from a reliance on market makers' own investment (speed) or on ex post compensation in market design to an ex ante guarantee at the protocol level.

The deeper logic of this value judgment is that liquidity is a public good of the market from which all traders benefit, yet its providers (market makers) bear a disproportionate share of the risk. Without protection, market makers would widen their spreads to compensate for this risk, and wider spreads mean that all traders pay higher transaction costs. Protecting market makers at the protocol level is therefore not an unfair tilt but a mechanism design intended to improve the overall efficiency of the market. By lowering market makers' risk, it lowers the spread compensation they demand and ultimately reduces transaction costs for all traders.

However, the systematic suppression of informed traders by semantic ordering may also produce unintended efficiency consequences. The impossibility theorem of Grossman and Stiglitz (1980) holds that if informed trading is unprofitable, the incentive to acquire and process information weakens, and the efficiency with which market prices aggregate information declines accordingly ^[7]. When semantic ordering makes it difficult to exploit an informational advantage against a market maker's stale quote, the incentive for arbitrageurs to acquire and transmit new information is also weakened. This is not a design flaw of semantic ordering but an inherent design trade-off: between improving liquidity supply and preserving price discovery incentives, semantic ordering clearly chooses the former. Each ordering paradigm is a design choice made under particular constraints, with its own trade-offs, and should not be placed within a simple linear narrative of progress.

Semantic ordering offers a new dimension for market design: it makes explicit the priority of different trading behaviors and hardcodes that priority into the consensus rules. Yet semantic ordering is not the only path to solving the MEV problem, and situating it within the broader range of mitigation approaches helps clarify its distinctive position.

9.1.6 A comparison of MEV mitigation approaches

Current mainstream MEV mitigation approaches can be grouped into several categories according to their technical path. Private-mempool approaches, exemplified by Flashbots Protect and MEV-Share, work by encrypting or privatizing the transaction-submission process to prevent searchers from observing the contents of unconfirmed transactions, thereby eliminating front-running and sandwich attacks that rely on information visibility ^[8]. Such approaches have been widely adopted in the Ethereum ecosystem, but their limitation is that they do not change the ordering rules themselves: once a transaction is decrypted, its ordering is still decided by the block builder, so MEV is redistributed rather than eliminated. Cryptography-based approaches, exemplified by the threshold-encrypted mempool, use cryptographic means to ensure that transaction contents remain invisible until ordering is fixed, technically eliminating content-based MEV extraction. However, such approaches introduce additional computational and communication latency and cannot treat different transaction types differentially; in their encrypted state, all transactions are treated as equivalent. Intent-based approaches, exemplified by CoW Protocol and UniswapX, abstract a user's trading need into an intent, and specialized solvers compete to find the optimal execution path ^[9]. This approach performs well in swap scenarios, but its applicability is limited to transaction types that can be expressed as outcome constraints and cannot cover the full order-book trading environment.

Hyperliquid's semantic ordering occupies a distinctive position among these mechanisms. Unlike the approaches above, semantic ordering explicitly classifies the economic meaning of transactions at the consensus-protocol level and, on that basis, makes priority decisions that embody a value judgment. This makes it a rare MEV mitigation mechanism among the mainstream approaches surveyed in this chapter that explicitly expresses, at the protocol level, a value orientation about which market behaviors should be given priority protection. However, this design requires an application-specific chain as its implementation vehicle and cannot be deployed on a general-purpose L1, because Hyperliquid's L1 blockchain is itself infrastructure custom-built to support semantic ordering. Table 9-5 provides a systematic comparison of these approaches.

Table 9-5. Comparison of MEV mitigation approaches (Data source: compiled by the author)

The comparison with dYdX v4 is especially instructive, because, like Hyperliquid, it is a decentralized order-book exchange on an application-specific chain. dYdX v4 mitigates single-point ordering manipulation by distributing ordering rights to validator consensus, but it does not classify different transaction types semantically at the protocol level, and all orders are treated equally when ordered. As a result, dYdX v4's market makers do not enjoy Hyperliquid-style protocol-level cancellation-priority protection, but they also avoid the suppression of informed-trader incentives that semantic ordering entails. The two paths strike different balances between liquidity protection and price discovery efficiency.

The value of surveying these solutions is that it reveals Hyperliquid's design choice to be not without alternatives but a particular philosophical and engineering trade-off made among several viable paths.

9.1.7 The interaction of semantic ordering with the transaction lifecycle

Semantic ordering does not act in isolation on the transaction-ordering stage; it interacts deeply with the other core subsystems of perpetual futures, and these interactions both amplify the protective effect of semantic ordering and, under certain conditions, introduce new dimensions of risk.

At the level of the margin system, the interaction between semantic ordering and liquidation cascades differs between isolated margin and cross margin. Under isolated margin, the liquidation of a single position does not affect other positions, and cascade risk is confined to a single trading pair; under cross margin, the liquidation of one position may render overall margin insufficient and trigger a chain of liquidations across trading pairs. Semantic ordering provides the same ordering protection in both modes, but under cross margin the transmission path of a liquidation cascade is more complex, and its systemic risk lies beyond what the ordering layer can cover.

At the level of funding rate settlement, the periodic settlement of the funding rate is placed at the system's highest priority (Table 9-1), which means that settlement transactions cannot be front-run by market participants at the ordering level (although, as Section 9.4.3 shows, the external price inputs on which the funding rate and mark price depend can still be manipulated; the protection here is confined to on-chain execution ordering). This design safeguards the integrity of the funding rate mechanism as a price-anchoring tool for perpetual futures, and its detailed workings are analyzed in Chapter 10.

At the level of the liquidation engine, the design choice to place liquidation orders at standard priority produces subtle but important consequences. When a market maker's Cancel instruction and the liquidation engine's forced-closure order coexist within the same block, the Cancel, as high priority, executes before the liquidation order — that is, the market maker can withdraw its quote before the liquidation order seeks a fill. This protects market makers from being forced to absorb liquidated positions at extreme prices, but it may also leave liquidation orders facing thinner order-book depth at execution, degrading the quality of liquidation execution. The JELLY incident is precisely an extreme manifestation of this interaction: when many market makers exercised their cancellation priority before liquidation was triggered, an oversized liquidated position, unable to find sufficient depth on the order book, was transferred to the HLP Vault, as analyzed in depth in Section 9.4.3. These interactions show that the effects of semantic ordering cannot be assessed in isolation from the broader contract-settlement system in which it is embedded. The design details of the liquidation mechanism and the margin system are discussed in Chapter 11 and Chapter 10, respectively.

The effectiveness of this macro-level framework depends heavily on its most contested concrete implementation in practice: cancellation priority.

9.2 The cancellation priority mechanism

Cancellation priority is the most directly consequential concrete rule within the semantic ordering framework. The rule stipulates that, within a block's processing cycle, every instruction that seeks to cancel an existing order has an execution priority absolutely higher than that of every new instruction that seeks to fill those orders. This design gives market makers a right of last look enforced by the consensus protocol.

In traditional financial markets, last look is a market maker's final opportunity to accept or reject a client order in light of the latest market information. This power has been widely questioned for its opacity and potential conflicts of interest. Hyperliquid, however, fundamentally reworks this concept. Here, last look is not a market maker's private privilege but a public, universal rule hardcoded into the consensus protocol. All market participants are fully aware of the rule's existence and can adjust their strategies accordingly. This complete transparency means cancellation priority is no longer an unfair advantage but a known initial condition that reshapes the market game.

9.2.1 Hedging adverse selection

To understand the effect of cancellation priority, one must return to the core market-microstructure concept analyzed in Section 7.1.3: adverse selection. A market maker's core business is to quote continuously under uncertainty (its strategy framework is given in Section 7.7.1); its profit comes from the bid-ask spread, while its greatest risk comes from trading against better-informed informed traders. When external information causes the true value of an asset to change, informed traders can arbitrage against a market maker's stale, not-yet-updated quote, and the loss this imposes on the market maker is the adverse selection cost. The classic model of Glosten and Milgrom (1985) systematically shows that a market maker's quoted spread must be wide enough to cover the expected loss it incurs when trading against informed traders ^[5].

In the CEX and general-purpose DEX environments, market makers have limited means to combat adverse selection: they mainly rely on investing in faster technical systems to cancel first, or on widening their quoted spread to pass the risk cost on to all traders up front. The cancellation priority mechanism offers a third solution: at the protocol level, it compresses the probability of within-block adverse selection under normal market conditions to a residual level near zero (with risk remaining only in a narrow window near the block boundary). In essence, it establishes a layer of structural separation, enforced by the consensus protocol, between the aggressive orders of informed traders (such as arbitrageurs) and the defensive cancellation instructions of market makers.

Figure 9-3 compares the execution outcomes of the same set of trading instructions in the CEX and Hyperliquid scenarios.

Figure 9-3. Comparison of execution timelines for the CEX and Hyperliquid (hypothetical worked example, not empirical data; $1,995, $150, 450 μs, and approximately 200 ms are all illustrative values; the mechanism by which the Cancel precedes the IOC is grounded in Section 9.1.2 and ^[5])

When the external market price changes, market maker Alice and arbitrageur Bob send instructions to the system at the same time. Even if Bob's instruction physically arrives first, as long as it falls within the same block as Alice's cancellation instruction, the protocol's consensus rules force Alice's cancellation to be processed first. This means the protocol gives Alice a protection window of about 200–400 ms (one block time), allowing her to withdraw a stale quote before it is executed. This mechanism significantly lowers a market maker's adverse selection cost, enabling it to provide liquidity at narrower spreads over longer periods.

