HyperEVM · HIP-3

TomahawkFi

Perps on penny stocks and the pre-market, 24/7. Trade the volatility Wall Street won't let you touch.

One war chest funds one desk. Every session its equity is read straight off HyperCore and split down the middle of an axe: the Handle is paid first, the Blade takes the first loss and everything left over.

Read the field manual How the split works

Contracts written, 48 tests green · nothing deployed, no liquidity yet

One number runs this camp

A contract on HyperEVM can ask HyperCore what an account is worth on a HIP-3 dex, and get an answer in the same transaction. That reading is the only input TomahawkFi has, and every rule below is written to need nothing else: no oracle, no reported NAV, no committee, no signature.

The chest funds one desk

Deposits are USDC. The vault bridges them onto HyperCore and pushes them to a single HIP-3 perp dex, the kind of venue where a penny stock or a pre-market name is actually listed and quoted around the clock.

Anyone can call the mark

mark() is permissionless. The people whose money it is never have to wait for an operator to admit a loss. It reads the desk's equity, adds what is idle on Core and on HyperEVM, and folds the difference into the book.

The fall decides who owns what

Gains repay the Handle's arrears, then its preferred return, then everything left is the Blade's. Losses run the other way: the Blade is spent to zero before the Handle is touched at all.

Senior tranche

The Handle

The wood. You hold the part that does not cut you.

8 % preferred return, accrued by the second for as long as your capital stands at risk.
Paid before anyone else. A gain funds the arrears and the preferred return in full before a single unit reaches the Blade.
Touched last. A loss has to spend the entire Blade before it reaches you, and if it does, the write-down is booked as a debt the next gains repay first.
24 hours' notice, then paid. A claim the vault cannot cover in full pays what is there and stays in the queue for the rest. It never reverts, so it can never be starved.

Junior tranche

The Blade

The steel. It takes the hit, so it takes the edge.

First loss, all the way to zero. That is the whole job. Wiped shares are wiped: they cannot price a later deposit back into existence.
Everything above the Handle's claim, less a 20 % performance fee, and that fee is charged only above the Blade's own high-water mark, so nobody can farm it by marking every up-tick.
A seat is burnt for, not bought. Burn TOMA, unlock capacity: 10 USDC of Blade room per token, permanently, and the supply never comes back.
Capped at half the Handle. A junior tranche larger than the senior it is meant to protect is not a junior tranche.

Custody

Trade it, never take it

The desk's trader can rest orders on listed markets and push capital out to the dex. There is no path by which that key can send a unit anywhere else: the two functions that move value address address(this) and USDC's own system address, both compile-time constants, and neither takes a destination.

Typed actions only. The vault builds every CoreWriter payload itself. It has no entry point that forwards bytes, which is the usual way this integration is turned into a back door.
The way home needs nobody. Anyone may pull idle capital off Core, and after 14 days without a mark anyone may pull it off the desk as well.
The queue is paid before the desk is fed. The trader cannot bridge out money a withdrawal is already waiting on.
Governance has a ceiling. Bounded dials and a listing table. It cannot move a unit, cannot mint, cannot pause, cannot replace itself, cannot change where the operator fee goes.

The token

$TOMA

One billion, minted once, no owner, no mint function, nothing to renounce.

Burn it for a seat. The only thing TOMA does inside the protocol is buy junior capacity, and it does it by leaving the supply for good.
One address collects every fee. The Blade's performance fee, the pool's trading fees and the launch position itself all pay a single operator address fixed at deployment, in the same call that books them. Nothing to claim later, nothing to vote on.
The mark travels with the token. ERC-7572 contractURI() with the logo drawn on-chain, baked in at deploy, with no setter to repoint it.
No tax, no blacklist, no pause. A sell-side tax cannot even exist against a v3 pool; this one does not pretend otherwise.

The dials, and their ceilings

Everything the governor can turn, and how far it can turn it. The bounds are reverts in the contract, not conventions in a document.

Dial	At launch	Hard bound	What it does
Preferred return	8 %	≤ 30 %	What the Handle accrues per year while at risk
Performance fee	20 %	≤ 30 %	Taken from the Blade, above its high-water mark only
Blade cap	50 %	5 % to 200 %	How large the junior may be against the senior
Notice	24 h	1 h to 7 d	Between a withdrawal request and its first payment
Settle window	10 blocks	1 to 500	Marking is refused this long after a Core send
Seat rate	10 USDC / TOMA	fixed	Blade capacity unlocked per token burnt
Operator share	100 % of the fee	fixed	Paid in USDC to an immutable address, in the same call
Abandonment	14 days	fixed	No mark for this long and the recall opens to everyone

What the chain will not tell you

These are measured limits, not caveats. They were established by calling the precompiles on HyperEVM and cross-checking the answers against the Hyperliquid API, and the protocol is shaped around them rather than written past them.

Value, never composition

On a HIP-3 dex a contract can read accountMarginSummary(dexIndex, addr) and nothing else. markPx, oraclePx and perpAssetInfo revert on a HIP-3 asset id, and position() takes a uint16 while HIP-3 ids start at 100 000, so the market cannot even be named in the argument.

So the Warchest proves what the desk is worth, and never what it holds. Anyone selling you the second one on this chain today is selling you a screenshot.

Performance is trusted, custody is not

A trader who loses their key loses the ability to trade well. They never gain the ability to steal: the contract will not encode a destination it was handed. That is a real boundary, and it is the only one being claimed.

CoreWriter is fire and forget

An action is a log HyperCore reads afterwards; the EVM transaction succeeds whether or not Core accepts it. So every capital move is one step per transaction, each step checks the precompile for the balance it is about to move, and marking is refused until the send has settled. Crediting a book from a balance that has not landed is how a vault pays out money it does not have.

Nothing is deployed

No addresses, no pool, no liquidity, no deposits. The contracts compile and 48 tests pass, including the launch path against a live fork of Project X. That is the entire claim being made on this page today.