Withdrawals
How to withdraw a Tuo position in two wallet calls, what happens in between, and the emergency exit that no one can block.
Withdrawal is two calls from the NFT owner's wallet. Tuo has no approval step and no veto. The vault gates the exit only on what it can measure: no hedge margin outstanding, and enough idle USDC to pay the share you asked for.
Call 1: request
requestWithdraw(nftId, sharesBps) with the share in basis points, from 1 (0.01%) to 10,000
(100%). From that moment:
- No new margin can be sent to Hyperliquid for the position.
- Top-ups are blocked.
- Tuo's exit chain starts. It authors an exit plan for the position within a minute and the keeper walks through it: burn every range, sell every priced balance back to USDC, then close the short and bring the margin home.
- The 24-hour emergency clock starts.
Requesting again with a new share replaces the request and restarts the emergency clock. Requesting 0% cancels it.
Every share unwinds the whole position. A 10% request burns every range and closes the short exactly as a full exit does, because the hedge covers the ranges and closing part of either would leave the rest unhedged. After the payout, the remainder is idle USDC that the keeper redeploys. A partial withdrawal therefore costs the same swap spread as a full one.
Between the calls
The keeper's unwind order is fixed: ranges first, hedge last. The hedge covers the ranges, so closing it earlier would leave them exposed. When the short has closed, the margin comes back over the bridge and the vault credits the amount that actually arrived. The keeper's final return clears the position's outstanding margin, which is what makes the settlement value available again.
Under normal conditions the unwind completes within hours. It waits on the bridge's attestation, on the pool price staying within the vault's deviation gate, and on the keeper's action budget. The position page shows the withdrawal as ready when the vault's preview confirms the idle USDC covers your share.
Call 2: withdraw
withdraw(nftId, withdrawalToken, minTokenOut, swapData). The vault:
- Checks that you own the NFT and a request exists.
- Computes the settlement value. If any margin is still outstanding, this reverts and the call fails cleanly; nothing moves.
- Computes the fee: 30% of the profit share being withdrawn, zero if there is no profit. See Performance fee.
- Checks that the position's idle USDC covers the gross amount.
- Reduces the basis pro rata so a later withdrawal is measured against the right high-water mark.
- On a full exit, deactivates the position and burns the NFT before any payout.
- Pays you in USDC, or swaps to any allowlisted deposit token through an allowlisted aggregator. For the swap, the vault imposes its own floor at the pool's average price less 0.5%, on top of the minimum you pass.
A partial withdrawal leaves the position active with the remaining share. The keeper redeploys it on the next engine cycle.
The emergency exit
emergencyWithdraw(nftId) is the door that always opens. Its properties:
| Property | Detail |
|---|---|
| Who can block it | No one. The pause affects deposits only, and no Tuo role can reach a deployed range |
| When | Immediately if the position never sent margin to Hyperliquid. Otherwise 24 hours after a withdrawal request, so the keeper has a window to bring the margin home the normal way |
| What it does | Closes every open range with no price floor and no deviation gate, so it works under any market condition, and pays every balance to you in kind: USDC, WETH, WBTC, whatever the position holds |
| Fee | 30% of the profit on the on-chain leg, withheld in kind from each token. If the pool price cannot be read, the fee is forgone rather than blocking the exit |
| Outstanding margin | Becomes a claim ticket on the position. The NFT is not burned. When the margin returns, the keeper settles the claim and the vault pays it directly to the NFT owner, never to the keeper. The NFT burns when the claim is zero |
The emergency exit closes ranges with no price protection. That is the price of a door that opens in any market: a bad price could not block it, so a bad price cannot be prevented either. It is exposed to sandwiching by design. The protected path is the two-call withdrawal above. Use the emergency exit when the normal path has failed, not as a shortcut.
The claim ticket for outstanding margin is a ledger entry, not an escrow. If the keeper never settles it, the claim is not enforceable on-chain. This limitation is disclosed in the auditor note; see Custody model.
Transferring instead of withdrawing
The position NFT is a plain ERC-721. You can transfer it, and the new holder becomes the sole withdrawal authority. There is no recipient gate. A pending withdrawal request travels with the position. This is also the escape for an owner whose address can no longer receive USDC: transfer the NFT to an address that can.
For integrators
- Cancellation is
WithdrawalRequested(nftId, 0); there is no separate cancel event. - There is no readiness flag. Derive "serviceable" from
previewWithdraw(nftId)againstidleBalance(nftId, USDC). HlBridgeInboundCompletedcarries the final-return flag. A projection that ignores it disagrees with the chain for the rest of the position's life.- See Events and integration.