9.2.2 A comparison with the IEX speed bump

The design philosophy of cancellation priority is often compared with the speed bump of the IEX exchange. IEX's design, popularized by Michael Lewis in his book Flash Boys ^[10], imposes a physical delay of about 350 microseconds on all orders entering its matching engine by routing them through 38 miles of coiled fiber-optic cable, with the aim of eliminating the speed differential between high-frequency trading (HFT) firms and other market participants. Although the two share a similar goal — creating a fairer market environment — they differ fundamentally in philosophy and mechanism (Table 9-6).

Table 9-6. Cancellation priority versus the IEX speed bump (Data source: compiled by the author)

The speed bump is a form of physical slowdown that attempts to patch a flawed rule system through technical means. Cancellation priority, by contrast, is a change of rules that fundamentally alters the rules of the game. The behavioral difference between the two under liquidity-stress scenarios is especially critical: IEX's delay is symmetric, applying equally to all orders (including cancellations), so during a liquidity contraction the rate at which market makers withdraw slows in step with the rate at which takers consume, and the net change in liquidity is relatively gradual. Hyperliquid's mechanism, by contrast, is asymmetric: only cancellations receive priority acceleration, and in a liquidity-contraction scenario, where cancellations far outnumber new resting orders, net liquidity may drop sharply within a single block. This asymmetry strengthens liquidity supply in normal markets but may accelerate liquidity evaporation during periods of stress. The D-Limit order type that IEX later introduced also began to incorporate a semantically aware design philosophy, indirectly corroborating the need to solve the ordering problem at the level of protocol rules.

9.2.3 Structural effects

The cancellation priority mechanism has profound structural effects on the market ecosystem, the most direct of which is a fundamental shift in the dimension along which market makers compete. In the CEX, a two-dimensional competition of speed plus model dominates, whereas in Hyperliquid the importance of speed is greatly diminished and the competitive focus shifts to model quality itself. This significantly lowers the barrier to entry for market making, enabling small quantitative teams that lack the capacity to invest in top-tier infrastructure to compete, thereby increasing the diversity of liquidity supply in the market. By comparing market makers' cost structures across the two environments, Figure 9-4 illustrates this structural shift from infrastructure investment to competition on model quality.

Figure 9-4. Comparison of market makers' cost structures across trading environments (conceptual illustration, not empirical data; $/$$/$$$, ~0, and N/A are qualitative cost tiers, not measured monetary values; maps to Sections 9.2.3 and 9.5.1)

Figure 9-4 reveals a structural shift: infrastructure investment falls from a dominant position in the CEX environment to a marginal level in the Hyperliquid environment, while model development and data analysis take its place as the core cost items. The direct consequence is that the capital barrier to entry for market making falls while its intellectual barrier to entry rises.

The mechanism also forces high-frequency takers to shift their strategies from latency arbitrage toward information-driven approaches. The traditional strategy of sniping stale quotes becomes unprofitable, forcing these traders toward strategies that rely more on information analysis and predictive capability — for example, predicting market makers' behavior patterns, or acting as a price-transmission intermediary across exchanges to promote price convergence, rather than arbitraging price lags.

At the level of spread structure, the effect of cancellation priority is equally significant. By lowering adverse selection and infrastructure costs, market makers can remain profitable even while quoting narrower spreads. Empirical data show that, during calm market periods, the spreads on Hyperliquid's major trading pairs are typically comparable to, or even better than, those of top-tier CEXs (the measurement basis for this comparison and the static-versus-effective-depth qualifications are detailed in Section 9.5.4). However, the cost of these narrow spreads reveals a liquidity paradox. The research framework of Foucault, Kadan, and Kandel (2005) on the resilience of limit order markets helps in understanding this phenomenon ^[11]: cancellation priority lowers the option cost of a market maker's resting order, and under normal market conditions this incentive leads market makers to provide tighter spreads and deeper order books; but the same mechanism also means that, during periods of market stress, market makers can withdraw all of their liquidity with frictionless speed. The prospect theory of Kahneman and Tversky (1979) offers a behavioral explanation: when market volatility spikes, loss aversion drives market makers to exercise their cancellation right immediately rather than wait and assess ^[12]. Because the execution cost of cancellation (including its psychological cost) is reduced to near zero at the protocol level, panic withdrawal may occur faster and more completely on Hyperliquid than in the CEX environment. This constitutes a procyclical effect: the very mechanism that improves liquidity in normal times accelerates its evaporation in a crisis. Potential mitigations include introducing minimum market-making obligations or imposing a cancellation cooldown during extreme volatility, but these options are in tension with the core design philosophy of cancellation priority.

For ordinary traders, the net effect is positive. They enjoy lower transaction costs, and the risk of their market orders being sandwiched is significantly reduced. But they must also adapt to a new market characteristic: some of the liquidity displayed on the order book may be apparent liquidity — the depth illusion defined in Section 8.2 appears in a new form under the cancellation priority mechanism, in that when they attempt to execute a large order, this liquidity may vanish as market makers exercise their cancellation priority. For institutional traders who need to execute large orders, the complete transparency of the on-chain environment poses a structural challenge to execution quality. Traditional execution algorithms such as the time-weighted average price (TWAP), the volume-weighted average price (VWAP), and iceberg orders face a fundamental dilemma in a fully transparent on-chain environment: the size, timing interval, and direction of every child order are visible in real time, allowing competitors to infer the total size and execution strategy of the parent order. The optimal-execution framework of Almgren and Chriss (2001) shows that information leakage increases the permanent price-impact cost ^[13]: when market participants can anticipate the later portions of a large order, they adjust their quotes in advance, causing execution prices to deteriorate systematically. This transparency cost partly offsets the spread-level benefit that cancellation priority brings to institutional traders.

The effectiveness of the cancellation priority mechanism depends on a key structural foundation: the discrete-time window inherent to on-chain matching (about 200–400 ms). It is this window that forcibly reduces the resolution of the speed race from the nanosecond to the hundred-millisecond scale, making rules rather than speed the dominant factor in ordering. Its structural origin as an inevitable consequence of on-chain matching, and the mechanism-design space it opens up, are detailed in Section 9.3.

9.3 Discrete-time matching: an inherent property of on-chain matching

Semantic ordering and cancellation priority define the rules for who should be processed first, but these rules can take effect only if the matching engine can collect multiple transactions within a time window before ordering them together. Discrete-time matching provides this structural foundation. Discrete-time matching is not a mechanism invented by Hyperliquid but an inherent structural feature of any on-chain matching system: a blockchain reaches consensus and processes transactions in units of blocks, so once a matching engine is placed on-chain, it must process transactions in batches by block, switching from continuous time to a discrete-time window (about 200–400 ms). This structural feature is not itself complex, but Hyperliquid astutely recognized the mechanism-design space it creates and built semantic ordering and cancellation priority on top of it, fundamentally transforming the market's speed game.

9.3.1 Continuous- versus discrete-time games

To understand the economic consequences of discrete-time matching, one must first examine its opposite: the inherent problems of continuous-time matching. Budish, Cramton, and Shim (2015) argue that the continuous-time limit order book inherently gives rise to a speed race, because under this mechanism even a microsecond-level speed advantage can be converted into a deterministic profit ^[14]. This channels vast social resources into a zero-sum or negative-sum race to invest in infrastructure — building dedicated microwave towers, laying undersea fiber-optic cables — and ultimately concentrates the market ever more tightly among a few top-tier HFT firms.

In traditional financial markets, the communication latency between the Chicago Mercantile Exchange (CME) and the New York Stock Exchange is a classic arena of the speed race. HFT firms invested hundreds of millions of dollars to build microwave-tower networks solely to shorten data-transmission latency along the Chicago–New York corridor from about 6.0 ms to about 3.8 ms (data from roughly 2014–2018; the latency of the most advanced microwave networks today may be lower). In a continuous-time winner-take-all game, this roughly 2.2 ms advantage can generate tens of millions or even hundreds of millions of dollars in profit each year, because the participant that reacts first to a price change captures almost all of the arbitrage opportunities. Hyperliquid's block time of about 200–400 ms is precisely where the economic essence of discrete-time matching lies: it transforms the winner-take-all game of continuous time into equal competition within a discrete-time window — as long as instructions fall within the same block, speed differences within the block no longer generate economic value at the protocol level (a quantitative worked example is given in Section 9.3.5).

Hyperliquid's L1 uses the HyperBFT consensus algorithm, a derivative implementation of the HotStuff family. Under normal network conditions, HyperBFT's block latency is about 200 ms; under high load (as during the JELLY incident), block time may extend to 400 ms or longer owing to mempool congestion and increased communication latency among validators. The 200–400 ms range of block times reflects precisely this load-dependent dynamic. Hyperliquid's matching mechanism operates in discrete time, with the block as its basic unit. The processing flow for each block (as shown in Figure 9-5 ^[3]) is uniform: collect transactions from the mempool, order them according to the semantic rules, match them one by one within the ordered sequence under a price-first, time-second principle, and finally update the order book state all at once and commit the block. This batch-processing model has significant microstructural consequences.

