Trustless UltraShort Tokens

Status: research proposal, not a deployed product. “Trustless” has a deliberately narrow meaning here. The target design removes an operator from custody, trading, bridge, share-supply, and redemption decisions. It does not make Samsung’s price, Hyperliquid’s consensus, a HIP-3 deployer’s oracle, USDC, smart contracts, or proof systems infallible. No token should be described as Tier 4 until the full subscription-and-redemption path has passed adversarial tests with live funds and no privileged fallback.

The proposal in one paragraph

A Trustless UltraShort Token is a fungible NAVCoin backed by one isolated, autonomously managed short-perpetual strategy. A user chooses an underlying and a leverage policy—“short Samsung at 2×,” for example—deposits USDC, and receives an ERC-20 in MetaMask after contracts have swept the collateral into HyperCore, opened the corresponding xyz:SMSN short, and proved the resulting position and equity to PFTL. The token’s NAV moves with realized and unrealized short P&L, funding, fees, and trading costs. Holders can transfer it, use it in DeFi, or trade it in a Uniswap-compatible pool. Redemption locks the token, closes the holder’s pro-rata share of the perp position, returns USDC, and only then reduces global supply. Keepers may submit transactions, but immutable policy—not a manager—decides what may be traded, where collateral may go, and when shares may exist.

The product is best understood as a rolling onchain perp position packaged as a NAVCoin, not as an ETF placed onchain and not as a synthetic token whose issuer promises to hedge somewhere else.

The user experience

The intended wallet flow is four choices and one confirmation:

Underlying       Samsung Electronics (xyz:SMSN)
Direction        Short
Leverage policy  Target 2.0×, rebalance band 1.8×–2.2×
Spend            1,000 USDC

Estimated opening cost       1.31 USDC
Current funding to shorts     -0.0065% / hour (shorts currently pay)
Estimated liquidation buffer  shown from current venue parameters
Receive                        ~998.69 usSMSN-2x at $1 initial NAV

After confirmation, the wallet shows honest stages rather than a spinner:

USDC escrowed
    -> credited to the strategy on HyperCore
    -> Samsung short filled inside the slippage limit
    -> position and equity proven
    -> NAVCoin shares issued
    -> ERC-20 delivered to MetaMask

If the order cannot fill within the disclosed limit, no tradable token is minted. The user receives a refund claim against the still-segregated cash. A backend outage cannot turn “pending” into an unbacked asset.

The wallet must never promise that a short “gets paid funding.” It says one of:

• Shorts receive funding when the current rate is positive.
• Shorts pay funding when the current rate is negative.
• Funding unavailable or stale when the source cannot be proven.

Funding changes hourly and can reverse sign after the trade.

Why build this now

Leveraged and inverse exposure is no longer a niche product category. Direxion’s 2026 review reports that the US leveraged-fund universe nearly quadrupled over five years, reached $160.5 billion of assets by the end of November 2025, and was on pace for 16.9 billion shares of 2025 trading volume versus 7.3 billion in 2024. It estimates the category represented roughly 8% of all US stock-exchange trading activity in 2025. Those are issuer estimates, but independent venue data point in the same direction: IEX data reported by ETF.com in July 2026 put leveraged products at roughly 40% of ETF trading volume, with seven leveraged products among the ten most actively traded ETFs. The denominators differ—one is all exchange activity and one is ETF activity—but the message is consistent: traders already pay heavily for packaged leverage.^{1 2}

Bloomberg same-store check

We also checked a deliberately fixed basket of six long-running US products: TQQQ, SQQQ, SOXL, SOXS, UPRO, and SPXU. The basket includes three bull/bear pairs, was fixed before measuring the result, and avoids attributing all growth from new launches to organic trading growth.

Bloomberg reported $72.76 billion of current combined fund assets for those six products on August 18, 2026. The volume calculation is Post Fiat’s: PX_LAST × VOLUME, summed by trading day over the identical calendar window. The fund-asset figure is Bloomberg’s FUND_TOTAL_ASSETS. This is a six-fund bellwether check, not a total-market estimate; it excludes closed funds, new products, ETNs, and every issuer outside the selected series. Bloomberg data are proprietary, so this proposal publishes the method and derived aggregates rather than redistributing the raw feed.

