Everything, in order.

How a price is made

HALCYON never prices from its own reserves. Every fill starts at HyperCore's HYPE/USDC mid. The mid is shifted against the pool's inventory (if the pool holds too much HYPE it sells HYPE a little cheaper), then widened by a half-spread: a base, plus one times the one-second volatility, plus the size of your trade against HyperCore's depth within 10 bps.

The spread model's bounds are constants in the contract: no proposal, desk or guardian can quote tighter than 0.5 bps or wider than 100 bps, or shift the mid by more than 50 bps.

Because the price does not depend on the pool's reserves, the trade before yours cannot move it. There is nothing to sandwich.

PERCH: a signed price, bounded on chain

Until Elysium's HyperCore hooks ship, no contract on Elysium can read HyperCore. HALCYON's keeper reads HyperCore's book, names the HyperCore block it came from, and signs an EIP-712 packet: mid, vol, depth, block, and the last Elysium block it may be used in.

Your swap carries the packet in. The contract accepts it only if it is signed by a listed signer, lives no more than 20 Elysium blocks (about three seconds), never goes back in HyperCore height, moves no more than 0.5% from the last accepted price, and drifts no more than 3% from the minute's anchor. A stolen signing key can stop quotes; it cannot move them far.

The trader pays the gas to carry the price in, so the price feed costs the house nothing.

DIVE: HyperCore inside Elysium

Kinetiq's upgrade adds a precompile that reads HyperCore's book from inside the EVM, and ElysiumCoreWriter, which lets a contract trade on HyperCore through a trade-only agent. HALCYON's DIVE adapters (PrecompileSource and CoreWriterHedge) are written against the documented behaviour; when the ABIs are published they are pointed at them and tested on a fork of the real chain.

In DIVE the pool hedges its inventory on HyperCore's HYPE perp in bands, so depositors stop carrying HYPE's swings. Money held on HyperCore sits in CoreCustody, a HyperEVM contract that can only trade, move margin within its own account, and send funds home to the Elysium pool.

Who gets paid

The spread is the only charge. Of each fill's spread, 20% goes to the protocol treasury and on to the house that runs HALCYON, from the house pool and from every desk; the rest stays with the pool's depositors (or a desk's owner). A $HALCY staker gets up to half of the protocol's 20% back inside their own price.

Deposits pay a 2 bp entry haircut that stays with the existing depositors, so a deposit timed against a stale price cannot take from them. There are no management, performance or withdrawal fees.

Keepers: fill calm orders, earn the tip

A calm order is an EIP-712 order a maker signs once: a price band on HyperCore's mid, an amount, how many slices and how far apart, and a tip of at most 0.3%. Anyone may call CalmOrders.fill with the order, the signature and a fresh signed price. The contract checks everything again and pays the caller the tip, out of the order's input.

The keeper's HTTP API lists open orders by maker; any bot can read the same events and fill them. Gas on Elysium is about 0.1 gwei, so a fill costs a fraction of a cent and the tip pays for it.

Risks, plainly

The contracts are new and unaudited. Caps are small on purpose and rise only through the timelock.

In PERCH, a pool share holds real HYPE exposure: roughly half HYPE, half USDC. If HYPE falls, so does the share.

The keeper is a single point of liveness: if it stops signing, swaps stop. They never fill at an old price.

Leaving Elysium for HyperEVM through the canonical bridge takes about 5.6 days (the rollup's challenge period). Arriving takes about a minute.

Informed traders can still pick off a stale quote inside its few seconds of life; the spread and the vol term are there to price that, and markout shows whether they do.

Contracts

Not on Elysium yet. The contracts are in the repository with their tests: the pool, the signed price source, the spread model, the registry with its PERCH/DIVE switch, the factory and desks, the router, calm orders, the treasury, $HALCY staking and pass, both vetoes, and the DIVE adapters with CoreCustody for HyperEVM.