Custody

Hypervolic is non-custodial. Participants' USDC is held by a settlement contract on Base, not by the exchange. The exchange matches orders; the contract holds the money and pays it out, and it checks every trade itself before it moves a cent.

What the contract checks

The exchange matches orders off chain and commits each fill to the contract. The contract then executes the fills in order and, for each one, checks:

each order's signature, by its maker or a key the maker registered;
the maker's nonce floor and the order's expiry;
that the quantity is within what was signed;
that the price is the resting order's limit;
that the fees are the instrument's and within both orders' caps;
that every book the fill touches is still fully secured, and no balance goes negative.

A fill that fails any of these does not execute, whatever the exchange said.

Deposits

Approve USDC to the contract and call deposit(amount), or use depositWithPermit to do both in one transaction. The exchange credits the deposit once its block reaches the chain's safe tag. Your first deposit opens your account. See Funding.

Withdrawals

A withdrawal is debited by the exchange first and paid by the contract after:

You sign a withdrawal request and send it to the gateway. The exchange debits your free cash at once.
The exchange signs a withdrawal for that amount, payable only to your own address, valid for a week, and only once the contract has executed every fill of yours before the debit.
You submit it to the contract with withdraw.

Only your account's own key can request a withdrawal. A signing key you registered for trading never can.

If the exchange stops answering

You do not need the exchange's cooperation to get your money out.

Forced withdrawal. Call requestForcedWithdrawal(amount) on the contract. The exchange must answer: it cancels your resting orders, debits up to that amount of free cash and pays it.
Freeze. If the request is still unpaid after the contract's FORCE_WINDOW, anyone may call freeze(you). Only your account freezes; everyone else keeps trading.
Escape. Once the contract has executed your fills up to the freeze, plus FREEZE_GRACE, or after a further FORCE_WINDOW in any case, call escapeWithdraw() and the contract pays your cash. Your open positions stay claimable at expiry.

The exchange can also freeze the whole contract. Everyone can then withdraw and claim at expiry, and nothing more trades.

Every timing parameter is a public constant of the contract: FORCE_WINDOW, FREEZE_GRACE, USER_ACTION_DELAY, ORACLE_TIMEOUT, ANCHOR_BEHIND and ANCHOR_AHEAD. Read them from the contract.

Signing keys and nonce floors

setSigningKey(key, expiry) registers a key that may sign your orders and cancels and open your sessions, until expiry (unix seconds; 0 revokes).
cancelUpTo(nonce) raises your nonce floor, so no order signed under a lower nonce can ever execute.

Lengthening a key takes effect at once. Shortening or revoking a key, and raising the floor, bind on the contract after USER_ACTION_DELAY, but the exchange cancels the orders they affect as soon as it reads them from the chain.

What you still trust

Beyond the contract's code:

the exchange's oracle key, which signs each expiry's settlement price;
the contract's administrator, who can rotate the exchange's keys, pause, and freeze the contract;
Circle, USDC's issuer, which can freeze an address or change the asset;
Base and its sequencer, to include your transactions.

The exchange staying up is not on the list.