Author: L2Beat

Translated by: Deep Tide TechFlow

Deep Tide Introduction: Two platforms both claim to be decentralized exchanges, but the underlying design determines whether your money can truly be in your hands. Lighter locks the operator's ability to tamper with funds and orders through Ethereum's validity proof, while Hyperliquid relies on governance by 28 validators—The JELLY incident has already proven that they would change the rules to save their own treasury. This breakdown tells you which promises are cryptographic guarantees and which are just verbal checks of "we don't do evil".

Decentralized exchanges (DEX) for perpetual contracts differ from centralized exchanges (CEX) like Binance or Bybit in two aspects. First is custody rights: Contract DEX allows users to retain ownership of their collateral instead of surrendering funds for an IOU from the exchange. Second is verifiability: Order execution and position management can be transparent and verifiable.

Perpetual contracts (and other leveraged products) require a trading engine capable of actively managing user positions for liquidation. To this end, contract DEX use position management mechanisms—such as automatic liquidation (ADL) algorithms—whose verifiability is crucial, as these mechanisms grant the exchange the power to close and reduce positions while directly opposing the exchange's solvency with user profits.

A comparison of the leading contract DEX—Hyperliquid and Lighter—can be divided into three categories:

Ownership rights—Can the operator use your collateral or prevent you from withdrawing?

Order fairness—Can the operator see, rearrange, front-run, censor, or squeeze your submitted orders?

Position fairness—Who decides when and how to liquidate you and which counterparty takes on your position?

Comparison of Lighter and Hyperliquid Architectures

The clear architectural difference between Hyperliquid and Lighter is that the former is an independent L1 chain, while the latter is an Ethereum L2. The main consequence is that the Hyperliquid validator set is the exchange operator, and transaction settlement occurs on the same chain controlled by the operator. Lighter, on the other hand, completes settlements by submitting validity proofs to Ethereum, which is a chain that the Lighter operators cannot control. In theory, settling on Ethereum is a structural advantage. Ethereum is the most decentralized and extensively battle-tested chain, currently boasting about 800,000 validators and $50 billion in economic security. Hyperliquid's validator set consists of 28 operators, and the foundation directly controls about 50% of the staked amount, plus delegated staking obtained through a delegation program. This small group of validators can change the outcomes of trading, liquidation, and settlement through ordinary governance—they did so during the JELLY incident in 2025, when they delisted a manipulated market and forcibly settled at a price of their choosing to save the HL treasury from a loss of around $13 million.

While the collateral and exit path of Lighter exists on Ethereum, the Lighter operators can effectively do the same thing. Currently, the Lighter team can still upgrade contracts without delay, including proof validators. It can be said that the main difference lies in where the trust limit is, as Lighter's L2 design can ultimately—once sufficiently mature—satisfy Stage 2 decentralization standards by relinquishing upgrade control, thereby inheriting complete Ethereum security.

Considering that both projects have similar governance risks, evaluations of the two projects are based on current architectural designs and contract deployments.

Ownership Rights

During normal operation, Lighter's validity proofs are regularly verified on Ethereum, which means the circuit can enforce:

The operator cannot steal idle USD or execute unauthorized orders—state transitions require valid signed transactions.

The operator cannot mint USDC—each batch's total balance accounting must be reconciled among all accounts. Additionally, closing positions cannot create value; every profit has a corresponding loss.

The operator cannot retroactively modify account states. State roots are submitted sequentially, and modifying old states will lead to verification failure.

On Hyperliquid, these properties are not enforced by cryptographic proofs but rather by validator consensus. Validators can collectively vote to change state outcomes.

If the exchange fails or ceases operations, Lighter's emergency exit function allows users to withdraw funds from the exchange and transfer them back to their wallets through the Ethereum bridge. This can be achieved by users independently generating their account proofs and verifying against the latest L2 state root posted on Ethereum. Hyperliquid cannot implement this feature. Hyperliquid's main bridge on Arbitrum does not use a proof system, and withdrawals are backed by a permissioned subset of 8 validators (2 groups of 4 validators). Other bridges are also externally verified, meaning that if the operator stops fulfilling its duties, there is no unpermissioned way to exit user funds.

Order Fairness

Neither platform provides guarantees of order flow fairness, so standard order flow attacks apply, such as front-running, squeezing, censoring, last-look, and stop-loss hunting. However, Lighter's validity proofs guarantee the integrity of orders after submission. In particular, the operator cannot modify the order price or size, nor can they match at incorrect prices. The order book enforces price-time priority within the matching algorithm, meaning that matching at prices worse than the user's limit price will result in proof failure. Furthermore, the matching circuit proves that the counterparty for order transactions is the highest priority order on the opposite side. This fairness algorithm is undermined by the control the aforementioned operators have over inputs, for instance, the operator can insert their orders to become the best bid offer.

Position Fairness

Liquidation has three dials: when (timing), at what price (mark price), and who takes on the counterparty (counterparty selection). On both platforms, the operators control all three dials. However, on Lighter, the proofs set some boundaries on what can be done to solvent accounts.

Starting with how users can get screwed:

Mark price/oracle manipulation. Liquidation and unrealized P&L are based on mark prices, which come from oracle data sources. Oracle signatures are currently not verified on-chain or in proofs, exposing users to oracle attacks, such as position liquidations due to surging mark prices, as well as funding rate manipulation transferring value from longs to shorts (and vice versa). When desert (escape) mode is activated, users also face the risk of settling at unfavorable prices. Open positions cash settle at the last published mark price; thus if the operator can choose when to stop operations, they can opt to stop at an unfavorable mark price for active position holders.

Timeliness of position management. Even without manipulating the price itself, the operator also controls the timing of events. For example, the operator can execute large-scale liquidations at chosen mark prices to maximize their own interests. The choice of ADL counterparty is also arbitrary. The circuit enforces that the counterparty holds the opposite direction, liquidation prices are calculated from bankrupt account states, and bankrupt accounts are indeed bankrupt. However, it does not set ordering constraints for selecting which qualified counterparty. This also means that operators can choose when to socialize losses, and when to backstop through insurance funds.

Therefore, on Lighter, the operator can liquidate you at their chosen moment and mark price but cannot liquidate truly solvent accounts under the committed mark price, cannot fabricate liquidation prices, and cannot reduce positions beyond the bankruptcy size.

On Hyperliquid, there are no validity proof constraints on reductions: HLP automatically inherits bankrupt positions; thus, liquidity pools are designed to be the counterparty. During the JELLY incident, HLP became insolvent, and validators directly voted to delist markets and forcibly settle each open position at their chosen prices. So what Lighter sets as boundaries in the proof circuit, Hyperliquid leaves to governance, which can even rewrite the settlements of already liquidated positions after the fact.

Summary Evaluation