PaperTrade BBO Pricing Incident

Incident Summary

PaperTrade reported manipulation attempts on 10–11 October 2026 targeting the Hyperliquid best bid and ask (BBO) used to price its synthetic positions. The project acknowledged the attempts on 11 October. The account examined in this analysis withdrew 1,279,106.191184 USDC more than it deposited. PaperTrade settled positions at the instantaneous BBO midpoint, while its profit haircut used a fixed reference notional. This linked large synthetic payouts to an influenceable quote without increasing the haircut percentage as position size grew. Graphic summary — Analyst-created diagram of the supported mechanism, position 72098's settlement and account-level withdrawals.

Addresses and Roles

All addresses below are on HyperEVM, chain 999.

Background

PaperTrade offered leveraged synthetic trading against its Martingaler liquidity pool. Opening a position created internal exposure; PaperTrade did not place an equivalent order on Hyperliquid. Closing the position settled its PnL against the pool.

PriceOracle obtained Hyperliquid’s current best bid and ask through precompile 0x080e and used their midpoint as the execution price. Profitable closes passed through a deadband, an asymmetric-impact haircut and a winning-close fee. Payments were queued when liquidity was insufficient. The price therefore came from Hyperliquid’s inside quotes, while PaperTrade’s pool backed the synthetic exposure. The amount payable depended on the position size, even though no equivalent quantity had traded at that midpoint.

Attack Flow

All times below are UTC. The four steps describe the examined account’s opening, settlement, external trading and withdrawals.

1. Position opening

At 21:41:36 on 10 October, 0x2025137a136bea7446deba681cbfc7cf1970840e opened ETH long position 72098 in transaction 0xe639…f225. The opening receipt recorded 20,000 USDC margin, 500× leverage and an entry price of $2,506.45. The historical trace shows a $2,506.40 bid and $2,506.50 ask, with the oracle returning their $2,506.45 midpoint. Margin multiplied by leverage established $10 million of synthetic exposure.

Figure 1 — Step 1: local decoded view of the opening receipt, block 48,202,020, log 4. Notional is derived from margin × leverage.

2. Settlement

Six minutes later, at 21:47:36, the position closed in transaction 0xb5bc…df42d. The closing receipt records an exit at $2,510.85, a favorable movement of approximately 17.55 basis points. The historical call trace follows Exchange → PriceOracle → BBO precompile 0x080e. The precompile returns 251080 / 251090 in $0.01 quote units: a $2,510.80 bid and $2,510.90 ask. PriceOracle returned 251085, exactly the $2,510.85 exit recorded by the successful settlement. Both BBO reads in this transaction agree.

These quotes have a $0.10 spread (approximately 0.40 basis points). The 17.55 basis points above measures the entry-to-exit return over six minutes, not a deviation from an independent market price. Neither observation establishes an abnormal quote or deliberate price influence. This position illustrates the recorded settlement rules; ordinary leveraged trading remains a sufficient explanation for this example.

Figure 2 — Step 2: rendered local view of preserved historical dRPC traces, including position 72098's opening and close. Close BBO frame [0,0,0,2,0,0]; block 48,202,386, receipt log 10. This establishes quote consumption. It does not establish an abnormal quote or deliberate price influence.

This is where the price input becomes a payout. Prices use $0.01 quote units, so the integer-rounded deadband is floor(250645 / 50000) = 5 units, or $0.05. The remaining favorable move is: Using the documented ETH parameters, the profit scale is: The resulting calculation matches the recorded settlement. Values below are rounded to six decimals; intermediate calculations retain full precision.

Figure 3 — Step 2: explorer capture of the closing receipt, block 48,202,386, log 10. Event values match the account records and payout calculation; displayed amounts are rounded to six decimals.

The fixed 100,000 USDC reference notional in term2 is the critical size relationship: actual position size does not enter the scale calculation. At these same prices and parameters, a hypothetical $500,000 position would produce 661.241720 USDC after the fee. The recorded $10 million position produces 20× the gain, while the impact haircut remains 22.243992% in both cases.

Thus, a $4.40 price change produced a 13,224.834407 USDC gain on the recorded position. The account had no ETH fill within five seconds of this close, so this example establishes settlement behavior without identifying a corresponding manipulation trade.

3. External trading and repeated settlements

Between 22:01:00 and 22:03:00, the same account executed 597 ETH fills on Hyperliquid, buying 6,058.1450 ETH and selling 383.0414 ETH. Its broader collected history contains 10,427 ETH fills and approximately $231.84 million of ETH turnover.

The PaperTrade history contains 337 settled ETH positions, including 296 profitable closes. Winning positions span six notional sizes from $500,000 to $10 million; aggregate exposure comprised multiple positions.

Figure 4 — Step 3: local aggregation of Hyperliquid fill records and PaperTrade settlement checks. The sample retains native trade IDs.

Across 296 profitable closes, 62 were within one second of a same-account ETH fill: 52 overlap maker fills only, and 10 include taker fills. The latter occur in three settlement transactions across two seconds. For example, position 69035 closed a short at $2,505.85 while nearby taker sells executed at$2,505.80. By comparison, position 71121 overlaps ten maker buys.

The recovered trace for position 69035’s transaction reads $2,505.80 / $2,505.90, returning the recorded $2,505.85 midpoint. Position 71121’s transaction similarly reads $2,509.70 / $2,509.80 and returns $2,509.75. The actual quote inputs are now established for these transactions.

These matches do not establish that either quote was distorted. Testing deliberate price influence requires ordered market-wide quotes, orders and cancellations, together with a contemporaneous independent price reference; timestamp overlap alone is insufficient.

4. Cash out

Across the collected window, five Exchange withdrawals match successful receipts and HyperCore USDC credits:

Figure 5 — Step 4: local view of the largest withdrawal, block 48,203,557, log 17, and its matching HyperCore credit.

Deposits totaled 1,200,100.502854 USDC, including redeposits. Subtracting these from withdrawals gives a 1,279,106.191184 USDC net outflow to the account. Gross withdrawals include returned principal and reused funds. This account total does not measure aggregate LP loss or profit after costs on other venues.

Vulnerability

1. BBO midpoint without independent price validation

The decoded PriceOracle branch rejects zero prices and crossed quotes, then returns the instantaneous midpoint. It contains no averaging or independent price-deviation check. These checks validate the quotes without measuring the liquidity supporting the synthetic exposure.

Figure 6 — Collected oracle disassembly: BBO read at PC 0x08f5; midpoint arithmetic at 0x01ea–0x01f6. The archive runtime at block 48,202,386 matches this disassembly; historical call traces independently establish the BBO read and midpoint return. Original Solidity/build remains unverified.

2. Haircut percentage independent of position size

The asymmetric-impact formula substitutes a fixed referenceNotional for actual position size. Dollar payouts therefore grow with exposure while the haircut percentage remains unchanged. Across six position sizes, all 296 profitable closes match the documented curve within 0.000000001 USDC.

Figure 7 — Official haircut documentation, captured 19 October, showing the fixed reference notional. Documentation, not verified incident-deployed Solidity.

Response and Recovery

In its 11 October statement, PaperTrade acknowledged overnight BTC/ETH BBO manipulation attempts. It attributed their feasibility to permissive launch open-interest caps and said it had begun tightening limits onchain and at the relayer.

PaperTrade also said a winning user returned almost all profits through new accounts. The examined account recorded 30 later liquidations losing 450,000 USDC, already included in the net-withdrawal total. The cap changes and recovery through other accounts were not independently verified.