HELIX

HELIX is a permissionless perp DEX that runs as a single Uniswap v4 hook on Base L1. There is no orderbook, no off-chain matcher, no sequencer, and — after deploy initialization — no admin. Every position trades against the underlying AMM's deepest liquidity layer; every fee accrues to a community LP vault and a fixed-supply governance token; every parameter is set in stone the moment lockMarkets() fires. This document specifies the protocol from invariants down to the bootstrap math.

01Abstract

Centralized exchanges concentrate billions in custodial risk; existing decentralized perp DEXs either (a) build sovereign L2s to escape mainnet latency, (b) operate off-chain matching engines that reintroduce centralized failure modes, or (c) live on isolated sidechains with thin native liquidity. HELIX takes the third path: inhabit Base's Uniswap V4 as a hook contract, inheriting its liquidity, finality, and validator set. Settlement is per-block. Funding is rate-clamped and oracle-corrected. The HLP vault prices counterparty risk transparently; the $HELIX token captures protocol revenue through a perpetual buy-and-burn loop. Bootstrapping is bounded and time-decayed; founder seed is locked; admin keys do not exist past Phase 9 of the deploy script.

02Invariants

The following properties are enforced at the contract level and cannot be modified after deploy:

• No admin role. No onlyOwner modifier. No proxy. No upgrade path. The INIT_ADMIN address can only call addMarket and lockMarkets, and only until the registry is frozen.
• Market registry is one-shot. lockMarkets() can be called exactly once. After it fires, no new market can ever be added.
• $HELIX supply is fixed. 1,000,000,000 tokens minted at deploy. No mint function exists. Buybacks burn to 0xdead — supply only decreases.
• HLP drawdown gate. If HLP NAV drops more than 8% off its all-time peak, withdrawals pause until the peak is recovered.
• Founder seed lock. The founder's $250K seed deposit is share-locked for 90 days, enforced in hlpWithdraw().
• Reentrancy guard. Every external user-facing entry is marked nonReentrant.
• Safe ERC20. All token transfers go through _safeTransfer/_safeTransferFrom helpers that require both a successful call and a non-false return value.

03Perpetual engine

HELIX supports 24 perp markets at launch, all settled in USDC. Cross-margin: a single USDC balance backs every open position. A trader can long ETH-PERP, short SOL-PERP, and short PEPE-PERP simultaneously, drawing margin from one account.

Position lifecycle

Each (trader, marketId) pair maps to at most one Position struct. Opening more in the same direction stacks margin and notional. Opening in the opposite direction reduces or flips the position. The fee schedule is paid in USDC on every open and close:

Margin tiers

04Funding

Funding is a continuous rate derived from the divergence between the AMM mark price and the chainlink oracle price. It is settled hourly into each trader's margin account:

The rate is clamped to ±0.05% per hour (FUNDING_CLAMP_PP1E8 = 5000) to prevent extreme single-period dislocations. When the rate is positive, longs pay shorts; when negative, shorts pay longs. The hook contract calls settleFunding(marketId, mark) at the start of every swap that touches a bound pool, so funding is always current with the most recent AMM clearing price.

05Liquidation

A position is liquidatable when its maintenance-margin ratio exceeds 100%. Any wallet may call liquidate(trader, marketId) and receive a 1.0% bounty of seized notional. The loss waterfall ensures HLP is the lender of last resort, not the first:

1. The liquidator receives a 1% bounty of seized equity (capped at remaining equity).
2. Any positive equity after bounty refunds to the trader's margin account.
3. Negative equity (residual loss) first drains the insurance fund.
4. Anything still uncovered drains HLP.

There is no socialized P&L in normal conditions. The HLP vault absorbs residual losses individually — other traders' margin is never touched.

06Oracle

HELIX uses a two-source mark price: a Chainlink aggregator and an AMM 10-minute TWAP, taken as the median.

oracleMark = median(chainlink, ammTwap10min)

Both must be available to write a new mark. If either is stale or divergent by more than 1.5%, the protocol falls back to the closer source. The TWAP is read via AMM.twapOf(marketId, 600) from the v4 hook adapter, all WAD-scaled.

07HLP vault

The HELIX Liquidity Pool (HLP) is the protocol's counterparty. LPs deposit USDC, receive HLP shares minted at the prevailing share price, and earn:

• 49% of every protocol fee (split with $HELIX stakers and the insurance fund)
• The opposite side of every trader's PnL — NAV ticks down when traders win on net, up when they lose
• Bonus $HELIX during the bootstrap window (see §9)

Drawdown gate

If the HLP vault is more than 8% off its peak NAV, withdrawals pause:

require(hlpAssets * BPS >= hlpPeakAssets * (BPS - HLP_DRAWDOWN_GATE_BPS), "drawdown gate");

The gate releases automatically when the peak is recovered. Emissions continue to accrue while paused, so LPs are compensated for the wait — and there is no admin override.

08Insurance fund

2% of every protocol fee accrues to an insurance fund capped at $1,000,000 USDC. Once filled, overflow routes to HLP. The fund acts as the first buffer for liquidation residuals, draining before HLP touches the loss. There is no admin withdrawal path — funds drain only via the liquidation waterfall.

09HLP bootstrap

A time- and cap-bounded window pays double $HELIX emissions on the first $1M of HLP deposits.

