Counterparty and venue risk

A Tuo position depends on parties outside the vault: the Hyperliquid venue, Circle's bridge, the Tuo-operated account that holds hedge margin, the swap aggregators, and the issuer of USDC. This page is candid about each.

The hedge margin leaves on-chain custody

Hyperliquid credits deposits to the sending address, and a smart contract cannot sign Hyperliquid orders. So the vault cannot hold the hedge itself. Instead, when the keeper moves margin to the hedge, the vault transfers USDC to a Tuo-controlled operator address, one per position, whose signing key is held in a cloud HSM. That address bridges the USDC to Hyperliquid, opens the short, and later returns what is left.

• Up to 50% of basis (Basis Plus Core) or 90% of basis (Delta Hedge Standalone) can be at that address at once. The cap is enforced by the vault; the amount inside the cap is chosen by the engine.
• While it is there, the margin is outside the vault's custody guarantees. The vault knows how much left and to which address, and only that address can return it. It cannot force the return.
• On an emergency exit, outstanding margin becomes a claim ticket the keeper settles by pulling from the operator address straight to your wallet. If the keeper never settles it, the claim is a ledger entry, not an escrow. The vault cannot enforce it.
• The set of allowed operator addresses is a treasury-managed allowlist. Nothing on-chain stops two positions sharing one operator; one operator per position is Tuo's operating rule, not a contract rule.

This is the largest single trust assumption in Tuo, and it is stated the same way to the security reviewers. See Custody model.

One venue

Every short is on Hyperliquid. If the venue halts, delists a market, changes its margin rules, suffers an exploit or becomes insolvent, every Tuo hedge is affected at once. During a venue outage the engine cannot read the hedge and deliberately abstains from every hedge decision rather than acting on a guess; ranges keep running unhedged until the venue is readable again. Margin on the venue is subject to Hyperliquid's own rules and risks, which Tuo does not control.

The bridge

Margin travels to and from Hyperliquid over Circle's CCTP v2 (default) or Hyperliquid's own Bridge2 (fallback). Specific failure modes Tuo has designed around, and which remain risks:

• A transfer below the fee floor (5 USDC) is lost, not refunded. Tuo never sends below it.
• A CCTP transfer to a Hyperliquid account that has never sent anything can be dropped by Circle's forwarder with the USDC stuck at the forwarder. Tuo warms every operator account by hand before it serves a position and refuses to send to an un-warmed one.
• A return transfer sized below the bridge's fee reverts on the destination with the source already debited. Tuo bounds the return fee and sizes returns above it.
• Bridge fees come out of the transferred amount. A hedge returns what it is worth, not what was sent.

A bridge pause, a change in Circle's fee, or a bug in either bridge would delay the return of margin and therefore delay your withdrawal. The emergency exit still recovers everything on-chain.

USDC

Every position is accounted in USDC and settled in USDC. USDC is issued by Circle and can be frozen at the issuer's discretion. Two consequences:

• If USDC transfers to your wallet are blocked by the issuer, a withdrawal or emergency exit to that wallet reverts. The way out is to transfer the position NFT to a wallet that can receive USDC, which needs no permission from Tuo.
• If the vault's own USDC were frozen, every position would be stuck. Tuo has no mitigation for this beyond the choice of USDC itself.

Swap aggregators

Entry, exit and keeper swaps route through an allowlisted aggregator (0x or 1inch). The vault approves the exact amount for one call and checks the balance delta against a TWAP-derived floor, so a malicious aggregator cannot take more than the slippage bound on one swap. The allowlist is treasury-managed; a compromised treasury could narrow it to a venue it controls, but could not touch the guaranteed exit, which needs no swap.