Lighter vs. Hyperliquid: Capital, Orders, and Positions, Whose Design Is Superior?

Author: L2Beat

Translation: TechFlow

TechFlow Editor's Note: Both claim to be decentralized perpetual exchanges, but underlying design determines whether you can truly hold your money. Lighter locks down the operator's permission to tamper with funds and orders through Ethereum validity proofs, while Hyperliquid relies on governance by 28 validators voting—the JELLY incident has already proven they will change rules to save their own treasury. This breakdown tells you which promises are cryptographically guaranteed and which are just verbal checks of "we won't do evil".

The difference between perpetual decentralized exchanges (DEX) and centralized exchanges (CEX) like Binance or Bybit is reflected in two aspects. First is custody rights: perpetual DEXs allow users to retain ownership of collateral, rather than handing over funds in exchange for IOUs from the exchange. Second is verifiability: order execution and position management can both be transparent and verifiable.

Perpetual contracts (and other leveraged products) require the trading engine to be able to actively manage user positions to execute liquidations. To this end, perpetual DEXs adopt position management mechanisms—such as automatic deleveraging (ADL) algorithms—where verifiability is crucial, because these mechanisms empower the exchange to close and reduce positions, while directly opposing the exchange's solvency with user profits.

The comparison of leading perpetual DEXs—Hyperliquid and Lighter—can be divided into three categories:

Property Rights—Can the operator use your collateral, or prevent you from withdrawing?

Order Fairness—Can the operator see, reorder, front-run, censor, or sandwich the orders you submit?

Position Fairness—Who decides when and how to liquidate you, and which counterparty takes over your position?

Architectural Comparison of Lighter and Hyperliquid

The clear architectural difference between Hyperliquid and Lighter is that the former is an independent L1 chain, while the latter is an Ethereum L2. The main consequence is that the Hyperliquid validator set is the exchange operator, and trade settlement occurs on the same chain controlled by the operator. Lighter completes settlement by submitting validity proofs to Ethereum, whereas Ethereum is a chain that Lighter operators cannot control. Theoretically, settling on Ethereum is a structural advantage. Ethereum is the most decentralized and battle-tested chain, currently possessing approximately 800,000 validators and $50 billion in economic security. The Hyperliquid validator set consists of 28 operators, with the foundation directly controlling about 50% of the staked amount, plus delegated stake obtained through delegation programs. This small group of validators can change the results of trading, liquidation, and settlement through ordinary governance—they have already done so during the 2025 JELLY incident, when they delisted a manipulated market and force-settled at prices of their own choosing to save the HL treasury from a loss of about $13 million.

Although Lighter's collateral and exit paths exist on Ethereum, Lighter's operators can actually do the same thing. Currently, the Lighter team can still upgrade contracts, including the proof verifier, without delay. It can be said that the main difference lies in where the trust ceiling is, because Lighter's L2 design can eventually—once mature enough—meet Stage 2 decentralization standards by relinquishing upgrade control, thereby inheriting full Ethereum security.

Given that the governance risks of the two projects are comparable, both projects are evaluated based on current architectural design and contract deployment.

Property Rights

During normal operations, Lighter's validity proofs are verified on Ethereum regularly, which means the circuit can enforce:

Operators cannot steal idle USD or execute unauthorized orders—state transitions require valid signed transactions.

Operators cannot mint USDC—the total balance accounting for each batch must reconcile across all accounts. Additionally, closing positions cannot create value; every profit has a corresponding loss.

Operators cannot retroactively modify account states. State roots are submitted in order; modifying old states causes verification failure.

On Hyperliquid, these attributes are not enforced by cryptographic proofs, but by validator consensus. Validators voting together can change state results.

If the exchange fails or stops operations, Lighter's emergency exit function allows users to withdraw funds from the exchange and transfer them back to wallets via the Ethereum bridge. This can be achieved by users independently generating their account proofs and verifying them against the latest L2 state root published on Ethereum. Hyperliquid cannot achieve this function. Hyperliquid's main bridge on Arbitrum does not use a proof system; withdrawals are secured externally by a permissioned validator subset consisting of a total of 8 validators (2 groups of 4 validators each). Other bridges are also externally verified, meaning if operators stop performing duties, there is no permissionless way to exit user funds.

Order Fairness

Neither platform provides order flow fairness guarantees, so standard order flow attacks apply, such as front-running, sandwich attacks, censorship, last look, stop-loss hunting, etc. However, Lighter's validity proofs guarantee integrity after order submission. Specifically, operators cannot modify order prices or sizes, nor match at incorrect prices. The order book enforces price-time priority within the matching algorithm, meaning matching at a price worse than the user's limit price causes validity proof failure. Additionally, the matching circuit proves that the counterparty for order transactions is the highest priority limit order on the opposite side. This fair algorithm guarantee is weakened by the aforementioned operator control over inputs, for example, operators can insert their own orders to become the best limit order quote.

Position Fairness

Liquidation has three knobs: when (timing), at what price (mark price), and who takes the counterparty (counterparty selection). On both platforms, operators control all three knobs. However, on Lighter, proofs set some boundaries on what can be done to solvent accounts.

Starting with how users get screwed:

Mark price/oracle manipulation. Liquidations and unrealized PnL are based on mark price, which originates from oracle data sources. Oracle signatures are currently not verified on-chain or in proofs, exposing users to oracle attacks, such as position liquidations due to mark price spikes, and funding rate manipulation transferring value from longs to shorts (and vice versa). When desert (escape) mode is activated, users also face the risk of settlement at unfavorable prices. Open positions are cash settled at the last published mark price, so if operators can choose when to stop operations, they can choose to stop at a mark price unfavorable to active position holders.

Position management timing. Even without manipulating the price itself, operators control the timing of events. For example, operators can execute large-scale liquidations at selected mark prices to maximize their own interests. ADL counterparty selection is also arbitrary. The circuit enforces that the counterparty holds the opposite direction, the deleveraging price is calculated from the bankrupt account state, and the bankrupt account is indeed bankrupt. But it sets no ordering constraints on which eligible counterparty is selected. This also means operators can choose when to socialize losses and when to backstop via the insurance fund.

Therefore, on Lighter, operators can liquidate you at the moment and mark price of their choice, but cannot liquidate accounts that are truly solvent at the committed mark price, cannot fabricate liquidation prices, nor deleverage beyond the bankruptcy amount.

On Hyperliquid, there are no validity proof constraints on deleveraging: HLP automatically inherits bankrupt positions, so the liquidity pool is the counterparty by design. During the JELLY incident, HLP became insolvent, and validators voted directly to delist the market and force settle every open position at prices of their choosing. So what Lighter sets boundaries on in the proof circuit, Hyperliquid leaves to governance, which can even rewrite the settlement of liquidated positions after the fact.

Summary Evaluation