The demand is also becoming more granular. Single-stock leveraged products now cover semiconductor, software, crypto-equity, and thematic names, while borrow demand around those products can itself be material. S&P Global reported in 2026 that leveraged and inverse products were taking a growing share of ETF launches and that securities-lending demand around prominent single-stock funds had become economically meaningful.³

What the customer is buying

The customer is buying a transferable claim on the net equity of a transparent short strategy:

strategy collateral
+ realized short P&L
+ unrealized short P&L
+ funding received
- funding paid
- trading fees and slippage
- protocol and proof fees
- finalized liabilities and safety haircuts
= strategy net equity

If Samsung falls 5%, a perfectly maintained 2× short begins with approximately a 10% gross gain before funding and costs. If Samsung rises 5%, it begins with approximately a 10% gross loss. Rebalancing, compounding, gaps, funding, mark methodology, and execution make the actual return different. Like a daily-reset leveraged ETF, it is path dependent. Tokenization does not repeal volatility drag or liquidation.

What changes is the control surface:

This is not automatically a better instrument for every investor. The target customer values bearer ownership, transparent funding, programmatic collateral, continuous transfer, and proof-gated issuance enough to accept perp, oracle, smart-contract, and crypto-market risks.

It is a specialized NAVCoin

The NAVCoin proposal defines a token as a pro-rata claim on a verified reserve portfolio. The canonical collateralization model adds the essential separation between primary issue/redemption and secondary trading. Trustless UltraShort keeps that model and narrows the reserve portfolio to one strategy account and one immutable mandate.

Each series registers:

SeriesConfig {
  underlying_market       // e.g. xyz:SMSN
  direction               // short
  collateral_asset        // linked HyperCore/HyperEVM USDC
  leverage_policy         // target or deterministic range
  rebalance_band
  max_leverage
  min_liquidation_buffer
  max_order_slippage
  max_position_vs_oi
  max_position_vs_depth
  mark_and_oracle_policy
  funding_policy
  fee_policy
  proof_profile
  strategy_contract
  permitted_core_actions
  representation_contracts
}

One series has one equity pool, one policy, one NAV, and one global supply. Its shares can appear natively on PFTL and as wrapped units on HyperEVM or another registered EVM, but those are representations of the same economic supply—not additional claims.

Uniswap is the secondary market. It does not set primary NAV, authorize minting, count as reserve equity, or change global supply. A discount or premium can exist; permissionless issue/redemption arbitrage is what should pull the pool toward NAV.

A fungible token cannot contain private leverage settings

“Let the user choose any leverage” sounds simple but violates fungibility if two holders of the same token can have different claims. The leverage setting must belong to the series, not to an individual balance.

There are two viable product forms:

1. Fixed-target series. usSMSN-2x targets 2.0× short exposure and only rebalances outside a published band, such as 1.8×–2.2×.
2. Adaptive-range series. usSMSN-CARRY may move between, for example, 1.0× and 2.5× under a deterministic rule tied to funding, liquidity, volatility, and liquidation buffer. Every holder owns the same policy.

The wallet may present a leverage slider. Underneath, that slider selects an existing series or permissionlessly deploys a new series from an audited factory. It must not silently mix unlike leverage claims in one ERC-20.

Deterministic leverage controller

For strategy equity \(E_t\), signed position quantity \(Q_t < 0\), and the registered oracle price \(P_t\):

A fixed-target controller trades only when \(L_t\) leaves the registered band. An adaptive controller computes a target using bounded integer arithmetic:

where \(C(f_t)\) is a capped funding adjustment and \(R_t\) is a deterministic risk deduction derived from proven depth, oracle deviation, volatility, and liquidation buffer. The exact functions and lookback windows are series state. No model, keeper, or UI may improvise them.

The controller should scale toward the high end only when shorts are being paid and the risk checks remain healthy. Negative funding pushes toward the low end. Funding is an input to leverage, never a promised yield.

The Samsung example, using live venue state

At 13:57 UTC on August 18, 2026, Hyperliquid’s public metaAndAssetCtxs endpoint reported the following for xyz:SMSN:

Hyperliquid’s funding convention is positive when longs pay shorts and negative when shorts pay longs.⁴ At this snapshot, a 2× short backed by $1,000 of equity had about $2,000 notional and would pay approximately $0.1304 for that hour if the rate and notional remained unchanged. That is not an annual forecast; funding is variable and can flip sign. The wallet sentence “short Samsung and get paid funding” would have been false at this moment.

