Execution and settlement
The architecture separates order acceptance from final settlement, with explicit requirements for enforceability and owner recovery.
The working architecture#
- Confidential state
- Matching, risk checks and the private account ledger run inside the proposed execution boundary.
- Onchain authority
- Contracts enforce custody, authorized state transitions and withdrawal ownership.
- Recovery
- The owner needs available account data and an enforceable exit if execution services fail.
The working recommendation is an attested confidential executor with onchain custody and settlement. HyperEVM is a settlement candidate, subject to qualifying the complete attestation, enforcement and owner-recovery design.
No proof generation before each fill#
The intended order path verifies signatures, nonces, fresh prices, margin and market capacity, then commits a durable execution sequence. It doesn't require client-side proof generation, a bridge transfer or an external hedge round trip before accepting the trade.
The planning target is a regional click-to-accepted-fill p95 below 250 ms for prefunded accounts. This is a target, not a deployed performance claim. Final chain settlement is measured separately.
What makes a fill enforceable#
An execution receipt isn't final chain settlement. Contracts must enforce the approved signing policy, conservation, sequencing, replay protection and withdrawal ownership. Recovery data must remain available to the owner; publishing a state root alone doesn't solve recovery.
Attestation identifies approved software running in supported hardware. It doesn't prove that the software is bug-free. Hardware, key management, operator policy and upgrades are disclosed trust assumptions.
Infrastructure roles#
Hyperliquid can provide market references and optional aggregate hedging. It isn't assumed to hold the customer's private position. Phala/dstack is a confidential-runtime candidate, not a confirmed integration.
The documented NEAR Intents Hyperliquid route credits HyperCore perps, not a HyperEVM ERC-20 escrow. A route into SubLiquid custody therefore requires separate validation. Read the routing documentation.