Papertrade Says It Is Restricting Exposure After Manipulation Claims

Papertrade says it is restricting exposure both onchain and through relayers. The claim, reported by The Defiant, lands after allegations that two wallets moved the price Papertrade's own contracts use to open and close trades. Its statement does not confirm claims that a trader was blacklisted or prevented from closing positions.

That is roughly where the public record stops. Which markets are affected, what size the new cap is and when it takes effect are not stated on any page that could be opened. Papertrade's own site did not resolve, so the change can't be checked inside the product.

What the Contracts Read

Papertrade's documentation says its smart contracts read the midpoint between Hyperliquid's best bid and best offer, the BBO, through a HyperCore precompile. They read it once when a position opens and again when it closes, and that midpoint fixes both prices. One number, in other words, prices every position on the venue.

It's a little like settling a bet at the midpoint of someone else's order book, when anyone can post an order there without ever filling it. Papertrade's docs name that exact scenario as the main unresolved protocol-level risk: an attacker places a small limit order inside Hyperliquid's natural spread, shifting the midpoint.

The pricing pipeline has no independent reference price that could reject a manipulated quote. Open-interest caps and an asymmetric haircut on profits cut what an attacker could collect, but the documentation says manipulation and losses for liquidity providers stay possible.

Where the Payout Money Comes From

The pool that pays winners starts at zero and grows as traders realize losses, according to Papertrade's launch documentation. A platform administrator, @izebel_eth, has explained that collateral does not enter the house pool, only losses do.

When the pool lacks enough USDC to settle a winning close, the protocol pays out first-in, first-out, and the unpaid profit becomes an on-chain debt claim. If the balance falls below $2 million, the protocol issues 100 PAPER for every $1 lost. Winners pay a 2% fee on gains after the impact haircut, and the venue charges no funding cost.

The Limits and the Relayers

At launch, Papertrade routed transactions through its frontend and whitelisted relayers. The contract did not accept direct public interaction during phase one. The relayer's intent system ranks activity by transaction type and notional value, with liquidations ahead of position opens, so restricting exposure through relayers fits the design the team already described. Whether the whitelist or that ranking has changed is not public.

The launch rules cap a single position at $10 million, allow a user to hold several positions, and set $1 billion of short-term opening headroom per market and direction. Leverage runs up to 1,000 times on supported markets including Bitcoin and Ethereum. Any of those numbers could be the one being tightened.

The Allegations

On Oct. 11, a user called Boblob alleged that two wallet addresses were exploiting Papertrade through price manipulation and said the activity exposed a potential protocol vulnerability. The addresses allegedly traded about $20 million per transaction on Hyperliquid, moved Ether by roughly 10 to 20 basis points, then opened Papertrade longs worth hundreds of millions of dollars.

Ten to 20 basis points is 0.1% to 0.2%. A crypto trader, Rune, separately flagged a protocol-level pricing vulnerability in Papertrade's documentation, saying attackers could manipulate Hyperliquid's best bid and offer to move Ether prices. The allegation remains unconfirmed. The Defiant's earlier story on the episode also said the cited wallet showed about $1.73 million in realized trading gains on PaperDash.

The Question Behind the $3.14 Million Figure

The Defiant's earlier Papertrade story carried $3.14 million in its headline as the size of the house pool. That figure sits in the headline: it could not be read in the article's body, on Papertrade's site or on an explorer page.

DefiLlama recorded $137.1 million in total value locked at 10:08 a.m. ET, a figure its methodology builds from customers' trading balances plus the protocol-owned pool that takes the other side of positions. That is not the same as a reserve set aside only for paying winners, which is the pool the $3.14 million figure points at. Whether that pool sits near $3.14 million now, or ever did, could not be established, and neither could whether unpaid profits have accumulated there.

What Is Not Public Yet

• The specific limits: which markets, what size, what cap and from when.
• Whether the change is live and verifiable in the product.
• Whether a trader was blacklisted or blocked from closing positions. The statement does not confirm either claim.
• Any verified loss figure, compensation arrangement or timetable for changing the BBO-based pricing.
• Whether queued payouts or PAPER issuance followed the alleged trades.

The clearest things to watch are the pool balance against the $2 million line, and the relayer itself. A change to the whitelist or to the intent ranking is where a new exposure limit would show up first.