This snapshot demonstrates that a usable market exists, not that it is safe or that its current liquidity supports arbitrary token size. The series must cap its position against open interest and proven executable depth, not merely the venue’s advertised 10× maximum.

The economic edge must survive a market-wide test

Funding is not incidental to the instrument. Hyperliquid specifies a default interest component equivalent to 11.6% annualized paid to shorts when premium is neutral; the premium component then moves the hourly rate in either direction, and HIP-3 deployers may apply a funding multiplier.⁴ Payments are peer-to-peer rather than a fee retained by Hyperliquid. An UltraShort series passes the resulting cash flow directly into NAV.

Samsung alone is not credible evidence for that edge. We therefore applied one fixed 90-day rule to two broad frozen universes in the local Hyperliquid archive: at least 90% of the 2,160 expected hourly observations and a final observation no more than six hours before the cohort cutoff. The core panel ended July 2 at 10:00 UTC; the HIP-3 xyz: archive ended five hours later. We report the cohorts separately because their assets, operators, and funding regimes differ.

The HIP-3 result spans single stocks, equity indices, commodities, and FX. At constant 2× notional, its median funding contribution would have been +5.01% of starting equity over 90 days before underlying-price P&L and every other cost. This is the broad economic evidence for the product; it is not an annualized projection.

The core result is an equally important warning. Shorts received funding in roughly three quarters of individual hours, yet large negative observations left the equal-market 90-day mean below zero. Sign frequency is therefore not a carry strategy. A series needs cumulative funding, tail loss, liquidity, and liquidation checks; the adaptive controller must reduce leverage or reject a market whose apparent positive-hour frequency hides adverse net carry.

Samsung was in the upper tail, not the representative case: xyz:SMSN ranked third among the 47 eligible HIP-3 markets at +12.73% of constant 1× notional in the comparable 90-day window. Its longer 4,310-hour history through August 18 summed to +17.25%, but included a negative March and rolling 30-day annualized funding from -34.24% to +70.41%. The live hour above also charged shorts.

These are historical cash-flow decompositions, not strategy-return backtests or expected yields. They exclude price P&L, changing notional, rebalancing, liquidation, fees, slippage, and compounding. The defensible claim is narrower: a large majority of sufficiently active HIP-3 markets paid shorts net-positive funding in this fixed window, and a proof-gated token can expose, pass through, and condition leverage on that carry instead of burying it.

A conventional inverse ETF is not literally zero carry: swaps embed financing and borrow, collateral may earn interest, and expenses reduce NAV. Its holder sees those effects netted together. UltraShort makes the hourly funding leg separately observable and policy-addressable. The immutable per-market universe CSV, universe summary, and universe analysis script publish the inclusion rule, every eligible market result, distributions, source hashes, and calculations. The derived CSV SHA-256 is d3f5902cd8a957b1cfdd46876716349ea288903365cfa838c7811ef5a25af1aa. Samsung’s complete hourly case file and case summary remain published for observation-level audit.

Trustless collateral sweep

The hardest requirement is not wrapping the position. It is proving that every dollar accepted for shares was actually placed under the series mandate without giving an operator a withdrawal key.

The clean initial deployment keeps both strategy settlement and the wrapped token on HyperEVM. MetaMask supports HyperEVM, and a Uniswap-compatible AMM can run there. This avoids pretending that Hyperliquid’s current native Arbitrum withdrawal API is callable by an autonomous contract when it is not.

Hyperliquid’s live spotMeta response listed canonical USDC with a linked HyperEVM contract on August 18, 2026. That makes the proposed EVM ↔ Core route plausible, not proven. Hyperliquid’s own documentation warns that linking alone does not validate ERC-20 bytecode or guarantee that the system address holds sufficient supply.⁵ The launch proof profile must pin the USDC contract, verify its code and system balance, and demonstrate both transfer directions before accepting deposits.

