Hypow: Proof of Trade

1. Introduction

Bitcoin backed money with energy. Every attempt at a block burns electricity, and whoever pays that cost earns the coin. The cost is real and verifiable, but the energy is spent for the sake of the proof.

Trade is the evolution of energy. Every cent traded on Hyperliquid is one attempt at a block, and every attempt carries a real cost, paid in the market: spread and fees for the taker, inventory and risk for the maker. That cost is spent for the sake of the trade: it buys a position the trader wanted, and pays for liquidity and price discovery along the way. The proof comes as a byproduct of economic activity that was going to happen anyway.

Hypow is fair-launch money backed by that activity. It lives on Hyperliquid, the most liquid onchain market in the world. Trading is work: it commits capital, attention, and risk. Every coin in existence stands for that work, done and paid for in the market. As Hyperliquid grows, so does the economic power needed to generate each coin.

2. Proof of Trade

A mining claim is a nonce satisfying

H(seal, trader, nonce) < target(D)

where seal is the hash of the drand public randomness beacon's signature for the round the attempts were committed to, trader is the trading address, nonce ranges over the attempts committed to that round, one per cent of notional volume, and D is the current difficulty. The participant searches off-chain and submits only a winning nonce. Each successful claim advances the chain and closes its round and every earlier one.

The name designates the binding constraint, not the filter. Compute is free; trade volume is the scarce resource. Each cent of perpetual notional volume grants one chance. No chance can be evaluated before it is committed: attempts are committed to a round that has not yet been published, so there is nothing to precompute. Identities confer nothing; the chances are the volume, however it is divided among addresses. The hash filter spreads expected wins across the active trader population. The entire emission record is publicly reconstructible from on-chain position changes, committed draws, the drand rounds that decided them, and the claimed nonces. Every coinbase reward is verifiable by inspection.

Mining costs the venue's spread, set by an adversarial market. A real trader pays this regardless and mines as a byproduct. A wash trader pays it twice per round trip with no other return. As real participation grows, the wash trader competes against an expanding majority that mines for free.

3. Architecture

3.1 Verification by observation

HyperEVM precompiles expose state (positions, balances, prices), not history. A contract cannot, given an address, retrieve the list of trades that address has made. It can read that address's current position on any given perpetual market, including every builder-deployed market, present or future.

This is sufficient. The contract reads the participant's position before and after a window of activity. The magnitude of that change since the previous observation is the credited volume. Growth is valued at the prevailing mark. A reduction is valued at the lower of the prevailing mark and the mark at the position's previous observation, so a close cannot be credited at a price reached after it. Frequent observation makes the credit track realised trading closely. That volume is what the hash filter samples. The cost of the change (spread, fees, and slippage for the taker; inventory and risk for the maker) is paid in an adversarial market regardless, and is what makes the chance scarce.

A position change is a position change. A discretionary trade, a liquidation, an automatic deleveraging, a passive fill of a resting order: all are observed equally, all mine. The protocol makes no judgment about how the change was produced; the participant paid for it either way.

Credited volume is banked as attempts, which never expire. Attempts are committed to a draw on a drand round a few seconds in the future, and become evaluable only once that round exists. drand is produced by an independent network of operators through threshold signatures, and every round is publicly verifiable, so no participant, validator, or block producer can predict or bias it. Because the round is unknown when attempts are committed, the timing of a commitment confers no advantage. Each draw is bound to exactly one round and is never redrawn.

A claim on a round closes that round and every earlier one; their unclaimed draws are void. Draws on later rounds carry on, so the next claim on a later round is the deadline for every earlier draw, and a winner must claim promptly. A change not yet observed is not lost: it is credited at the next observation. A change undone before then is never seen, which is why the miner observes after every fill.

The participant trades natively on Hyperliquid through any interface they would use anyway. Their funds never leave their own account. The protocol holds nothing.

3.2 Difficulty

Difficulty D retargets every 2,016 blocks to maintain a target interval of one block per minute, measured in HyperEVM block time. It scales by the ratio of the expected time to the time the window actually took, by at most a factor of four either way, as in Bitcoin. As participation grows, D rises. As it falls, D falls. The supply curve is independent of the level of activity; only the probability of winning per nonce moves.

The target interval is short by design. It does not change a participant's expected share of emission, only how finely that share is divided: a short interval lets an occasional trader realise a win rather than hold a small chance at a large one. It is bounded below by the latency between observation and claim, since a draw is void once a later round is claimed; the interval is set well above it.

A sudden collapse in participation would otherwise stall the chain: a window sized for the old activity could take months to fill. So a window that has already run four times its target duration, about 5.6 days, retargets at its next block instead of waiting for block 2,016, dividing D by four and starting a new window. The delay is long enough that no one can trigger it cheaply to game difficulty down.

4. The Miner

The trading address acts once: it authorises a miner, by a single transaction or a single signature that anyone may submit. A miner is a local key, typically holding only gas, that observes the trader's positions, records each change on-chain promptly, commits the trader's attempts to draws, evaluates them off-chain, and submits the winning claims. The trader authorises exactly one such key and may revoke it at any time. The reward mints to the trading address whoever submits, so the miner advances state and pays gas but can neither redirect a reward, register volume the trader did not trade, nor choose its round.

Observation is the trader's own. A capture values the change at the mark it reads, so the moment of a capture is worth something, and a stranger who chose it could only choose a bad one. Only the trader or their authorised key may capture the trader; a trader who has joined a pool is captured only by that pool. Committing attempts is likewise the trader's decision, made by the trader or their authorised key. Claiming is open to anyone, and the reward mints to the trader whoever submits.

The only advantage one miner holds over another is the latency between observation and claim. The target interval is set so that this advantage is small.

5. Supply

Hypow is a fair launch. Every coin in existence is mined, under the same rules for every participant from the first block; none is premined, allocated, or sold. Hypow has a fixed cap of 21,000,000,000 coins. Emission follows a single continuous exponential decay over the global block count, with no halvings, no cliffs, and no discretionary parameters.

5.1 The emission curve

Let n be the global block counter, incremented by one on each successful claim. The reward paid for block n is

R(n) = R₀ · e^−λn

with R₀ = 12,721.6 and λ = 6.058 × 10⁻⁷ . The two constants are linked by the cap: R₀ ÷ λ ≈ 20.9997B , just under S_max = 21B, so total emission stays below the fixed supply. The cumulative emission after block n is approximately S(n) = (R₀ ÷ λ)(1 − e^−λn) , monotonically approaching that limit without ever reaching it.

Emission is indexed by block count, not wall clock. Difficulty pins the expected inter-block interval to a target rate, which gives the curve a calendar interpretation: at the steady-state rate of one block per minute, the half-life of the reward is a little over two years.

5.2 Immutability

The token and minter contracts have no admin, no governance, no upgrade authority, and no allowlists. Supply cap, name, symbol, emission curve, the single authorized minter, the difficulty rule, and the rule that every perpetual market mines, present or future, are fixed at deployment and irrevocable. No one, including its authors, can change the terms of the launch.

References & Links

1. Hyperliquid documentation: hyperliquid.gitbook.io/hyperliquid-docs
2. HyperEVM precompiles: see L1Read.sol in the protocol repository.
3. drand: a distributed randomness beacon operated by the League of Entropy.
4. Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System.