Figure 9-5. Hyperliquid's block-processing flow (mechanism illustration; the flow follows Hyperliquid documentation ^[3]; the priority tiers: System/High/Standard shown in the figure are an interpretive reconstruction in this chapter — what the documentation ^[3][4] explicitly records is only cancellations and post-only orders ahead of GTC/IOC taker orders, and placing mark price and funding rate updates and liquidation in separate ordered tiers is an interpretive reconstruction made in this chapter for analytical convenience rather than the documentation's own text; see the note to Table 9-1)

Figure 9-5 reveals an important design feature: semantic ordering takes place after transaction collection and before sequential matching — a three-stage flow of classify, then order, then match — which is the concrete way in which semantic ordering and discrete-time matching operate in concert.

9.3.2 The displacement of speed competition

The discrete-time matching mechanism displaces the dimension of the speed race. Within a block, the execution order of all transactions of the same type is determined by the order in which the block proposer receives them; but because the mempool typically buffers several blocks' worth of transactions, most transactions wait briefly in the pool before being packaged. This greatly dilutes the who sends first speed advantage within a block. Speed competition is not eliminated entirely, however, but is displaced to the level between blocks. If a participant's transaction can enter the mempool earlier than others', it is more likely to be packaged into an earlier block. The speed race therefore falls from the microsecond-level competition of the CEX to the hundred-millisecond-level competition of Hyperliquid.

This between-block speed competition is especially pronounced near the block boundary. As a block's packaging deadline approaches, a residual speed competition persists within a fuzzy interval of about 10–20 ms. Even so, compared with the 1–10 microsecond competition window of the CEX, Hyperliquid has reduced the intensity of speed competition by about three orders of magnitude.

9.3.3 A comparison with frequent batch auctions

Although Hyperliquid nominally still uses a price-time-priority central limit order book (CLOB) mechanism (its structure and rules are covered in Section 8.1.1), its discrete-time batch-processing property gives it some of the characteristics of the frequent batch auction (FBA) introduced in Section 8.8.3. The core idea of the FBA is to collect all orders within a time window and then execute all matchable orders at a single uniform clearing price, thereby eliminating the speed advantage entirely in theory ^[14]. Hyperliquid does not adopt a uniform clearing price but continues to use price-time-priority sequential matching within the block. Within a single priority category, transactions are arranged in the order in which the block proposer receives them from the mempool, effectively forming a first-in-first-out (FIFO) ordering. However, because the block proposer retains final control over the received ordering, this constitutes a concrete dimension of MonarchEV. This within-priority ordering rule gives rise to a key difference from the FBA.

Suppose that within a block window the order book has sell orders at $2,002, $2,005, and $2,010, and that market buy orders from three buyers — Alice, Bob, and Carol — arrive simultaneously, with total demand less than or equal to the total supply at or below the $2,005 price level. Under the FBA mechanism, all buyers execute at the uniform clearing price of $2,005, and their arrival times are entirely irrelevant. Under the Hyperliquid mechanism, by contrast, the earliest-arriving buyer, Alice, first executes a portion at $2,002 and then the remainder at $2,005, obtaining a better average execution price. The later-arriving buyers, Bob and Carol, can execute only at $2,005. In this scenario, Alice's speed advantage — even if only at the millisecond level — brings her an economic benefit. Moreover, the block proposer can choose which of Bob and Carol executes first, which constitutes one source of residual MEV.

The differences in pricing mechanism, residual speed advantage, and MEV risk distribution revealed by this case can be compared systematically in Table 9-7.

Table 9-7. Key differences between the Hyperliquid and FBA mechanisms (Data source: compiled by the author)

Hyperliquid's design can be seen as a balance between the theoretical goal of the FBA and the practical constraints of the CLOB. It largely achieves the FBA's main goal (greatly weakening the speed race) while retaining the user experience of a traditional order book and a relatively simple implementation logic.

Behind this mechanistic difference lies a deeper divergence in design philosophy. Hyperliquid and the FBA share a common idea — both counter the speed race by discretizing time ^[14] — but they differ fundamentally in implementation path and philosophical orientation. The core of the FBA is a uniform clearing price, so that all trades within the auction window execute at the same price, eliminating the incentive to front-run. Hyperliquid, by contrast, remains a price-time-priority order book: within a block, transactions execute sequentially by semantic priority and price level, and the price can move. Hyperliquid absorbs the core idea of the FBA but combines it with the traditional order-book mechanism and the innovative rule of semantic ordering. Hyperliquid differs structurally from the FBA along the dimensions of matching mechanism, price formation, ordering rules, and HFT-suppression strategy, and Table 9-8 provides a systematic comparison.

Table 9-8. Discrete-time matching versus the FBA (Data source: compiled by the author)

From a theoretical perspective, the core logic by which Budish et al. ^[14] argue for the FBA is that it breaks the prisoner's dilemma of the speed race. The discrete-time property inherent to on-chain matching achieves the same effect, and Hyperliquid adds to it a dimension the FBA lacks: semantic ordering. In the FBA, all participants are entirely equal within each auction window; in Hyperliquid, market makers' cancellation instructions are explicitly given higher priority. This is an important design difference: the FBA pursues procedural equality, whereas Hyperliquid pursues outcome optimization, explicitly placing the interests of liquidity providers above those of liquidity consumers. Hyperliquid can therefore be seen as a more explicit, deliberately weighted, and pragmatic implementation of the FBA idea in a blockchain-native environment.

9.3.4 Synergy with semantic ordering

The discrete-time property of on-chain matching and semantic ordering are mutually reinforcing complements, and their combination forms the foundation of Hyperliquid's microstructure. Discrete time creates a batch window that provides the basis for implementing semantic ordering. In continuous-time matching, orders are processed one by one in order of arrival, making it impossible to establish priority relationships among different order types. Conversely, semantic ordering solves an inherent problem of discrete time: within a batch window, absent explicit ordering rules, the block proposer would have complete freedom to order all transactions, which would lead to unconstrained MEV extraction. Through predefined priority rules, semantic ordering strictly limits the block proposer's discretion, compressing the MEV space to the single dimension of ordering within the same category.

Neither element can stand without the other. Without discrete time, semantic ordering cannot be implemented in continuous time; without semantic ordering, discrete time would degenerate into a pure block-space auction, leading to uncontrolled block-proposer MEV. Other decentralized exchanges share the structural feature of discrete time but have not converted it into a microstructural advantage. Hyperliquid's innovation lies in recognizing the mechanism-design space embedded in the discrete-time window inherent to on-chain matching and, on top of it, building semantic ordering and cancellation priority, thereby creating a self-consistent microstructure with few direct precedents in the known practice of either traditional finance or crypto finance.

Figure 9-6 presents the synergy between discrete-time matching and semantic ordering and its effect on the market ecosystem.

Figure 9-6. The synergy between discrete time and semantic ordering (conceptual illustration, not empirical data; MEV is compressed to ordering within a single priority category — that is, residual MonarchEV, a term drawn from the {Monarch, Moloch, Mafia} extractable-value framework of Sun 2022 ^[25] and not official Hyperliquid terminology)

Figure 9-6 shows that discrete time creates the batch window that makes semantic ordering implementable, while semantic ordering constrains the block proposer's discretion; the interaction of the two compresses the MEV space to the single dimension of ordering within a priority category, whose scale and harm are far smaller than the unconstrained MEV extraction seen on a general-purpose DEX.

9.3.5 The weakening of the speed race

In the CEX's continuous-time matching environment, a speed lead is measured in nanoseconds (billionths of a second), and HFT firms invest enormous sums to achieve it. In Hyperliquid's discrete-time matching environment, by contrast, the smallest unit of time is one block time (a few hundred milliseconds). This means that whether a trading instruction arrives with a latency of 1 microsecond or 100 ms, as long as it falls within the same block window it is treated as equal along the time dimension. What determines execution priority is no longer physical speed but the protocol's semantic rules.

This compression of time granularity from nanoseconds to milliseconds renders the traditional speed advantage of HFT almost entirely ineffective. Drawing on the theoretical framework of Budish et al. ^[14] and Hyperliquid's technical documentation ^[3], Figure 9-7 compares the effective competition time windows of different trading platforms.

Figure 9-7. Comparison of effective competition time windows across trading platforms (representative parameters, not an external dataset; logarithmic time axis; Ethereum's block time of about 12 s and Hyperliquid's of about 200–400 ms follow Hyperliquid documentation ^[3] and refer to block production and confirmation rather than the roughly 70 ms single-block finality; the 1–10 μs for top-tier HFT and 50–500 μs for standard market making are industry orders of magnitude; the theoretical FBA spanning the entire window follows Budish et al. 2015 ^[14]; about 50,000 times the roughly 4 μs window of top-tier HFT is an arithmetic inference)

A simple model can quantify this effect. Suppose that on a CEX, HFT firm A has a latency of 50 microseconds and market maker B has a latency of 500 microseconds; A is 450 microseconds faster than B, a gap sufficient for A to capture B's stale quote first on every price change. But on Hyperliquid, where the block time is 200 ms (200,000 microseconds), the 450-microsecond latency difference between the two is only 0.225% of the block time. As long as the instructions fall within the same block, this difference is irrelevant. The resolution of the speed race is forcibly lowered from the nanosecond to the hundred-millisecond scale, substantially equalizing the competitive conditions among participants and shifting the competitive focus from infrastructure speed to model quality and information-analysis capability.