                         HYPERLIQUID (one HyperBFT state)

 MetaMask            HyperEVM contracts                 HyperCore
 --------            ------------------                 ---------
 USDC -------> SubscriptionEscrow
                         |
                         | ERC-20 transfer to the
                         | linked token system address
                         v
                                                  strategy spot USDC
                                                         |
                         CoreWriter policy --------------+
                                                         v
                                                  xyz perp collateral
                                                         |
                                                  short xyz:SMSN
                                                         |
                         HyperCoreReader <---------------+
                              |
                    finalized receipt proof
                              v
                         PFTL NAV state
                              |
                    Tier-4 issuance proof
                              v
 MetaMask <------- wrapped usSMSN ERC-20 -----> AMM pool

Hyperliquid’s current read precompiles expose HyperCore state to HyperEVM and guarantee that returned values match HyperCore when the EVM block is built. CoreWriter allows a contract to place limit orders, cancel them, transfer USD between spot and perp classes, and send spot assets on behalf of the contract’s own HyperCore account.⁶ The strategy address must be initialized on HyperCore before it sends a CoreWriter action; initialization and an action in the same EVM block fail under the documented ordering.⁷

Subscription state machine

1. The user transfers HyperEVM USDC into a series-specific escrow with minimum shares, maximum slippage, and deadline.
2. The escrow moves linked USDC to the same contract’s HyperCore spot balance.
3. The controller transfers the allowed amount to the registered HIP-3 perp class and places a bounded order through CoreWriter.
4. A reader contract records position, collateral, account equity, funding, mark, oracle, and market identifiers in a HyperEVM receipt.
5. A proof opens that receipt against the HyperEVM receiptsRoot and anchors the header to HyperBFT finality. PFTL checks the pinned reader, market, strategy address, freshness, fill, leverage, and arithmetic.
6. PFTL finalizes the new NAV and share supply. A Tier-4 PFTL proof authorizes the representation contract to mint shares to the subscriber.

Steps span blocks and are therefore not atomic in the database sense. Safety comes from the state machine: cash is segregated while pending; a failed or expired order cannot produce transferable shares; retries are idempotent; every receipt identifier is single-use.

Redemption state machine

1. The holder locks wrapped shares in RedemptionEscrow with a minimum USDC payout and deadline. Locking is reversible until execution begins.
2. PFTL verifies the lock and authorizes a proportional, reduce-only close.
3. The controller closes the corresponding share of the short through CoreWriter and moves released USD from the perp class to spot.
4. The controller sends spot USDC to its linked HyperEVM system address. The corresponding ERC-20 is credited on HyperEVM.
5. A new receipt proves the reduced position and returned cash. PFTL finalizes the lower global supply; the representation contract burns the locked shares and pays the actual net USDC proceeds.

If a close cannot execute within the user’s limit, the token unlocks instead of being destroyed. Once a position has been reduced, the resulting cash remains a reserve asset owed to that redemption until it can be paid. A proof outage may delay completion; it may not give governance or a keeper the cash.

Why Ethereum/Arbitrum cash-out is a separate route

Hyperliquid’s native bridge credits deposits sent from Arbitrum, but its current withdrawal flow requires a user-wallet withdraw3 signature and validator processing.⁸ CoreWriter does not expose that withdrawal action. Giving a server or committee the strategy’s signing key would defeat the proposal.

The initial product therefore redeems to USDC on HyperEVM. A later Ethereum or Arbitrum route must be one of:

• a proof-verified bridge whose contracts can lock/burn HyperEVM USDC and release destination USDC without an operator signature; or
• a permissionless solver market in which a solver pays destination-chain USDC and claims the proven HyperEVM proceeds through an atomic claim protocol.

The wallet may offer those routes only with separate trust, fee, liquidity, and timing disclosures. “Tier-4 UltraShort redemption” must not inherit a Tier-3 cash-out hidden behind the same button.

NAV and supply accounting

At finalized epoch \(t\), strategy net equity is:

where \(C\) is collateral, \(RP\) realized P&L, \(UP\) unrealized P&L, \(F\) net funding, \(X\) explicit fees and execution costs, and \(H\) registered haircuts or liabilities. With valid global supply \(S_t\):

PFTL should consume the HyperCore account-equity value committed through the reader, then cross-check it against position, mark, oracle, collateral, and funding fields under the proof profile. All monetary arithmetic uses bounded integers and registered decimal scales. A stale API response is not a reserve packet.

