Papertrade 利用漏洞索赔事件紧随 Hyperliquid 上 2000 万美元的 ETH 交易

Summary

Papertrade vulnerability allegations focus on US$20 million ETH transaction

Hyperliquid's price protection mechanism differs from Papertrade's best mid-price (BBO)

Summary of Papertrade vulnerability allegations

Recent allegations of Papertrade vulnerabilities involve approximately $20 million in orders reported by two wallets on Hyperliquid, causing ETH prices to fluctuate by 10 to 20 basis points, while the wallets held larger long Papertrade positions.

Papertrade used Hyperliquid's best bid-ask mid-price as the padding price for synthetic transactions, which constitutes the price reference risk documented in the document, but remains an unsubstantiated allegation in this case.

Hyperliquid uses independent data source prices and markup prices for its own margin and liquidation protection, so the above allegations do not establish evidence that its native systems have been breached.

In the report released October 11 reviewed, independent wallet analysis, verified loss amounts, compensation plans or Papertrade's official response were lacking.

Allegations Details and Background

Allegations related to the Papertrade vulnerability surfaced on October 11. X platform user Boblob (@Dr_bobo54) claimed that the two wallets each placed approximately $20 million in Ethereum transactions on Hyperliquid. He pointed out that these transactions moved ETH quotes by 0.1% to 0.2%. The wallets are said to hold leveraged Papertrade positions worth hundreds of millions of dollars.

Trader Rune (@RuneCrypto_) shared the warning. However, there is currently no independent analysis to confirm whether there is manipulation, wallet identity, profit or loss. In the report released that day, Papertrade has not yet released a confirmed public response. The core of the accusation lies in its pricing design: Papertrade uses Hyperliquid's best mid-price for both entry and exit of synthetic transactions. The market impact is unclear.

Price movements and potential risks

Researchers pointed out that orders moved ETH quotes by approximately 10 to 20 basis points (1 basis point equals 0.01%, or 0.1% to 0.2%). He claimed that the same wallet held long positions on Papertrade, with a total nominal exposure of hundreds of millions of dollars. When nominal exposure far exceeds the margin paid by traders, small price changes may be amplified and have a huge impact.

Rune pointed out Papertrade's vulnerability risks in its own risk control disclosure. However, the preliminary report did not include wallet addresses, transaction hashes or independent transaction analysis. The breach allegation has not yet been verified; public statements have not proved that any account has benefited from price fluctuations.

Papertrade was recently launched on HyperEVM, a smart contract environment connected to Hyperliquid. Instead of matching users through an order book, it uses synthetic swaps between each trader and its liquidity pool. According to reports, when a position is opened or closed, the agreement will read Hyperliquid's best bid and best ask prices and use its median price as the deal fill price. The platform provides up to 1000 times leverage on the supported Bitcoin and Ethereum markets.

The core of the so-called Papertrade vulnerability theory lies in using the median price of other venues as a reference price. New orders can change the best bid or ask price before execution. Rune believes the change could change Papertrade's offer while larger positions are still open. According to reports, the document listed manipulation of best bid and sell prices as an unresolved risk. Despite this risk disclosure, this does not prove that the alleged wallet exploited the vulnerability.

Differences in pricing mechanisms between Hyperliquid and Papertrade

The alleged Papertrade vulnerability involves how the protocol uses external prices, rather than evidence that the Hyperliquid system was breached. Hyperliquid's native perpetual contracts use independent data source prices and markup prices for transaction protection. Its data source price is the weighted median of centralized exchange prices and is updated approximately every three seconds.

Tagged prices combine multiple inputs, including Hyperliquid orderbook prices and data from other trading venues. Hyperliquid uses it to calculate unrealized profits and losses, determine margin requirements, and trigger liquidation. In contrast, the BBO mid-price reported by Papertrade serves a different function: it determines entry and exit of synthetic transactions. This distinction is crucial when assessing which systems may be affected.

An independent PaperJet description states that Papertrade's liquidity pool started from scratch and grew from traders 'realized losses. It also said that if there is insufficient funds in the pool, the liquidation of profits may need to be queued. PAPER tokens can be minted after qualifying trading losses, and pledgers may receive USDC allocations. These mechanisms describe possible settlement limits rather than the impact identified by current allegations.

Previously, a SK Hynix perpetual contract associated with Hyperliquid fell 17.9% in July. An unusual South Korean transaction subsequently affected its external price reference. Trade.xyz later said it would cover eligible liquidation losses. The case involved different contracts and pricing arrangements and did not substantiate Papertrade's allegations.

Conclusion

The report released on October 11 did not establish whether the Papertrade vulnerability affected the liquidity pool. The withdrawals and queuing for claims have not yet been confirmed. The reports also lacked verified wallet identities, losses, compensation measures or timetables for changes to the pricing system based on the median price.