On January 11, 2024, the U.S. Bureau of Labor Statistics released higher-than-expected consumer price index (CPI) data, setting off a chain reaction in the markets. At t = 0 the data are released; at t + 5 ms, algorithmic trading systems in the Chicago futures market react first and BTC futures prices fall; at t + 15 ms, top-tier HFT market makers on Binance begin adjusting their quotes; at t + 50 ms, spot prices on Binance have finished adjusting. Between t + 50 ms and t + 200 ms, market makers on Hyperliquid detect the price change on Binance and send Cancel instructions. At the same time, arbitrageurs also detect the spread and send IOC buy orders in an attempt to attack the stale quotes. The instructions of both fall within the same block. At t + 200 ms, the block is processed. Under the cancellation priority rule, the market makers' cancellation instructions execute before the arbitrageurs' buy orders. The market makers successfully withdraw their stale quotes and avoid loss, while the arbitrageurs' buy orders fail for lack of a counterparty. This case reveals a core characteristic of Hyperliquid's microstructure: its price discovery carries a structural lag of about 150–200 ms, giving it a price-following relationship to external markets. It is precisely this lag window that gives market makers ample time to send Cancel instructions, and the cancellation priority rule ensures that these instructions execute ahead of an attack, so that discrete time and cancellation priority form an effective synergy here. At the block boundary (for example, around t + 200 ms), a brief, temporary absence of liquidity may occur, because the market makers' old quotes have been withdrawn while their new quotes have not yet been confirmed on-chain.

9.3.6 Block time as a hyperparameter

The preceding analysis has treated the 200–400 ms block time as a given system parameter, but from a mechanism-design perspective, block time is an adjustable hyperparameter whose value directly determines the trade-off surface between the strength of market-maker protection and price discovery efficiency. When block time is short (for example, close to 50 ms), fewer transactions are collected within each block window, the reaction time available to market makers is compressed, the probability that a Cancel instruction lands in the same block as an aggressive order declines, adverse selection risk partly returns, market makers are forced to quote wider spreads to compensate, and the system's speed-competition characteristics begin to approach those of the CEX. When block time is long (for example, more than 2 seconds), market makers gain an ample protection window and adverse selection risk falls further, but the price-following lag widens in step. Within each block cycle, order-book quotes drift steadily away from external market prices, so market makers must widen their spreads in advance to cover this quote-staleness risk. The risk arises from within-block price drift, not from any need to hold positions longer, since market makers can still cancel and re-quote each block. The equilibrium spread therefore traces a U-shaped curve: when block time is too short, adverse selection costs push the spread up; when block time is too long, inventory risk and price staleness push the spread up; and in the middle region there is an optimal block time that minimizes the total spread.

Hyperliquid's current choice of a 200–400 ms block time can be located within this framework. Compared with other L1s, Ethereum's 12-second block time offers ample room to implement semantic ordering but too large a price-following lag; Solana's block time of about 400 ms is close to Hyperliquid's but does not introduce semantic ordering; and the subsecond block times of layer-2 (L2) chains such as Arbitrum likewise lack differential treatment of transaction types. Hyperliquid's distinctiveness lies in combining a relatively short block time with semantic ordering, seeking to operate near the low point of the U-shaped curve. The U-shaped curve above is a qualitative description, and its quantitative calibration faces significant challenges. The parameters of the FBA model of Budish et al. ^[14] are estimated from the volatility characteristics and participant structure of U.S. equity markets, and extending them directly to the crypto perpetual futures market would require recalibration to markedly different volatility distributions, leverage structures, and participant compositions. The optimal block time may differ significantly across trading pairs — for example, the difference in volatility characteristics between BTC perpetual futures and long-tail tokens implies that their optimal points on the U-shaped curve may lie far apart — yet Hyperliquid currently applies a uniform block time to all trading pairs. As the underlying consensus technology advances, block time may shorten further, which would improve the price discovery lag but would also compress the protection window provided by cancellation priority; the dynamic balance between the two requires ongoing empirical calibration.

9.3.7 Boundary effects and MonarchEV

Discrete-time matching has inherent limitations, one distinctive risk being the block-boundary effect. Because transactions are processed in discrete blocks, transactions that happen to fall near the boundary between two blocks may have sharply different outcomes. As shown in Figure 9-8, market maker Alice sends a Cancel instruction 1 ms before block N's deadline tN; but if network latency delays that instruction so that it reaches the validator node 1 ms after tN, it is assigned to block N+1. During the processing of block N, Alice's stale quote is still active and may be filled by an arbitrageur within that block.

Figure 9-8. The block-boundary effect (hypothetical worked example, not empirical data; t − 10 ms and t + 1 ms are illustrative timestamps showing that cancellation priority provides near-absolute protection within a block but leaves a narrow gap at the block boundary; maps to Section 9.3.7)

This means that although cancellation priority provides near-absolute protection within a block (conditional on the cancellation being submitted and received by the proposer within the same block), a narrow protection gap remains at the block boundary, its width depending on fluctuations in network latency and typically ranging from a few milliseconds to a few tens of milliseconds. Market makers must therefore still attend to the network latency between themselves and the validator nodes, but the aim is to ensure that instructions reliably land in the intended block rather than to compete within a block — the competitive focus shifts from a within-block speed race to a cross-block reliability race, whose investment scale is far smaller than that of the traditional speed-infrastructure race.

Moreover, discrete-time matching does not eliminate MEV entirely. HyperBFT selects block proposers through a deterministic leader-rotation mechanism, which means that the identity of the next block's proposer is technically predictable. MEV searchers can exploit this predictability by submitting priority-ordering requests directly to the validator about to produce a block. Within a block, the power to order transactions of the same priority (for example, two IOC orders) still rests with that block's proposer — the MonarchEV defined in Section 9.1.4. Although this MEV is far smaller in scale and harm than the MEV on a general-purpose DEX, it remains a concentration of power worth attending to within the Hyperliquid ecosystem.

The discrete-time property inherent to on-chain matching is the structural foundation of Hyperliquid's microstructure innovations. By switching time from continuous to discrete, the blockchain fundamentally changes the market's competitive paradigm: it not only greatly weakens the advantage of traditional HFT but also provides the necessary conditions for implementing the two mechanism innovations of semantic ordering and cancellation priority. The combination of the discrete-time property with these two mechanism innovations forms a complex synergistic system whose inherent trade-offs and risk boundaries equally merit examination.

9.4 Synergies and trade-offs

The power of the three-layer mechanism — semantic ordering, cancellation priority, and discrete-time matching — arises not from any layer operating in isolation but from the complex system they form in concert. The discrete-time property inherent to on-chain matching divides the continuous flow of time into discrete block windows, creating the necessary conditions for semantic ordering within a batch; semantic ordering, in turn, defines a non-economic, rule-based priority for the flow of transactions within that window, at the core of which is granting cancellation operations priority. Acting together, this layered structure significantly alters the market's microdynamics but also introduces new trade-offs and risk boundaries. This synergy ultimately drives a positive feedback loop aimed at strengthening the market's core function — liquidity: a self-reinforcing transmission chain running from market-maker protection to narrower spreads, greater trading volume, and the entry of more market makers, whose complete chain is laid out in Section 9.4.8 (Figure 9-9). In practice, however, this self-reinforcing loop faces multiple constraints, and its inherent trade-offs and risk boundaries merit examination one by one.

9.4.1 Transparency effects

One of Hyperliquid's core value propositions is its high degree of transparency, and the tension between verifiability and strategy privacy analyzed in Section 7.5 is concentrated here. All trade histories, order book snapshots, and even the protocol's ordering rules themselves are recorded on-chain and can be audited by anyone. This design eliminates the black box problem of centralized exchanges and establishes trust grounded in verifiable facts. However, this complete transparency also carries an asymmetric side effect: in eliminating one form of information asymmetry, it creates a new dimension of information competition, giving rise to a race in analytical capability.

Because all data are publicly available, quantitative analysis teams can use sophisticated algorithms to reverse-engineer the trading strategies of other market participants, market makers in particular. By analyzing a particular market maker's quoting behavior, inventory management, and cancellation patterns under different market conditions, one can infer the key parameters of its model. These reverse-engineered strategy characteristics are called a strategy fingerprint. Having captured a rival's strategy fingerprint, a competitor can develop targeted countermeasures — for example, slightly improving on the rival's quote after it posts — and thereby systematically capture its order flow.

A small quantitative market-making team, AlphaQuant, deployed an innovative market-making model on Hyperliquid and performed excellently at first. Months later, however, its profits fell sharply. Investigation revealed that a competitor had fully replicated its core algorithmic model by analyzing all of its public on-chain trade data. The competitor had captured AlphaQuant's behavioral fingerprint — for example, its cancellation thresholds and spread-adjustment patterns at particular volatility levels — and developed dedicated countermeasures on that basis. Because of Hyperliquid's transparency, AlphaQuant's strategic edge was rapidly eroded. In response, the team had to develop strategy obfuscation techniques, such as adding random noise to its quotes and randomizing cancellation delays, but this sacrificed a certain proportion of its market-making efficiency. Strategy obfuscation necessarily reduces signal precision in theory, because introducing noise also disturbs the market maker's own optimal quoting decisions; the exact magnitude of the efficiency loss, however, depends on the obfuscation parameters and market conditions, and public empirical measurements are still lacking. Although this analytical competition does not consume physical resources the way the CEX speed race does, it likewise raises the barrier to market making and poses a new challenge to small participants. This reveals an inherent contradiction: cancellation priority lowers the speed barrier to market making, but complete transparency raises the barrier of strategic complexity. The deeper risk is that on-chain transparency exposes not only individual strategies but also makes coordinated group behavior possible. The complete observability of market makers' positions and the HLP Vault's holdings, amplified by social media, can catalyze coordinated behavior against a particular participant; the JELLY attacker analyzed in Section 9.4.3 exploited precisely the public visibility of the HLP Vault's risk exposure to design its attack path.