For a subscription that adds proven net equity \(\Delta E\), new shares are computed from the pre-subscription NAV:

Rounding direction, dust treatment, and every fee are fixed in the series. A redemption receives the actual proceeds of its pro-rata close, subject to the user’s limit; any difference from the quoted NAV is explicitly attributed to funding, price movement, fees, and execution.

Tier 4: what is and is not trustless

The pfUSDC Tier-4 design defines the relevant standard: both ingress and egress facts are verified, and there is no observer, multisig, or signer fallback. Applying that standard here requires more than a proof-of-reserves dashboard.

For xyz:SMSN, the HIP-3 deployer determines important market parameters and the oracle maps a Korean equity into a continuously traded USD perp. HIP-3 markets are isolated, but isolation does not make the oracle true. A 2026 TradeXYZ oracle incident involving SK Hynix reportedly caused roughly $60 million of liquidations after an anomalous Seoul print; reimbursement was a discretionary venue response.⁹ That is exactly the kind of source risk a receipt faithfully proves rather than eliminates.

The honest claim is:

No operator can mint an UltraShort share before the registered position is live, redirect strategy collateral, choose an unregistered trade, or complete redemption without reducing the proven liability. The holder still bears the registered venue, oracle, market, collateral, contract, and consensus risks.

Required invariants

The implementation is not acceptable unless these invariants hold under model, fuzz, fork, and live-bounded tests:

1. One global supply. PFTL native supply plus all registered wrapped supply equals finalized economic supply; bridges never create net claims.
2. Position before shares. No transferable share exists until collateral, fill, leverage, and equity are proven under the current profile.
3. No free collateral. Subscription cash is escrowed, deployed, refundable, or owed to a specific claim. It is never an operator balance.
4. Restricted strategy. The controller can trade only the registered market, direction, collateral, order types, leverage bounds, and destinations.
5. No keeper authority. Anyone may call maintenance functions; caller identity cannot change the allowed state transition or destination.
6. Single-use evidence. Deposit, fill, bridge, mint, burn, and payout receipt identifiers cannot be replayed.
7. Freshness fails closed for risk. Stale or invalid proofs disable issuance and leverage increases.
8. Exits remain open. A halt preserves reduce-only orders, cash return, redemption claims, and proof challenges wherever the underlying chain is live.
9. Liquidation is explicit. The series can lose all NAV. It may never mint a replacement claim to conceal that loss.
10. Secondary trades are accounting-neutral. AMM swaps change holders and market price, not strategy equity or global share supply.
11. Governance cannot seize. Upgrades use new series versions. An existing immutable series cannot be repointed to a new market, oracle, or withdrawal address.
12. No silent downgrade. If either proof direction is unavailable, the product reports the exact lower tier and disables the Tier-4 label.

Risk controls that belong in code

Liquidation and gap risk

Launch leverage should be materially below the venue maximum. A 10× venue limit is not a sensible retail product target. The controller needs minimum margin buffer, maximum leverage, reduce-only emergency behavior, and a rule for gaps while the reference equity market is closed.

Oracle and market-hours risk

Samsung trades in Korea while the perp can trade outside Korean cash hours. The policy must distinguish primary-market, off-hours, and halted states; cap oracle deviation; define FX treatment; and disable new exposure when the registered oracle or executable quotes are stale. Corporate actions need deterministic handling before the ex-date, not an administrator’s retrospective edit.

Capacity risk

Series open interest must be capped as a fraction of Hyperliquid market open interest and executable depth. Subscription may partially fill and refund the rest. A Uniswap pool with deep apparent liquidity cannot authorize a larger perp position than the backing venue can safely carry.

Funding and basis risk

Funding belongs entirely in NAV. Positive funding paid to shorts increases equity; negative funding reduces it. No protocol marketing may annualize one hour’s rate as expected yield. Perp basis, mark construction, and oracle moves must be visible next to funding.

Contract and chain risk

The product composes PFTL, HyperBFT, HyperCore, HyperEVM, USDC, proof circuits, representation contracts, and an AMM. Each component adds failure modes. Tier 4 removes discretionary custody; it does not imply zero technical risk.

