HyperCore auditing checklist 🧵 markPx() vs oraclePx() vs spotPx() — don’t mix them up These are three distinct price sources: markPx: used for PnL, margin, and liquidations (risk engine price) oraclePx: external/index price used in funding as input to mark price spotPx: spot market last traded price (spot-only) Key point: they are not interchangeable, and using the wrong one in risk or collateral logic leads to incorrect results. // ❌ Wrong uint64 px = spotPx(perpIndex); // ✅ Correct uint64 mark = markPx(perpIndex); // perp risk / liquidation uint64 oracle = oraclePx(perpIndex); // funding index reference uint64 spot = spotPx(spotIndex); // spot markets only ⚠️ Common mistake: assuming markPx == oraclePx they can diverge during volatility because mark is derived from oracle market state.

If you want to understand Hyperliquid (HyperCore HyperEVM), this video by @0xjuaan is 🔥 Also, his hyper-evm-lib makes things much easier to work with. Really enjoyed diving into it. youtube.com/watch?v=ZESEkAKi…

Thanks @MitchellAmador and @Ehsan1579 for such a great video. Honestly, I really enjoyed watching this , a lot of valuable insights throughout 👏

HyperCore auditing checklist 🧵 tokenInfo().evmExtraWeiDecimals — Can be NEGATIVE evmExtraWeiDecimals is an int8, not a uint. A negative value (e.g. -2) means the EVM amount has fewer decimals than the spot amount. Incorrectly assuming it is always positive can cause conversion logic to break by powers of 10, leading to incorrect accounting, pricing, or settlement calculations. // ❌ Wrong — breaks if value is negative uint64 evmAmt = spotAmt * (10 ** ti.evmExtraWeiDecimals); // ✅ Correct int8 extra = ti.evmExtraWeiDecimals; if (extra >= 0) { evmAmt = spotAmt * uint64(10 ** uint8(extra)); } else { evmAmt = spotAmt / uint64(10 ** uint8(-extra)); }

Eid Mubarak 😊

If you find these HyperCore auditing checklists helpful, a retweet would be appreciated 🤝 HyperCore auditing checklist 🧵 position().szi — Negative value means SHORT position: szi is an int64, not a uint64. A negative value represents a short position. Casting it directly to uint64 can silently wrap into a massive positive value and completely break accounting or risk logic. // ❌ Wrong — wraps if the position is short uint64 size = uint64(pos.szi); // ✅ Correct bool isShort = pos.szi < 0; uint64 size = uint64(pos.szi < 0 ? -pos.szi : pos.szi); // remaining logic

Also worth mentioning — an excellent article by @chase_manning_ that breaks everything down very clearly. Highly recommended. x.com/chase_manning_/status/…

In audits, verifying fixes is critical work. It carries real responsibility — sometimes even more than finding the original bug.

No response from the protocol team till now🧐

Made the most of the weekend alongside my work, I discovered a bug in a protocol with ~$38M TVL that’s integrated by several other protocols. Since they don't have bug bounty program on Immunefi or elsewhere, I submitted the report via email. Let’s see what happens.