HIP-4 deployers settle their own markets — and validators can slash the stake for markets settled wrong, settled late, or defined ambiguously. Kleros turns settlement from a personal liability into a public, defensible, automated process: an open bonded oracle with a jury of last resort, and an on-chain record proving you followed it.
Hyperliquid's spec makes the deployer the settlement authority — and makes the stake slashable by validator vote on three grounds:
| Slashing ground | The exposure |
|---|---|
| Settled incorrectly | Your private judgment call is the final answer. A contested edge case becomes validators re-litigating your market — with your stake on the table. |
| Unsettled > 1 week | Settlement ops is a standing obligation. Hyperliquid's own testnet accumulated markets left unsettled for six weeks — the failure mode is real, and it's slashable. |
| Poorly defined | Ambiguity discovered at settlement time is too late. Someone must absorb the judgment — today, that someone is you. |
Traders carry the mirror risk: there is no dispute mechanism anywhere in HIP-4. Whoever holds the deployer key decides who gets paid — "trust me" with a bond.
HyperCore can't read other chains, so no bridge is possible — instead, the deployer pre-commits to an external truth process and automates following it:
officialSource keyword. The commitment travels in the market's on-chain description itself — nothing extra to look up. From this moment, your settlement discretion is publicly forfeited. (For templates with no free keyword, an Outcome Oracle Registry on HyperEVM carries the same binding externally.)If validators ever question a settlement, your defense is a URL: the question, the bonds, the challenges, the ruling, and the settlement that matches — timestamped and immutable.
Outcome #11646 — US Midterms 2026 Senate Control: Democrats v Republicans — deployed from Hyperliquid's own sportsContestWinner template, with the resolution source written into the market's description. The answer was contested on purpose, from two different addresses, so the dispute mechanics are visible. Every step is independently verifiable:
| Claim | Proof |
|---|---|
| Market deployed permissionlessly | deploy tx on HyperCore |
| Resolution source named in the market itself | same tx — officialSource: reality.eth:0x268339e0… |
| Question, arbitrator & timing immutable | question on reality.eth |
| Answer contested & resolved | same page — 0.001 Yes → 0.002 No → 0.004 Yes → finalized YES |
| Settlement matches the oracle | settle tx on HyperCore — settleFraction 1.0 |
Check the last step yourself — no trust in us required:
curl -s -X POST https://api.hyperliquid-testnet.xyz/info \
-H 'Content-Type: application/json' \
-d '{"type":"settledOutcome","outcome":11646}'
Everything above is packaged as hip4kit — a reference CLI a deployer runs end to end. It encodes the sharp edges of the HIP-4 deployer API (canonical action serialization, agent-vs-master signing rules, oracle question timing, the settlement latency budget), so your integration takes an afternoon, not a debugging week:
hip4kit activate # one-time deployer registration hip4kit ask-question ... # the question, Kleros arbitrator attached hip4kit deploy ... # market from any template, bound to that question hip4kit watch # relayer: monitor, settle the moment it finalizes
Your master key signs exactly once (activation). Everything operational runs on a restricted, revocable agent key. The toolkit is open — or integrate the pattern directly into your own stack; nothing about it is proprietary. Write to us for the repo and a guided setup.
The template catalog now reaches well past price thresholds — sports contests, rate decisions, and more arriving as Hyperliquid iterates. Those templates settle against an officialSource named in prose, with a fallback to "independent reputable reporting." That is precisely where contested settlements will land, and precisely where a bonded oracle with a jury of last resort belongs.
Because officialSource is free text, the binding above already works — no protocol change, today. What's missing is a type. A typed resolution-source keyword would let the exchange validate the reference at deploy time and let the interface show traders the question, its arbitrator and its live answer, instead of leaving the commitment buried in a description nothing renders. We've put that proposal into Hyperliquid's feedback process. Deployers who adopt the pattern now inherit the visibility the moment it ships.