Fees and protocol economics

The business should make money in ways a holder can reconcile directly to NAV:

• an annualized management fee accrued per block or epoch;
• a small issue/redemption protocol fee;
• exact pass-through of trading, proof, bridge, and gas costs; and
• optionally, a share of positive realized funding, never a fee calculated from advertised or unrealized funding.

AMM fees belong to liquidity providers. Remaining funding and strategy P&L belong to token holders. The protocol should not run an undisclosed market-maker inventory or socialize one series’ execution losses across another.

The strongest commercial wedge is not merely “another 2× token.” It is a factory for long-tail, globally accessible exposure that conventional ETF sponsors cannot launch economically or distribute continuously: Korean equities, private-market proxies, commodities, rates, baskets, and hedges—provided a liquid perp and a defensible oracle already exist. Each series converts existing Hyperliquid liquidity into a composable bearer asset while the protocol earns transparent recurring fees.

Implementation sequence

Phase 0 — falsify the route

• Deploy a same-address HyperEVM controller and initialize its HyperCore account before any CoreWriter call.
• Verify the linked USDC contract code and system-address backing, then move USDC EVM → Core → HIP-3 perp class and back Core → EVM without an EOA trade or withdrawal key.
• Open and close a bounded xyz:SMSN isolated position using only permissionless keeper calls.
• Confirm every required position, margin, funding, mark, oracle, and balance field is exposed by the read precompiles. The existing local Hyperliquid proof work identifies a real coverage gap around some spot/cash fields; launch must not paper over it with an API response.

Failure of any item blocks the Tier-4 claim.

Phase 1 — one non-transferable live strategy

• Fixed 1× short on a deep, continuously traded crypto underlying.
• One immutable controller, no token, no AMM.
• Prove subscriptions, fills, equity, funding, rebalances, closes, and refunds.
• Run invariant, reorg, stale-proof, keeper-censorship, partial-fill, and liquidation simulations.

Phase 2 — one wrapped NAVCoin

• Issue a capped, fixed-target series after a complete live proof loop.
• Add PFTL global-supply accounting and the HyperEVM representation.
• Add redemption escrow before adding secondary liquidity.
• Publish raw transaction, receipt, proof, supply, P&L, and conservation evidence.

Phase 3 — AMM and variable leverage

• Seed a small Uniswap-compatible USDC pool with no protocol promise to defend NAV.
• Display pool price, finalized NAV, premium/discount, available primary capacity, funding, and liquidation buffer separately.
• Introduce adaptive leverage only after deterministic shadow operation shows lower liquidation risk and acceptable turnover versus fixed leverage.

Phase 4 — destination-chain settlement

• Add a proof-backed solver route or a genuinely proof-verified USDC bridge.
• Test censorship, solver failure, proof delay, and destination liquidity.
• Keep HyperEVM USDC redemption as the canonical fallback.

Launch acceptance test

The first product is ready only when an external reviewer can independently verify this complete loop:

HyperEVM USDC
  -> segregated subscription
  -> HyperCore collateral
  -> registered short position
  -> finalized NAVCoin shares
  -> wrapped ERC-20 in MetaMask
  -> AMM transfer to a second wallet
  -> redemption lock
  -> proportional reduce-only close
  -> wrapped and global supply reduction
  -> HyperEVM USDC payout

The evidence bundle must prove beginning and ending balances, every fee, actual funding, actual fill prices, maximum leverage, global supply conservation, and the absence of any privileged transaction. “The UI says complete” is not an acceptance test.

Conclusion

Leveraged ETFs prove the product demand; Hyperliquid supplies liquid, continuously rolled perp exposure; NAVCoin supplies the accounting and issuance discipline. The opportunity is to combine them without keeping the one feature that makes most tokenized funds untrustworthy: an operator who can mint first, hedge later, move the collateral, or decide whether redemption happens.

Trustless UltraShort Tokens should begin with a narrow promise: a bearer share of a specific autonomous short strategy, issued only after the position is proven and redeemed only through a proven pro-rata close. If that loop works, variable-leverage series and long-tail markets become factory outputs. If the loop needs an operator key, it is not Tier 4 and should not be sold as one.

“UltraShort” is a working research name and may overlap existing financial product branding. Production naming requires trademark and regulatory review.

Sources