Per-deposit math

If applied + remainder > cap, the overflow earns base rate only. The window ends when either the cap fills or 28 days elapse — whichever first. There is no extension mechanism.

Why this shape and not alternatives

10$HELIX token

Fee flow per $1.00 collected

1. $0.02 → insurance fund (until $1M cap, overflow to HLP)
2. $0.49 → $HELIX stakers via per-share accumulator
3. $0.49 → buyback queue; queue swaps USDC for $HELIX from the AMM and burns to 0xdead

11v4 hook

HelixHook is bound to each market's Uniswap v4 pool. Permissions are bit-encoded into the hook address (lowest byte 0xC0 = beforeSwap + afterSwap only). Every other callback reverts at the contract level.

• beforeSwap — settle funding for the bound market + sweep up to 3 flagged liquidations
• afterSwap — record the cleared mark price + donate 5 bps of quote-token swap volume to HLP

Bindings are one-shot: bindMarket is callable only by INIT_ADMIN until lockBindings() fires. After that, the pool↔market mapping is frozen forever.

12TGE & distribution

The Token Generation Event is conducted entirely on-chain. There is no presale, no whitelist, no investor allocation. Distribution paths are:

Airdrop (35% of supply = 350M $HELIX)

Snapshot is taken at TGE_BLOCK - 1. Cohorts and weights:

Anti-sybil: discord-account uniqueness, 0.05 ETH balance floor at snapshot, mixer-funded wallet exclusion, and a 50K $HELIX per-wallet cap regardless of cohort math. 25% releases at TGE, 75% vests linearly over 6 months.

Open Merkle claim (5% = 50M $HELIX)

Late-discovery users can claim a flat 500 $HELIX from a Merkle tree opened 24h after TGE. Closes after 30 days; unclaimed reverts to treasury.

Initial LP

At TGE, the treasury funds the initial $HELIX/USDC market: 25M $HELIX + $250K USDC on Uniswap v4 0.3% tier, with HelixHook bound for buyback mechanics. The LP token is locked 12 months minimum (recommended permanently).

13Audit summary

Pre-external audit, the protocol has passed:

• Internal slither static analysis — 0 critical, 0 high findings post-remediation
• 1 medium finding (unchecked ERC20 transfers) — fixed via _safeTransfer helpers
• 4 low findings — 2 fixed, 2 acknowledged as intentional design (timestamp dependence on multi-day windows; receive() that intentionally reverts)
• 34 forge tests across 3 suites, all passing

Three external audits are queued: Trail of Bits, Spearbit, and Cantina. Reports will be published alongside the mainnet deploy transaction.

Open items (must close before mainnet)

1. OPEN-01 — Chainlink staleness check in _oracle()
2. OPEN-02 — Wire executeBuyback() to AMM with slippage protection
3. OPEN-03 — Subgraph for trade/liquidation history
4. OPEN-04 — Fuzz tests on _calcPnL and funding math

14Risk disclosure

The following risks are inherent to the design and cannot be engineered away. Anyone interacting with HELIX is responsible for understanding them:

• Trader streak. Sustained trader-favorable PnL drains HLP. The 8% drawdown gate slows the bleed but cannot prevent depth-of-loss in a structural regime shift.
• Oracle. Chainlink + AMM TWAP median is robust but not infallible. Simultaneous manipulation of both sources is the worst case.
• Smart contract. Pre-audit code is risky to interact with at material size. Audits land before mainnet, not after.
• Liquidity. The protocol assumes deep AMM liquidity on the underlying pairs. Thin markets produce wide mark drift, which feeds back into bad funding rates.
• Pre-deploy: testnet behavior is not a guarantee of mainnet behavior. Bootstrap participants accept HLP NAV risk.

Nothing in this paper is investment advice. The token has no economic claim outside the fee-share + buyback mechanics defined here. The bootstrap window does not guarantee a return; LPs can lose capital if traders win on net.

15Contract surface

HelixPerps · trader entries

deposit(uint256)
withdraw(uint256)
open(bytes32, Side, uint256, uint256)
close(bytes32, uint256)
liquidate(address, bytes32)
hlpDeposit(uint256)
hlpDepositWithReferral(uint256, address)
hlpWithdraw(uint256)
bootstrapClaim()
bootstrapClaimable(address) view
stake(uint256) / unstake(uint256) / claim()
executeBuyback()
seedFounderDeposit(uint256)  // founder only, one-shot
lockMarkets()                // INIT_ADMIN only, one-shot

HelixPerps · hook entries (onlyHook)

settleFunding(bytes32, uint256)
sweepLiquidations(bytes32, uint8) returns (uint8)
recordMark(bytes32, uint256)
donateHLP(bytes32, uint256)

16References

1. Source: HelixPerps.sol · HelixHook.sol
2. Bootstrap mechanics spec: /view?doc=contract/BOOTSTRAP.md
3. TGE distribution spec: /view?doc=contract/TGE.md
4. Internal audit report: /view?doc=contract/INTERNAL_AUDIT.md
5. Mainnet deploy checklist: /view?doc=contract/DEPLOY_CHECKLIST.md
6. Uniswap v4 Core: The Uniswap V4 Core White Paper, Adams et al., 2024