9.4.2 The price discovery lag

Hyperliquid's mechanism design makes an explicit trade-off between protecting liquidity and promoting price discovery, choosing the former. Cancellation priority and discrete-time matching enable market makers to provide liquidity safely, but they also reduce market makers' incentive to quote proactively and push prices toward a new equilibrium level. Market makers increasingly favor a passive quoting strategy: quoting off the price of a mature external market such as Binance plus a fixed spread, and using cancellation priority to protect themselves when the external price moves, rather than actively predicting the direction of prices.

This pattern gives Hyperliquid's price discovery process a structural dependence: its price updates follow the price changes of external markets passively and with some lag (one block time). This inefficiency in price discovery is not a technical flaw but a cost paid to protect market makers in exchange for greater liquidity. Quantitatively, this lag is about one block time (200–400 ms) under normal market conditions ^[4]. During sharp market swings, because rising uncertainty may prompt market makers to withdraw from the market collectively, order-book depth can drop abruptly, and the lag in price adjustment may widen to several block times. This structural dependence on external markets is the inherent fragility of its price-following posture. In systemic deleveraging events (such as the global liquidity crisis of March 2020 or the FTX collapse of 2022), Hyperliquid faces not merely a one-block-time price-following lag but a second-order risk: when several CEXs experience liquidity droughts simultaneously, the price reference source itself becomes unreliable. Hyperliquid's oracle price (the core input to the mark price) is a weighted median of external CEX spot prices, on top of which the mark price adds components such as an order-book exponential moving average (EMA); if these CEXs exhibit significant price deviations or trading halts under extreme stress, the anchoring function of the oracle price and mark price fails simultaneously, potentially triggering improper liquidations or erroneous funding rate settlement.

9.4.3 The JELLY incident: attack chain and mechanism analysis

Any rule system, however finely designed, can be exploited by participants in unexpected ways. Kirilenko et al.'s (2017) study of the 2010 flash crash shows that even the rules of a mature market can be exploited in unintended ways under extreme conditions ^[15]. The JELLY incident of March 26, 2025, stress-tested Hyperliquid's rule system; its attack path is closely related to the liquidation-cascade transmission mechanism analyzed in Section 8.3.1 and exposed systemic fragilities lying beyond microstructural protection.

JELLY was, at the time, a newly listed low-liquidity token on Hyperliquid, with an average daily trading volume of only a few million dollars on external spot exchanges. The timeline of the attack can be reconstructed as follows. First, the attacker created three independent on-chain accounts (the absence of any linked-account detection meant this step triggered no risk-control alerts) and deposited a total of about $7.17 million in USDC ^[16]. Second, the attacker established hedged positions across the three accounts: two accounts opened JELLY long positions totaling about $4.05 million, while the third opened a JELLY short position of about $4.1 million, whose effective leverage was such that a 400% rise in the mark price would produce a loss far exceeding the principal. The attacker then bought JELLY heavily on external spot exchanges, using its extremely thin external liquidity depth to drive the price up several-fold (reported increases range from about 400% to several tens of times depending on the source; the settlement price of $0.0095 was the attacker's opening price). The sharp move in the external price was transmitted through the oracle to Hyperliquid's mark price. As described in Section 9.4.2, the mark price takes the weighted median of external CEX spot prices as its core input and adds components such as an order-book EMA on top; when the attacker's manipulated external price carried enough weight, the oracle price and mark price shifted substantially as a result. The shift in the mark price caused the short account's maintenance margin ratio to fall below its threshold, triggering forced liquidation.

Hyperliquid's liquidation waterfall follows a specific priority sequence: the liquidation engine first attempts to liquidate the position on the order book via limit orders; if order-book depth is insufficient or slippage exceeds a preset threshold, the position is transferred to the insurance fund; and if the insurance fund's resources are insufficient to cover it, the position is ultimately transferred to the HLP Vault as the backstop. In the JELLY incident, because the short position far exceeded the token's order-book depth on Hyperliquid (and, as analyzed in Section 9.1.7, market makers could withdraw their quotes before liquidation orders executed by exercising cancellation priority, further weakening available depth), the position rapidly broke through the first two lines of defense in the liquidation waterfall and was transferred to the HLP Vault. As the price of JELLY kept climbing, the unrealized loss on the short position absorbed by the HLP Vault reached about $13.5 million at one point (roughly 6% of the Vault's total assets); this figure exceeds the attacker's initial principal because, under high leverage, a short position's loss is theoretically unbounded. The real threat lay not in the 6% snapshot loss at that moment but in the trend: a short position's loss is theoretically unbounded and expands linearly as the mark price continues to rise. Absent timely intervention, the loss would rapidly erode the HLP Vault's total assets of about $230 million, constituting a systemic threat ^[17].

Hyperliquid's validator set reached consensus within about 2 minutes, voting to delist the JELLY perpetual futures and to forcibly settle all JELLY positions at the attacker's original opening price of $0.0095, rather than at the prevailing market price of about $0.50 ^[17]. Within 24 hours of the incident, about $200 million in funds flowed out of Hyperliquid.

9.4.4 Risk transmission and counterfactual analysis

The risk-transmission path of the JELLY incident follows a clear causal chain: external price manipulation → mark-price shift → insufficient margin → forced liquidation → absorption by the HLP Vault → widening unrealized loss → a shock to market confidence → outflow of funds → declining order-book depth → potential cascade liquidations. The roughly $200 million outflow within 24 hours accounted for a significant share of Hyperliquid's total value locked (TVL) at the time, and had this outflow continued to accelerate, it could have triggered the bank-run-style negative feedback loop described by Diamond and Dybvig (1983) ^[18], in which depositors' rational individual behavior (withdrawing funds to protect themselves) produces a self-fulfilling liquidity crisis at the collective level.

Counterfactual analysis helps assess the reasonableness of the intervention decision. Had the validators not intervened and had the JELLY price continued to rise, the HLP Vault's short-side loss would have grown linearly with the mark price (a short position's loss is theoretically unbounded); given the constraint of the Vault's total assets of about $230 million, a further several-fold rise in the mark price could have rendered the Vault insolvent. The Vault's insolvency would mean not only direct losses for depositors but also, through the confidence channel, a large-scale withdrawal of funds that would accelerate the reversal of the flywheel. Viewed through the lens of cross-market contagion, JELLY's vulnerability characteristics — extremely thin external liquidity depth, no position limits, and high leverage — are not an isolated phenomenon. Several long-tail token perpetual futures with a similar risk profile exist on Hyperliquid, and the correlation risk of a simultaneous attack on multiple instruments constitutes a systemic exposure that has not yet been adequately assessed.

9.4.5 Legal and governance implications of the emergency intervention

The validators' decision to force settlement at the opening price of $0.0095 rather than the market price of about $0.50 has economic implications worth analyzing in depth. This choice of settlement price protected the HLP Vault from further losses but simultaneously harmed the interests of legitimate JELLY long holders: participants who held JELLY long positions during the attack for ordinary trading reasons were forced to close out at a price far below the market price, and their profit opportunity was unilaterally taken away.

From the standpoint of legal characterization, this intervention could face varying degrees of scrutiny under different regulatory frameworks. Under the anti-manipulation provisions of the U.S. Commodity Futures Trading Commission (CFTC), settling at a non-market price could be seen as an exchange's artificial intervention in market prices. Under the European Union's MiCA framework, emergency measures must satisfy a proportionality requirement — the scope of intervention should be commensurate with the risk being guarded against. A comparable precedent in traditional finance is exchanges' power to make ex post adjustments to erroneous trades and abnormal prices (for example, Rule 588 on trade cancellation and price adjustment in the CME rulebook, which handles erroneous trades outside a no-review range, along with the related authority exchanges hold under market emergency conditions); such mechanisms are typically accompanied by pre-disclosed procedural rules and an ex post review process. Hyperliquid's validator intervention was completed in about 2 minutes, and this timeline reveals the double-edged nature of a small validator set in crisis response: the capacity for rapid coordination allows it to act decisively before losses widen, but the same feature also means that a handful of participants can make major decisions affecting all users within an extremely short time and without any preset governance-deliberation procedure. This tension points directly back to the qualified statement about decentralization in Section 9.1.2: validator consensus is technically majority rule, but in a small validator set the practical meaning of majority differs from the public's perception of decentralized governance.

9.4.6 The boundary of protection

The JELLY incident reveals the boundary of protection of Hyperliquid's microstructure system. Placing these mechanisms within a complete risk-management framework helps pinpoint their scope: pre-trade controls include margin requirements, position limits, and linked-account detection as admission controls; at-trade controls include transaction ordering, matching rules, and price protection as execution-layer mechanisms; and post-trade controls include liquidation execution, absorption of risky positions, and insurance-fund management as settlement-layer mechanisms. The protection afforded by semantic ordering, cancellation priority, and discrete-time matching is concentrated in the at-trade stage: semantic ordering eliminates bribe-based ordering manipulation, cancellation priority eliminates the within-block adverse selection risk that market makers face, and discrete time eliminates the nanosecond-level speed-race advantage. The combined effect of these three layers of protection is to compress the space for MEV extraction to the single residual dimension of ordering within the same priority category.

