A perpetual, on-chain options venue on Hyperliquid — puts and covered calls priced by an autonomous on-chain mark, backed by real spot cover, no liquidation engine. Paper to live testnet in days; 346 tests + a 128,000-call solvency fuzz behind it.

HYPE is one of the most-traded assets on Hyperliquid, and its perp traders carry large, one-directional exposure straight through violent drawdowns — I measured $331M of large HYPE longs held unhedged through the June 2026 −29.5% crash, the same coin quantity, eating the full mark loss. HYPE options barely existed, and the ones that now do (Deribit, June 2026) are dated — you pick an expiry and roll it forever. A perp position is open-ended; a dated hedge is a mismatch. The instrument that actually fits is an everlasting option: no expiry, funding-settled, held like a perp. It didn't exist for HYPE. I built it.

  trader ──buy put / covered call──►  ┌──────────────────────────┐
                                      │      EverlastingBook      │
   autonomous mark = fairMark()  ◄────┤  puts (USDC escrow) +     │
   Σ 2^-(i+1)·BS(K, 2^i·τ, σ)         │  uncapped covered calls   │
   permissionless accrue()            └────────────┬─────────────┘
                                                   │  ICoverVault
                          ┌────────────────────────┴────────────────────┐
                          ▼                                              ▼
                 ┌──────────────────┐                        ┌────────────────────┐
                 │  HyperEVM reads   │  oraclePx precompile   │  HyperCore writes   │
                 │  (HYPE price)     │                        │  spot-HYPE cover    │
                 └──────────────────┘        CoreWriter ─────►│  (buy/sell at bbo)  │
                                                              └────────────────────┘

• Peer-to-pool everlasting options: one LP pool is the counterparty; traders buy puts (crash insurance) and uncapped covered calls. The pool holds real spot HYPE as cover, so a short uncapped call is fully backed — no liquidation engine anywhere.
• Autonomous on-chain mark: price is a pure formula (a White–SBF geometric basket of Black–Scholes prices) recomputed by a permissionless accrue() — no keeper posts prices, no owner knobs. Anyone can verify it; nobody can move it.
• Hyperliquid-native, end to end: reads HL's oracle via HyperEVM precompiles, buys/sells the spot cover on HyperCore via CoreWriter, priced off the live book — one of the first products to compose precompile reads + CoreWriter actions trustlessly.
• Solvency by construction: a single conservation invariant holds on every path — poolUsdc == poolFree + putEscrow + totalCollateral.

Not a mockup. Every value below is what happened on-chain (Hyperliquid testnet 998): market-driven cover crossing a live book, the autonomous mark computing itself, and the solvency invariant re-checked at each step. Step through it, or press play.

Both cover legs crossed the dislocated testnet book live; the run also surfaced and fixed a real bug — HyperCore silently drops prices over 5 significant figures.

Autonomous mark — a pure formula, no keeper authority

function _computedMark(Side s) internal view returns (uint) {
    uint m = _fairMark(s);                          // Σ 2^-(i+1)·BS(K, 2^i·τ, σ)
    if (m < intrinsic(s))      m = intrinsic(s);    // floor at intrinsic
    if (s == Side.PUT && m > Wput) m = Wput;         // put capped at max payout
    return m;                                        // no owner/keeper input anywhere
}
// accrue() is permissionless — anyone folds funding from the stored mark, then refreshes

Fully collateralized by construction — the cover gate

// an uncapped covered call can only be opened if the pool already holds the cover
require(vault.coverHype() >= netWritten, "coverGate");
// winning close funds the payout by selling cover CEIL-to-tick, so proceeds >= owed,
// and a fail-closed require(poolFree >= g) means a bad fill can never create bad debt

The mark carries no trusted scalar — the single biggest adoption blocker for a quant counterparty, designed out. Every fund-moving path was traced by hand and then fuzzed: 128,000 both-sided calls, zero reverts, with the conservation invariant non-vacuous throughout.

The contract is ~20% of the work; whether anyone routes size is the other 80%. So I measured it, live, off Hyperliquid's public API rather than guessing:

• Demand: $389M in large HYPE longs, ~$134M of it on accounts that could fund a realistic hedge premium from idle margin today — borne unhedged through a −29.5% crash.
• Supply: $104M of delta-neutral basis capital (survivable writers) + $674M of spot HYPE that earns no option yield anywhere else — the captive covered-call base — with HLP ($219M) as house precedent.

Mid-build, Deribit listed HYPE options. Rather than defend a dead "only venue" thesis, I re-scoped in the same session: Deribit validates the demand (the largest options exchange doesn't list an asset it hasn't sized), and its dated, custodial, off-Hyperliquid product leaves the exact slice I serve — perpetual, on-chain, HL-native — untouched. The everlasting instrument is the one differentiator no competitor offers, and Hyperliquid, the house that perps built, is where that audience already lives. I also engaged Zachary Feinstein (Stevens), author of the amortizing-perpetual-options research, on the pricing and LP-risk design.

• Full autonomous covered-call lifecycle proven end-to-end on testnet — deposit → open → close → withdraw, both cover legs crossing the live book, conservation holding at every step.
• Next: external audit + mainnet + a robust blended oracle, then a multi-LP covered-call yield vault for capacity. Fully collateralized throughout — un-blow-up-able while it earns a track record.
• Honest read: the hard part is liquidity and competing with a Coinbase-backed incumbent, not the contract — and I'd rather show that judgment than hide it.