> For the complete documentation index, see [llms.txt](https://docs.valantis.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.valantis.xyz/prime/developers/staking-discounts-risk-matrix.md). # Staking Discounts Risk Matrix ## Operating States Control Matrix `SHUTDOWN_NOTICE` keeps the same live trading permissions as `ACTIVE`, so the matrix below focuses on the steady-state `ACTIVE` split and the combined rights of the stHYPE protocol during the `SHUTDOWN` cycle. #### `ACTIVE` Trading Phase **Trader Controls** via CoreWriter. | Action | What the Trader controls | | ----------------------- | --------------------------------------------------------- | | `ADD_API_WALLET` | Add or replace trading API wallets | | `BRIDGE_TO_CORE` | Move assets from HyperEVM into HyperCore | | `BRIDGE_TO_EVM` | Move assets from HyperCore back to HyperEVM | | `BRIDGE_PERPS_SPOT` | Move balances between perps and spot | | `CANCEL_ORDER_BY_CLOID` | Cancel orders by client order id | | `CANCEL_ORDER_BY_OID` | Cancel orders by exchange order id | | `PLACE_LIMIT_ORDER` | Submit limit orders | | `SEND_ASSET` | Move assets across supported HyperCore balance buckets | | `VAULT_TRANSFER` | Deposit to or withdraw from supported vaults | | `BORROW_LEND` | Run supported borrow/lend supply or withdraw actions | | `SEND_TO_ACCOUNT` | Withdraw assets back to the parent Valantis Prime Account | Deposit/Withdraw from core workflows can either be managed through the [Valantis Prime Account](/prime/developers/account.md) or through Transfers to/from an external HyperCore funding address. **stHYPE controls** | Action | What stHYPE controls | | ----------------------- | ----------------------------------------------------- | | `updateStakeDelegation` | Delegate or undelegate the managed staking balance | | `approveBuilderFee` | Approve builder-code fee settings for the sub-account | | `startShutdownNotice` | Start the timed shutdown path if commercial terms end | During `SHUTDOWN_NOTICE`, the Trader keeps the same onchain action set as `ACTIVE`. stHYPE additionally gains `cancelShutdownNotice` and `beginShutdownUnwind` once the notice maturity and guard delay are satisfied. #### `SHUTDOWN`: stHYPE controls Controls are only changed after time lock passes, and stHYPE calls `beginShutdownUnwind`. Here, the Trader loses access to all HyperCore functions- only retaining access to EVM balances accessible through their Valantis Prime Account. These are the controls that stHYPE has over the HyperCore account after shutdown has begun. | Action | What stHYPE controls | | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `updateStakeDelegation` | Undelegate from validators only | | `delistApiWallet` | Remove previously listed external API wallets | | `attestApiWalletsCleared` | Attest that external API wallets have been cleared | | `installTrustedApiWallet` | Install a trusted cleanup wallet for controlled closeout. Primarily to remove DEX Abstraction. | | `removeTrustedApiWallet` | Remove the trusted cleanup wallet | | `withdrawStake` | Withdraw matured stake back into spot HYPE | | `recallHype` | Recall LST-managed HYPE from the Trader's account. Only the HYPE staking balance at the start of unwind can be withdrawn by the LST. This ensures potentially left-over balances are returned to the trader after `finalizeDetach` | | `finalizeDetach` | Detach management and return the account to normal ownership | ## Main Risks and Trust Assumptions #### Wind down is a real control right for the LST Under a closure of the relationship, stHYPE can start the managed exit path after the configured time locks. A trader integrating this model should explicitly underwrite the risk that access can be removed during wind down. The trader should understand when stHYPE will issue a wind down notice, how to measure/verify if and when an account will enter unstaking, and how to operationally clean up an account during notice period to prevent losing temporary access to funds. #### Shutdown takes at least seven days Wind down is not immediate. Undelegation timing, staking withdrawals, API-wallet cleanup, and HyperCore mechanics all affect how long it takes to fully recover the managed HYPE and detach the manager. Shutdown takes at least seven days. It is expected to complete within seven to eight days, but there is no guaranteed maximum duration. Close positions, cancel open orders, and withdraw trading balances during the notice period to avoid leaving them inaccessible during shutdown. After wind-down completes, the same HyperCore address returns to the trader’s control and the restrictions imposed by the stHYPE management relationship are removed. The trader retains ownership throughout the lifecycle. #### During Shutdown stHYPE cannot Withdraw Trader's Balances It is advised that Traders do not leave balances or positions open once shut down is initiated. They will become inaccessible for a minimum of 7-days during the shutdown lifecycle. Although, `recall` by stHYPE only pulls HYPE at the measured staking balance at the start of shutdown. This protects against over-reaching into balances that should not be treated as managed staking capital. These balances left by the trader will be returned to the trader after the shutdown is complete. Open positions MAY be closed if they put the recalled staked HYPE at risk of cross-margin liquidation as it transits through the spot balance temporarily. stHYPE cleanup process prioritizes isolating the risk of the spot balance being subject to liquidation risk during the unstaking process. In the future, stHYPE operators may expose an API which can process withdrawals/trades on behalf of the user during the shutdown process, but currently the expectation is the account is inaccessible. ## What to Monitor Monitoring should be run on the trader's side to ensure they cannot lose access to account functions unexpectedly. The system is designed to be transparent and measurable on-chain without trust in LST off-chain infrastructure as a counter party. #### Read functions to monitor shutdown risk **How healthy is the active account (has shutdown`Notice` been issued)** * `getManagedAccountInfo(...)`: current lifecycle state, notice timing, managed principal, and recall target * `canBeginShutdownUnwind(...)`: If this returns `true`, the notice period and guard delay have elapsed and shutdown can begin. The trader loses HyperCore access when `beginShutdownUnwind` is called; no additional notice period is required. **How Soon will the Account be returned (`Shutdown` status checks)** * `getShutdownUnwindStatus(...)`: How close is the account to being returned during shutdown. Whether API-wallet cleanup is attested, whether a trusted shutdown wallet is active, and whether flatness is attested. * `canEnterShutdownExecution(...)`: whether execution entry conditions tracked on-chain are satisfied