The JELLY attack path, however, bypassed precisely the at-trade layer: the attacker exploited the absence of linked-account detection and inadequate position limits at the pre-trade layer, together with the liquidation-absorption rules and cross-market price manipulation at the post-trade layer. Even if semantic ordering worked perfectly, and even if every Cancel instruction executed successfully within its intended block, the JELLY attack could still be carried out along exactly the same path. This shows that microstructural protection is a necessary but not sufficient condition: a complete market-safety system also requires independent defense mechanisms at the pre-trade layer (dynamic margin, position limits, cross-market monitoring) and the post-trade layer (liquidation rules, Vault governance, insurance-fund adequacy).

9.4.7 Validator economics and centralization risk

The effectiveness of the semantic ordering rules ultimately depends on those who enforce them: the set of validator nodes. Hyperliquid uses the HyperBFT consensus algorithm (a derivative of the HotStuff family), and its current validator set is relatively small (about 16–24 active validators, roughly 21 as of early 2026) ^[3]. This small size offers engineering advantages in delivering high throughput and low latency, but it also raises questions about the credibility of rule enforcement and about centralization risk.

On the MonarchEV dimension, validators (block proposers in particular) have ordering discretion within a single priority category. The preceding analysis characterized MonarchEV as a theoretical residual risk, but the accuracy of this judgment depends on the size and incentive structure of the validator set. In a validator set composed of a few nodes, the identity of the block proposer is highly predictable owing to deterministic leader rotation, and searchers can submit priority-ordering requests directly to the validator about to produce a block. Whether validators accept such requests directly determines the extent to which MonarchEV turns from a theoretical residual into an actual revenue source.

On the operational-risk dimension, a set of about 21 validators faces multiple infrastructure risks. Key management is the foremost concern: the Hyper Foundation controls a majority of the staked share, and a leak of its keys could in theory control the consensus process. Geographic and infrastructure concentration is the second layer of risk: if a majority of validators run on the same cloud provider, a single infrastructure failure could halt the chain or degrade it severely. Client-software homogeneity is the third layer of risk: all validators run the same client implementation, so a single software bug could paralyze the entire network; the Ethereum community's experience in promoting client diversity shows that this risk cannot be ignored in high-value systems. With open interest of $6.5 billion, the consequences of any of these single points of failure could be catastrophic.

On the moral-hazard dimension, the precedent set in the JELLY incident, where the validator set overrode the settlement price, creates an implicit expectation: when a position is large enough to threaten the solvency of the HLP Vault, validators may step in to protect it. This too big to fail implicit guarantee may be exploited strategically by large traders, who may game the validators' intervention behavior and take on risk exposure beyond the normal risk-control range, because they expect the system to backstop them in extreme situations. This moral hazard is structurally similar to the problem posed by systemically important institutions in traditional finance, but in a decentralized protocol there is no mature regulatory framework to constrain it.

9.4.8 The core trade-offs

Taken together, the synergy of this microstructure system can be summarized by the positive feedback loop shown in Figure 9-9.

Figure 9-9. The synergy and positive feedback loop of the microstructure system (conceptual illustration, not empirical data; a six-node self-reinforcing flywheel; the footnote symmetry of self-reinforcement and self-unraveling is validated by the JELLY incident of March 26, 2025, per ^[16][17]; its sustainability depends on supporting systems such as liquidation rules, the margin system, and Vault governance)

The positive feedback loop shown in Figure 9-9 follows the transmission chain of protocol-level protection → lower market-maker risk → narrower spreads → greater trading volume → the entry of more market makers, and its self-reinforcing nature means that once the initial conditions are met (that is, once the mechanism's protection is sufficiently effective), the accumulation of liquidity accelerates. This positive feedback loop is not without cost, however, and Hyperliquid's microstructure system makes a series of explicit, systematic trade-offs among the goals it pursues. These trade-offs are not judgments of right and wrong but value choices among different dimensions of market quality, and together they define the platform's market characteristics. These trade-offs span multiple dimensions — liquidity versus price discovery, market-maker protection versus taker rights, transparency versus strategy privacy, security versus performance, and rule certainty versus flexibility — and on each dimension Hyperliquid makes an explicitly weighted choice. Table 9-9 systematically summarizes the choice, benefit, and cost on each dimension.

Table 9-9. The five core trade-offs of Hyperliquid's mechanism (Data source: compiled by the author)

Hyperliquid's design philosophy explicitly chooses a value orientation of liquidity first, market-maker friendly, and transparently verifiable, accepting in return such costs as externally dependent price discovery, disadvantaged takers, and a lack of strategy privacy. Understanding these inherent, structural trade-offs is key to assessing whether the Hyperliquid model can be adopted more widely and how stable it will be over the long term.

9.5 Microstructure effects and the liquidity flywheel

The preceding analysis focused on the internal logic and trade-offs of the microstructure system; this section shifts the perspective from mechanism design to the systemic consequences at the market level. Semantic ordering, cancellation priority, and discrete-time matching do not act in isolation on individual traders; by reshaping the cost structure of market making, opening up channels for liquidity supply, and forming a self-reinforcing feedback loop, they exert a profound influence on Hyperliquid's overall market microstructure. The combined effect of these influences forms the basis of the core competitiveness that distinguishes Hyperliquid from both the CEX and the general-purpose DEX.

9.5.1 The restructuring of market-making costs and spread compression

Using the Glosten-Milgrom spread-decomposition framework established in Section 9.1.3 ^[5], the effect of the cancellation priority mechanism on the cost structure of market making can be analyzed quantitatively through its two dominant components: adverse selection costs and infrastructure costs. In the CEX environment, market makers must continually contend with the risk of informed traders arbitraging against stale quotes while also investing heavily in low-latency infrastructure to stay competitive in the speed race; Hyperliquid's cancellation priority mechanism produces a direct and quantifiable compression of both components.

On the adverse selection dimension, because Cancel instructions enjoy absolute priority within a block, a market maker can, with high probability, successfully withdraw a stale quote within the one-block-time window (200–400 ms) after an external price move. This reduces the probability of an adverse selection event from a competitive outcome that, in the CEX environment, depends mainly on physical latency, to a risk confined to a very small window near the block boundary. On the infrastructure dimension, discrete-time matching raises the effective competitive time granularity from the nanosecond to the hundred-millisecond scale, so that costly infrastructure investments such as dedicated microwave towers and colocated servers are no longer a necessary condition for the market-making business. The simultaneous decline in these two costs enables market makers to quote narrower spreads while remaining profitable. Empirical data show that, during calm market periods, the bid-ask spreads on Hyperliquid's major trading pairs are typically comparable to, or even better than, those of top-tier CEXs such as Binance (the measurement basis and the static-versus-effective-depth qualifications are detailed in Section 9.5.4), while the teams engaged in market making invest far less capital in infrastructure than comparable teams in the CEX environment. This restructuring of the cost structure is precisely the cost-side root of the shift in the focus of market-making competition described in Section 9.2.3 — from a capital-intensive speed race to knowledge-intensive competition on model quality.

9.5.2 The HLP Vault and the democratization of liquidity supply

Hyperliquid's microstructural protection not only lowers the operating costs of professional market makers but also provides the basic conditions for an entirely new mode of liquidity supply. The HLP Vault (Hyperliquidity Provider) is a liquidity-provider vault built into the Hyperliquid protocol that allows ordinary users to deposit USDC into the vault, where automated strategies carry out market-making operations on their behalf, and users share in the market-making returns in proportion to their holdings. The core premise of this design is that cancellation priority and discrete-time matching provide the vault's market-making strategy with the same protocol-level protection as a professional market maker: the vault's Cancel instructions likewise enjoy the highest execution priority within a block, and the probability that its stale quotes are filled by arbitrageurs is likewise compressed to a structural-residual level. Without these microstructural protections, a large, publicly visible liquidity pool with a predictable strategy would become an ideal attack target for informed traders, and market-making losses would far exceed returns.

The economic significance of the HLP Vault is that it transforms market making from an exclusive activity requiring professional infrastructure and quantitative-modeling capability into a source of return in which ordinary users can participate indirectly through capital contributions. In traditional financial markets and on CEXs, market-making returns are captured almost entirely by professional institutions with speed and model advantages. Hyperliquid's mechanism protection lowers the technical barrier to market making, and the HLP Vault further lowers the capital barrier, allowing dispersed small amounts of capital to pool into a liquidity pool with an impact on market depth. The narrative of democratized market making, however, also requires scrutiny of participants' behavioral characteristics. Barber and Odean (2000) show that retail investors systematically exhibit return-chasing bias, overconfidence, and recency bias ^[19]. In the context of the HLP Vault, its substantial historical returns (promoted during some periods as a high annualized figure, though independent estimates put the 2025 annualized return at about 11%–12% and the full-period compound annual growth rate (CAGR) at about 42%) may have attracted many participants who do not understand the underlying leveraged market-making risk and who may view it as a yield-farming product rather than an investment that bears the tail risk of market making. The pattern after the JELLY incident, in which assets under management (AUM) drew down by about 15% and then gradually recovered, is highly consistent with a typical panic-and-forget cycle, suggesting that participants as a group may systematically underestimate risk. Moreover, the structure of the HLP Vault (an investment of money, in a common enterprise managed by others, with an expectation of profit) formally satisfies the four elements of the Howey test ^[20]. If it were deemed a security in a major jurisdiction, its issuance and sale would require registration or an exemption, which would fundamentally constrain the scaling of democratized market making.

