Risks

Depositing HYPE into Ocean Reserve can lose you money. This page lists the ways, in rough order of how much they matter. It is not exhaustive.

Custody

Delegated HYPE sits in the Ocean Reserve delegation account on Hyperliquid, controlled by the Operator, a 4-of-7 multisig. If enough signers act maliciously, are coerced, or lose control of their keys, the HYPE in that account can be moved, and no contract on Elysium can recover it. This is the largest single risk in the protocol. The security model describes exactly what the Operator can and cannot do.

Smart contracts

The OCEAN, Vault, Distributor and Governor contracts can contain bugs. Because they are not upgradeable, a bug cannot be patched in place; the response to a serious bug is to pause deposits and migrate to new contracts through governance. Until an audit report is linked on the security model page, treat the contracts as unaudited.

Shortfalls and the withdrawal queue

OCEAN redeems for HYPE one for one while the pool holds one HYPE per OCEAN. If the pool suffers a loss, from custody, a validator penalty, a bridge failure or a contract bug, the backing ratio falls below 1.0000 and is visible on the Pool page.

The withdrawal queue is first-in, first-out and pays one HYPE per OCEAN burned. In a shortfall, earlier requests are filled in full while later requests wait on HYPE the pool does not have. The Vault does not automatically spread a loss across all holders. How to handle a shortfall is a decision for governance.

Withdrawal timing

Withdrawals that the Vault buffer cannot cover wait for HYPE to return from Hyperliquid: a one-day delegation lockup on recent delegations, Hyperliquid's seven-day unstaking queue, and the bridge transfer back to Elysium. Large or sudden withdrawals can take longer than that if they exceed what the Operator can undelegate at once. During that time your HYPE is not earning a distribution, because your OCEAN is already burned.

OCEAN market price

OCEAN can trade below one HYPE on secondary markets, especially when the withdrawal queue is long. Selling OCEAN gives you an immediate exit at the market's price, not at the redemption rate.

Validators

Validators can underperform, raise their commission, or be jailed for unresponsiveness. A jailed validator earns no rewards for the pool until it is unjailed. Hyperliquid reserves slashing for provably malicious behaviour such as double-signing; if a validator holding the pool's stake were slashed, the pool would lose HYPE. The Vault rejects any validator set that targets more than 25% of the pool's stake to one validator, which limits but does not remove this risk.

Hyperliquid

The pool's stake depends on Hyperliquid's consensus, staking system and rules. A failure, halt or rule change on Hyperliquid affects delegation, rewards and the timing of unstaking.

Elysium

Ocean Reserve runs on Elysium and inherits its trust model: AnyTrust data availability, a single sequencer, permissioned validation at launch, and optimistic withdrawals with a challenge period, as described in Elysium's documentation. An Elysium outage, a sequencer failure or a fault in its bridge can delay or block deposits, withdrawals, claims and the movement of HYPE between the Vault and Hyperliquid.

Bridging

HYPE moves between the Vault on Elysium and the delegation account on Hyperliquid through Elysium's canonical bridge. Bridges are complex and have failed elsewhere. HYPE in transit is exposed to the bridge for as long as the transfer takes.

Operations

The Operator funds the weekly distribution and moves HYPE back for withdrawals. If it stops operating, distributions stop and queued withdrawals stop progressing, even though the HYPE remains delegated. Governance can replace the Operator, after the 48-hour timelock.

Distribution variability

The weekly distribution is staking yield plus protocol revenue. It varies from week to week, can fall, and can be zero. The distribution rate shown on the site describes the current week only and is not a forecast or a promise.

Governance

Anyone who holds enough OCEAN can propose and vote. A large holder, or a group of holders, can pass proposals that other holders oppose, including a validator set or an Operator change. The 48-hour timelock gives other holders time to exit before such a change takes effect, but only if they are watching.

Contracts holding OCEAN

OCEAN held by a contract, such as an automated market maker pool, accrues its share of the distribution to that contract's address. Unless that contract is built to claim and pass it on, the distribution stays with the contract. Depositing OCEAN into another protocol also adds that protocol's own risks.

Interface and phishing

This website is one way to use Ocean Reserve; the contracts are the protocol. Fake sites can imitate it. Check the address of every contract you interact with against the list on the Pool page, and never share a seed phrase or private key with anyone.

Legal and tax

The legal and tax treatment of staking, liquid staking tokens and distributions differs by country and can change. You are responsible for the rules that apply to you.