Architecture

A handful of contracts of ours on one chain, NEAR; one spot venue on it, Rhea Finance's DCL; and one perpetuals venue, Hyperliquid, reached in one hop each way through NEAR Intents and controlled through NEAR's Chain Signatures.

---

Chain

NEAR mainnet. Blocks come about every 0.6 seconds and are final in about 1.2 (read 2026-09-25). Accounts are named (alice.near), and a contract lives at an account. A cross-contract call is a separate receipt that may land in a later block, and a failure in a later step does not undo the earlier ones: every multi-step flow here — a launch, a bond, a hedge transfer — is written as recorded steps that can be resumed, rather than as one transaction that reverts.

The quote asset is USDC, Circle's native dollar on NEAR, at the account 17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1 with 6 decimals — an ordinary NEP-141 token. It is not USDC.e (a0b86991…factory.bridge.near), the older bridged token, which nothing here accepts. Gas is paid in NEAR, and so is storage: an account must deposit a little NEAR on a token before it can hold it (about 0.00125 NEAR per coin), refundable. Everything else is paid and received in USDC. The explorer is NearBlocks.

Contracts

Not deployed yet. The account ids below are set at deployment and will be listed here then; until then, treat any account presented as TerminalPad's as unverified. The runbook names them after one root account: the launchpad at the root, the factory at lt.<root>, the hedge contract at hedge.<root>.

Code that cannot change. The coin, vault and reference-pool code is published once on NEAR as a global contract by hash: every coin, vault and reference pool runs byte-identical code, the accounts are created with no keys, and no one can replace their code. The launchpad is deployed normally and then, as the deployment's last and irreversible step, loses every full-access key, so its code can never be replaced either. The factory and the hedge contract are ordinary accounts; whether their keys are removed or held by a multisig after deployment is not settled yet — see Risks & security.

Rhea Finance DCL

A coin's pool uses the 1% tier (point delta 200); a tracker's USDC reference pool uses 0.04% (point delta 8). DCL positions are NFTs a contract can own; DCL itself has no lock, so the lock is the launchpad's code. Rhea's DAO can pause a pool and upgrade DCL. Everything is paid and received in USDC; there is no second leg through another asset.

The venue

The position behind a tracker lives on Hyperliquid, on trade.xyz's xyz market — a HIP-3 market of stocks, indices and commodities, margined in USDC. Hyperliquid identifies an account by an Ethereum-style address; the protocol's master account is the address NEAR's Chain Signatures derive from the hedge contract's account and a fixed path. Only the hedge contract can have NEAR's signer network (v1.signer) sign as it. The keeper trades with an agent key the master account approved, which cannot withdraw. Every tracker is hedged inside the one master account, and the hedge contract and the keeper keep per-vault books of who owns what inside it.

Dollars cross through NEAR Intents 1Click in one hop each way: NEAR USDC to Hyperliquid USDC (about 30 seconds), Hyperliquid USDC to NEAR USDC (about 35 seconds), in dry quotes on 2026-09-25. No other chain sits in the loop — the Avalanche version needed Arbitrum and Circle's bridge on the way back. Hyperliquid's account state is public. See The hedge book.

The launchpad is the registry

list_coins(from_index, limit) and coins_count() on the launchpad return exactly the coins it launched, in order, once each is live, and nothing else. The site's board reads it directly.

That has two consequences worth having. Coins from older stacks and abandoned experiments cannot appear at all — there is no deny-list to maintain and no way for a stale index to resurrect one. And a coin is listable as soon as its pool is filled, with no indexing lag between the launch and the board.

What is immutable

Changing any of these means deploying new contracts at new accounts. There is no admin action that alters them in place.

What is not

The protocol owner can pause new launches on the launchpad (nothing else there). On the factory it can list or delist the markets the launch form offers (set_underlying, with the Hyperliquid market name and the leverage a position can hold there), set the defaults new trackers are created with, change the NAV signer for new trackers, authorise launchers, create trackers and reference pools, change the reference-pool depth at which a tracker bonds, and bond a tracker directly. On a tracker's vault it can change or cut off its hedge contract (set_hedge_funder, where None stops every outflow), pause it, and adjust its oracle, its risk parameters and its fees within on-chain caps. On the hedge contract it can set the operator, the caps and the managed vaults, approve a trading key, and pause. On a reference pool it can force a re-centre and withdraw the pool's idle inventory. The full list is in Risks & security. None of these reaches an existing coin's pool: a coin already launched keeps its pool, its lock, its fee split and its creator whatever the site later decides to display or whatever happens to the keeper.

Reading it yourself

Every number this documentation states about our contracts is a public view call on NEAR. Where a figure is set at deployment — the bond threshold, the seed floor, the treasury — the docs name the view alongside the value (config() on the launchpad, state() on a vault or the hedge contract), so you can check the live contract rather than a page that may have gone stale. The Hyperliquid side is read from Hyperliquid's own public API, not from NEAR.