The JELLY incident also revealed an inherent fragility of this model: as a large, behaviorally predictable public liquidity pool, the HLP Vault's liquidation-absorption rules can be exploited in a targeted manner by attackers. There is an inherent tension between the vault's advantage of scale and its visibility as an attack target.

9.5.3 The liquidity flywheel and ecosystem sustainability

The two levels of influence described above — the compression of professional market-making costs and the opening of retail liquidity supply — together drive a self-reinforcing liquidity flywheel. The flywheel's operation relies on two coupled engines: professional market makers, drawn by lower adverse selection costs, provide tighter quotes, while HLP Vault users, drawn by a substantial share of market-making returns, deposit capital. Professional market makers benefit from the order-book depth thickened by the vault's capital (greater depth lowers the probability that a large order will move against their positions), while vault depositors benefit from the more efficient market conditions that professional market makers create (a more efficient market means more stable market-making returns). The positive feedback between the two accelerates the accumulation of liquidity: deeper liquidity brings narrower spreads, narrower spreads attract more trading volume, more trading volume generates more market-making profit, and that profit in turn attracts further entry by professional market makers and vault depositors.

A positive feedback loop, however, inherently possesses a symmetry between self-reinforcement and self-unraveling. The noise-trader model of DeLong, Shleifer, Summers, and Waldmann (1990) and Soros's theory of reflexivity both hold that the very mechanism by which a positive feedback loop reinforces itself in the upswing also reinforces itself in the downswing ^[21]. The JELLY incident provides an empirical test of this symmetry: in the positive phase, the HLP Vault's high returns attracted inflows, the inflows thickened order-book depth, and the greater depth further raised market-making returns, forming an upward spiral; in the negative phase (after JELLY), losses triggered outflows, an AUM drawdown of about 15% weakened order-book depth, and the decline in depth could further worsen market-making returns, forming a downward spiral. The recovery of AUM after JELLY suggests that the flywheel currently runs above critical mass, but the size of the safety margin is difficult to determine a priori: whether there exists a threshold of TVL or trading volume below which the flywheel would collapse irreversibly is an important question that remains to be tested.

The flywheel's scaling itself also faces endogenous constraints. The HLP Vault's current AUM of about $270 million (with a historical peak of about $500 million in mid-2025) operates within an average daily trading volume of $6.9 billion, and changes in its positions already carry significant market influence. As AUM grows, the vault faces a threefold capacity constraint: larger position adjustments produce greater price impact against limited order-book depth; a larger-scale quoting pattern is more easily identified and countered by competitors in a fully transparent on-chain environment; and a larger-scale withdrawal during emergency de-risking would intensify the market shock. These constraints imply a theoretical upper bound on AUM, beyond which market-making returns would be eroded by the vault's own scale effects.

The sustainability of this flywheel depends on the balance between protection and openness maintained by the microstructure system. If market-maker protection is too strong, tilting market conditions excessively toward market makers at the expense of takers' experience, trading volume may shrink as execution costs rise too high; if protection is too weak, market makers' profits are eroded, and both professional institutions and vault depositors may withdraw. The JELLY incident also revealed a third failure mode: the flywheel can be interrupted by an attack on the vault's infrastructure itself, even when the transaction-ordering and matching mechanisms function normally. The long-term stability of the flywheel therefore depends not only on the design quality of the microstructure mechanisms but also on the robustness of supporting systems such as liquidation rules, the margin system, and vault governance. The directions in which the Hyperliquid model evolves — the ongoing optimization of block time, the extension of semantic ordering rules, and the governance of validators' informational advantage — will all affect the flywheel's operating efficiency by altering this balance.

9.5.4 Empirical data and market performance

The theoretical predictions established in the preceding three subsections — that the compression of market-making costs narrows spreads, that the vault mechanism attracts retail capital, and that the flywheel effect drives the accumulation of liquidity — can be preliminarily validated against publicly available market data. As of March 2026, Hyperliquid's L1 TVL was about $4.4 billion and its average daily trading volume about $6.9 billion — roughly 15% of Binance Futures' daily volume — giving it about a 70% share of the on-chain perpetual futures market ^[22]. In terms of open interest, Hyperliquid's open interest was about $6.5 billion, roughly 30% of Binance Futures' (about $21.2 billion), while reaching more than 70 times that of dYdX (about $82 million) and more than 50 times that of GMX (about $124 million), far exceeding other on-chain competitors ^[23].

Before analyzing the specific data, the measurement methodology should be explained. The spread cited in this section is defined as the time-weighted average of the best bid and offer (BBO) spread — that is, the mean, weighted by time, of the difference between the best bid and the best offer at each moment within the observation window. Depth is defined as the total volume of resting orders within a certain percentage band of the mid price (typically 0.1–0.5%). The data source is public market data from CoinGecko and DefiLlama ^[22][23], with a sampling window of February–March 2026 and a sampling frequency of hourly snapshots. The choice of these measurement parameters directly affects the comparability and interpretability of the data.

In the BTC perpetual futures market, some snapshot data show that Hyperliquid's top-of-book bid-ask spread can be narrower than Binance's. The commonly cited specific figures (for example, a spread of about $1 versus $5.5, or mid-price depth of about 140 BTC versus 80 BTC) are difficult to trace to an independent primary source, and independent slippage estimates show that at larger trade sizes (for example, around $1 million) Binance typically offers deeper executable depth. The judgment that Hyperliquid has better depth should therefore be confined to the top of the book and read cautiously in light of the effective-depth discount discussed below ^[23]. This comparison must be qualified along two dimensions.

The first dimension is the distinction between static depth and effective depth. The 140 BTC shown in an order book snapshot is static depth — the total volume displayed on the order book at that moment. However, under the cancellation priority mechanism, market makers can, with high probability, withdraw their quotes within the same block before a large market order executes. Therefore, when a 100 BTC market buy order actually executes, the effective depth available for filling may be significantly lower than the 140 BTC statically displayed. The upper bound of effective depth equals static depth (no market maker cancels), while the lower bound equals the residual depth after all market makers simultaneously exercise cancellation priority — and this residual depth may include only passive liquidity, such as the HLP Vault, that cannot respond with a cancellation within the same block. This distinction cross-corroborates the depth illusion phenomenon analyzed in Section 9.2.3 and the analysis of apparent order-book liquidity in Section 8.2.

The second dimension is the HLP Vault's subsidizing effect on the spread. In his classic model of informed trading, Kyle (1985) distinguished apparent liquidity from equilibrium liquidity ^[24]. As a liquidity pool that aims at sharing market-making returns (rather than pure profit maximization), the HLP Vault may systematically make markets at spreads below the equilibrium level, and its narrow spreads may partly reflect an implicit subsidy rather than a pure efficiency gain. Comparing spreads across periods with high and low vault contributions would help separate the subsidy effect from the mechanism-efficiency effect, but public data for such period-by-period comparisons are currently lacking.

The growth metrics above must also be interpreted within the macro environment. The years 2024–2025 fell within the bull-market cycle following the approval of the BTC exchange-traded fund (ETF), during which the TVL and trading volume of almost all crypto infrastructure grew substantially. To separate Hyperliquid's platform-specific excess growth from systemic bull-market beta, its growth rate over the same period should be compared with on-chain competitors such as dYdX and GMX. Preliminary data show that Hyperliquid's growth rate is significantly higher than that of comparable platforms, but the contribution of HYPE token incentives within it remains difficult to fully isolate.

The HLP Vault's operating data provide a basis for testing the theory of democratized liquidity. The vault's AUM peaked at about $510 million (mid-2025) and currently stands at about $270 million (DefiLlama, mid-2026), with cumulative net profit of about $121.8 million (roughly 50% of the total return over the period, using the vault's average AUM over the period as the denominator; as of October 2025, on the DefiLlama HLP dashboard basis, consistent with Chapter 21); according to independent estimates from OAK Research, OnchainTimes, and others, its annualized return was about 11%–12% (2025), its full-period CAGR about 42%, and its trailing-12-month return about 22%, with returns that are highly event-driven and volatile rather than a stable annualized level of 65%–70% ^[22]. This annualized return, however, lacks a decomposition, and its composition may include several sources: market-making spread income, HYPE token incentives, directional beta exposure (in a bull market, market makers typically hold a net long position), and profits from absorbing liquidations. Citing the 65%–70% annualized figure without decomposing the sources of return can easily give readers the mistaken impression of 65%–70% from pure market making, when in reality a considerable proportion of the return may come from token incentives and directional exposure — sources that are not sustainable across cycles. After the JELLY incident, the vault's AUM drew down by about 15% around the event (the vault stood at about $230 million when JELLY occurred, consistent with the figure in Section 9.4.3, and drew down to about $195 million; the roughly $500 million was the historical peak in mid-2025, not the level at the time of JELLY), and then gradually recovered after the protocol repaired its liquidation-absorption rules. This data point validates both the flywheel's positive transmission and its fragility under extreme events. At the validator level, Hyperliquid currently runs about 16–24 active validators (roughly 21 as of early 2026), among which the nodes controlled by the Hyper Foundation hold a majority of the staked share ^[3]. Single-block finality (the time required for a transaction to become irreversible) is about 70 ms, distinct from the block time of about 200 ms; the median end-to-end order-confirmation latency is about 200 ms, with a 99th-percentile latency of about 900 ms (for a colocated client). Overall, these data support this chapter's theoretical analysis, but their limitations should be noted: the market data are snapshots at specific points in time, they cannot fully separate the contribution of mechanism effects from that of token-incentive effects to liquidity growth, and, as a rapidly evolving system, Hyperliquid's market metrics may change significantly over the short term.

