The Danger Zone

You should never need this page. But the Danger Zone holds the levers that recover funds when something has gone wrong, and each one states plainly what it does and whether it can be walked back. They sort into four severities.

Reversible

Everything here can be undone.

• Pause deposits blocks new deposits only — withdrawals keep working. A guardian pauser can pause independently of you; only you can unpause.
• Withdraw from perps moves free perp-balance USDC back to Core spot. This is routine, not an emergency: builder-dex defunds land on the perp ledger, so moving that margin to spot is the normal step home before bridging to the reserve. It works while paused.
• Force-resolve stuck bridge clears the in-flight accounting flags after a bridge has been wedged for at least an hour. It moves no funds and reverts while a bridge is still legitimately settling.

Key-compromise recovery

Two levers exist only for a specific failure: a misused agent key. The vault itself can never open these positions — the agent is order-only — so in normal operation both are safe no-ops.

• Borrow-lend drain withdraws the vault's entire lending-pool supply (HyperCore borrow-lend) back to free Core spot. It never supplies or borrows.
• HL native-vault withdraw pulls a parked Hyperliquid native-vault position back to the vault's own Core account. Proceeds credit the perp balance — move perp→spot, then bridge home. It reverts while HL's deposit lockup is still live.

Irreversible

These cannot be undone. Read before firing.

• Close vault freezes the redemption price from EVM-liquid USDC and enters redemption-only mode forever. It gates on a live checklist — perps flat, spot sold, Core USDC bridged home, no in-flight bridge, the queue drained — that mirrors the contract's own close precondition. Empty HyperCore first.
• Trigger emergency is not a pause. It permanently latches the vault into status 2, where trading stops and investors move to pro-rata claims on recovered funds. It's a permissionless dead-man switch: once the oldest queued withdrawal exceeds the queue timeout, anyone can fire it — which is the real reason to service the queue.

The egress walk

Terminal emergency is designed to recover funds without a manager. In status 2 a fixed chain of permissionless steps, all pinned to the vault's own accounts, walks money home: 0 force the account to standard mode → 1 repatriate builder-dex collateral to the native dex → 2 move free perp margin to spot → 3 bridge all spot USDC to the EVM vault (this step needs Core HYPE for gas). Investors then claim their pro-rata share.

A companion emergency close ticket, also status-2-only, flattens an open position with a reduce-only order straight through CoreWriter — no agent required. Send the opposite side of the position at a crossable limit price.

In the cockpit: Manage → Danger Zone groups every lever above under these same headings, with the close checklist and the egress steps laid out in order.