9.6 Chapter summary

Taking Hyperliquid as a case study, this chapter applied the order-semantics analytical framework established in Chapter 7 and the order-book microstructure theory revealed in Chapter 8 to a specific application-chain exchange, systematically analyzing how the two mechanism innovations of semantic ordering and cancellation priority form a self-consistent microstructure system on top of the discrete-time property inherent to on-chain matching. Semantic ordering classifies the economic meaning of transactions into four tiers (System, High, Standard, and Low) at the consensus-protocol level, placing the priority of liquidity-protecting actions above that of liquidity-consuming actions, while assigning liquidation orders and system-maintenance transactions to separate priority tiers. Section 9.1.7 further analyzed the interactions of semantic ordering with the margin system, funding rate settlement, and the liquidation engine, revealing how the ordering mechanism is embedded in the broader contract-settlement system. Cancellation priority concretizes the classification rules into a protocol-level right of last look for market makers; the discrete-time property inherent to on-chain matching compresses the precision of the speed race from the nanosecond to the hundred-millisecond scale, creating the time window necessary for implementing semantic ordering and cancellation priority — a window that Hyperliquid did not invent but that is an inherent structural feature of any on-chain matching system; Hyperliquid's innovation lies in recognizing and exploiting this feature to build differentiated ordering rules. Placing Hyperliquid's semantic ordering within the broader spectrum of MEV mitigation approaches — comparing it with alternatives such as Flashbots' private mempool, the threshold-encrypted mempool, intent solving, and dYdX v4's distributed ordering rights — shows that, among the approaches surveyed in this chapter, semantic ordering is a rare one that makes an explicit value judgment at the protocol level, at the cost of a strong dependence on an application-specific chain.

The core effect of this microstructure system is to systematically reduce the adverse selection risk and infrastructure investment costs faced by market makers. Empirical data provide preliminary validation: some snapshots show that the top-of-book bid-ask spread on Hyperliquid's BTC perpetual futures can be narrower than Binance's (the commonly cited figures of about $1 versus about $5.5 and static depth of about 140 BTC versus about 80 BTC are difficult to trace to an independent primary source, and Binance's effective depth is typically better at large trade sizes, so these should be read cautiously and confined to the top of the book), while the roughly 70% share of the on-chain perpetual futures market is a more firmly established figure. The interpretive qualifications — the gap between static and effective depth, the HLP Vault's subsidizing effect on the spread, and the macro bull-market cycle — are all detailed in Section 9.5.4. With a peak AUM of about $500 million, the HLP Vault has validated the feasibility of democratized liquidity supply, but its commonly cited 65%–70% annualized return is in fact a figure that includes token incentives and directional exposure; independent estimates put it at about 11%–12%, with returns that are highly event-driven and volatile, and whose sustainability remains to be verified.

At the level of liquidity, cancellation priority exhibits a liquidity paradox: in normal times it lowers market-making costs and improves liquidity supply, but the same mechanism may accelerate liquidity evaporation during periods of market stress, and the procyclical effect of market makers exercising their cancellation right with zero friction merits the attention of market designers. The in-depth analysis of the JELLY incident revealed, along the three dimensions of attack mechanism, risk transmission, and legal governance, systemic fragilities lying beyond microstructural protection: the breach of the liquidation waterfall, the HLP Vault's forced absorption, and the validators' forced settlement at a non-market price — all of which occurred beyond the boundary of the ordering layer's protection. The limited size and rapid governance capacity of the validator set appear as advantages in crisis response but also give rise to tensions among concentrated operational risk, moral hazard, and the narrative that rules are hardcoded at the consensus layer. The positive feedback loop of the liquidity flywheel possesses a symmetry between self-reinforcement and self-unraveling, and its sustainability depends not only on the design quality of the microstructure mechanisms but also on the robustness of supporting systems such as liquidation rules, the margin system, and vault governance. As an adjustable hyperparameter, block time directly defines the trade-off surface between market-maker protection and price discovery efficiency, but the quantitative calibration of the U-shaped curve requires estimation of parameters specific to the crypto perpetual futures market.

As Budish et al. (2015) ^[14] noted, the core of market design is not to have participants reach an equilibrium under given rules but to design rules that produce a better equilibrium. Hyperliquid's experiment shows that blockchains offer the possibility of encoding market rules in a consensus protocol in a way that is transparent, verifiable, and difficult to tamper with unilaterally; and its explorations in microstructural protection, the democratization of liquidity supply, and the construction of an ecosystem flywheel, together with the boundary conditions and failure modes those explorations exposed, will provide the necessary theoretical foundation for later chapters' analysis of the concrete operating mechanisms of the HLP Vault.

References

[1] Aquilina, M., Budish, E., & O'Neill, P. (2022). Quantifying the high-frequency trading "arms race". The Quarterly Journal of Economics, 137(1), 493–564. https://doi.org/10.1093/qje/qjab032

[2] Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., & Juels, A. (2020). Flash Boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability. 2020 IEEE Symposium on Security and Privacy (SP), 910–927. https://doi.org/10.1109/SP40000.2020.00040

[3] Hyperliquid. (n.d.). Hyperliquid docs. Retrieved February 28, 2026, from https://hyperliquid.gitbook.io/hyperliquid-docs

[4] Hyperliquid. (2024, January 6). Latency and transaction ordering on Hyperliquid. Medium. https://hyperliquid.medium.com/latency-and-transaction-ordering-on-hyperliquid-cf28df3648eb

[5] Glosten, L. R., & Milgrom, P. R. (1985). Bid, ask and transaction prices in a specialist market with heterogeneously informed traders. Journal of Financial Economics, 14(1), 71–100. https://doi.org/10.1016/0304-405X(85)90044-3

[6] Harris, L. (2003). Trading and exchanges: Market microstructure for practitioners. Oxford University Press.

[7] Grossman, S. J., & Stiglitz, J. E. (1980). On the impossibility of informationally efficient markets. The American Economic Review, 70(3), 393–408.

[8] Flashbots. (n.d.). Flashbots Protect documentation. Retrieved March 15, 2026, from https://docs.flashbots.net/flashbots-protect/overview

[9] CoW Protocol. (n.d.). CoW Protocol documentation. Retrieved March 15, 2026, from https://docs.cow.fi

[10] Lewis, M. (2014). Flash Boys: A Wall Street revolt. W. W. Norton & Company.

[11] Foucault, T., Kadan, O., & Kandel, E. (2005). Limit order book as a market for liquidity. The Review of Financial Studies, 18(4), 1171–1217. https://doi.org/10.1093/rfs/hhi029

[12] Kahneman, D., & Tversky, A. (1979). Prospect theory: An analysis of decision under risk. Econometrica, 47(2), 263–292. https://doi.org/10.2307/1914185

[13] Almgren, R., & Chriss, N. (2001). Optimal execution of portfolio transactions. Journal of Risk, 3(2), 5–39. https://doi.org/10.21314/JOR.2001.041

[14] Budish, E., Cramton, P., & Shim, J. (2015). The high-frequency trading arms race: Frequent batch auctions as a market design response. The Quarterly Journal of Economics, 130(4), 1547–1621. https://doi.org/10.1093/qje/qjv027

[15] Kirilenko, A. A., Kyle, A. S., Samadi, M., & Tuzun, T. (2017). The Flash Crash: High-frequency trading in an electronic market. The Journal of Finance, 72(3), 967–998. https://doi.org/10.1111/jofi.12498

[16] Arkham Intelligence. (2025). JELLYJELLY exploit on Hyperliquid: On-chain attribution. Arkham Research. https://intel.arkm.com

[17] Halborn. (2025). Explained: The Hyperliquid JELLY incident (March 2025). Halborn Blog. https://www.halborn.com/blog

[18] Diamond, D. W., & Dybvig, P. H. (1983). Bank runs, deposit insurance, and liquidity. Journal of Political Economy, 91(3), 401–419. https://doi.org/10.1086/261155

[19] Barber, B. M., & Odean, T. (2000). Trading is hazardous to your wealth: The common stock investment performance of individual investors. The Journal of Finance, 55(2), 773–806. https://doi.org/10.1111/0022-1082.00226

[20] SEC v. W. J. Howey Co., 328 U.S. 293 (1946).

[21] DeLong, J. B., Shleifer, A., Summers, L. H., & Waldmann, R. J. (1990). Noise trader risk in financial markets. Journal of Political Economy, 98(4), 703–738. https://doi.org/10.1086/261703

[22] DefiLlama. (n.d.). Hyperliquid L1 statistics. Retrieved March 15, 2026, from https://defillama.com/chain/hyperliquid-l1

[23] CoinGecko. (n.d.). Hyperliquid futures statistics. Retrieved March 15, 2026, from https://www.coingecko.com/en/exchanges/hyperliquid

[24] Kyle, A. S. (1985). Continuous auctions and insider trading. Econometrica, 53(6), 1315–1335. https://doi.org/10.2307/1913210

[25] Sun, X. (2022). Short note on {Monarch, Moloch, Mafia} extractable value. HackMD. https://hackmd.io/@sxysun/short-note-ext