Risk controls beyond diversification

What diversification actually removes, and what it leaves

Diversification is well understood in principle and routinely oversold in practice. Splitting capital across ten leaders instead of one removes idiosyncratic risk: the risk that is specific to a single trader's judgement, sizing habits, chosen market or decision to stop trading. That is a real and large improvement over single-trader copying, and it is the first thing any serious system should do.

It does nothing whatsoever about the risk that all ten leaders share. If every leader in the basket is running directional perpetual futures on the same venue, they are all exposed to the same funding regime, the same liquidity conditions and the same deleveraging cascades. Averaging across ten expressions of correlated exposure produces a smoother version of the same exposure, not a different one.

So the useful question is not whether the system is diversified. It is what the other layers are, and which specific failure each of them contains.

Correlation: ten leaders, one market

Correlation between leaders is not constant. In ordinary conditions a momentum trader, a mean-reversion trader and a funding-carry trader produce fairly independent return streams, and the basket behaves the way diversification advertises. In a stress event they converge, because everyone is trading the same order books against the same liquidations at the same time.

This is the single most important thing to understand about the risk profile: correlation rises precisely when you need it to be low. A basket does not fail gradually and independently across ten sleeves; if it fails badly, it is likely to fail in most sleeves at once. No allocation scheme fixes that, because it is a property of the asset class and the venue rather than of the selection.

Layer 1 — sub-account isolation as a margin firewall

Each mirrored leader trades in its own Hyperliquid sub-account with its own margin. The purpose is containment on two axes. First, positions cannot net: one leader's long and another's short in the same market coexist rather than cancelling. Second, and less often discussed, margin is scoped: a liquidation in one sleeve consumes that sleeve's margin and stops there.

In a single-account setup, a leader who takes an oversized position degrades the margin available to every other strategy in the account, so one trader's risk decision silently becomes everyone's constraint. Isolation removes that channel.

What it does not do is prevent the liquidation. If a sleeve is liquidated, that sleeve's capital is gone. Containment is not protection, and describing it as protection would be dishonest.

Layer 2 — per-sleeve weight caps and target allocation

Capital is allocated in proportion to composite score, which means the highest-scoring leader receives the largest sleeve. Left unbounded, that logic concentrates: if one leader's score is far above the rest, score-proportional weighting would hand them a majority of the book and quietly undo the diversification.

Target weights therefore function as a cap as much as an allocation. The relevant control is not the weighting formula on a normal day but the bound on how large any single sleeve can become on an abnormal one.

The cost of capping is that you underweight your best leader by construction. That is the correct trade when you cannot distinguish a genuinely superior leader from a lucky one with high confidence, which on any realistic sample size you cannot.

Layer 3 — probation and removal as a slow control

Scores are recomputed as closed trades arrive, and sustained deterioration moves a leader to probation and then out of the basket. This is a control, but a slow one, and it is worth being precise about what kind of protection it offers.

Rule-based removal acts on evidence, and evidence accumulates after the loss that produced it. It cannot prevent the drawdown that triggers it; it prevents the continuation of exposure to a leader whose record no longer supports the allocation. That is genuinely valuable over months and close to useless over a single bad afternoon.

The counterpart is emergency removal on hard risk breaches, which acts immediately. That is faster but blunter, and it fires in the conditions where execution is worst.

Layer 4 — volume-gated mode as a sizing control

Full diversification unlocks at $100,000 of mirrored volume; below that, Starter Mode mirrors a single leader. It is usually presented as a product tier, but structurally it is a sizing control.

A small account cannot meaningfully run ten sleeves. Minimum order sizes and per-sleeve margin requirements mean that dividing modest capital ten ways produces sleeves too small to track their leader, so you pay full turnover costs for exposure that does not resemble the model. Gating the ten-sleeve configuration behind demonstrated volume prevents a structurally broken allocation from being available by default.

The honest reading is that Starter Mode is the concentrated configuration, and anyone running it should understand that they are exposed to one leader with all the single-trader risks that implies.

Layer 5 — permission scope

The agent approval grants trade-only rights. It can place and cancel orders in your account and it cannot withdraw, transfer to an external address, or move funds out of your control. The builder fee is separately approved with a maximum rate that you set at approval time.

This layer addresses a category of risk that has nothing to do with markets: operator failure. If our infrastructure is compromised, the worst available action is unwanted trading, not theft. That is a materially different worst case from a platform that custodies deposits or holds withdrawal-enabled API keys.

It is also the layer with the cleanest boundary, because it is enforced by the protocol rather than by our policy.

Layer 6 — funding location and the readiness gate

Capital has to be in the Perps balance to be usable as margin. Funds sitting in Spot or unified balances are not available to the sleeves, and an account can look funded while being unable to trade.

The readiness check exists to catch this before autopilot starts rather than after: it reports Perps balance, minimum requirements, agent approval and builder-fee approval, and it blocks the start action while any of those is unmet. It is a detect-only check that never moves anything for you.

This is a small control that prevents a disproportionate number of real problems, most of which present as 'the bot is not doing anything'.

Controls you hold, not the system

Three controls sit entirely with you and require no cooperation from us to exercise.

• Revoke the agent approval on Hyperliquid at any time. Mirroring stops; your positions and funds remain yours.
• Withdraw or reduce capital whenever you choose. There is no lock-up, no redemption window and no notice period.
• Set the builder-fee cap at approval. The fee cannot exceed the maximum you approved.

Failure modes none of this prevents

A risk section that only lists controls is marketing. These are the exposures that remain after every layer above is working as designed.

• Correlated market loss. All sleeves can lose together in a deleveraging event, and the basket is directional, not hedged.
• Liquidation inside a sleeve. Isolation bounds it to that sleeve's capital; it does not prevent it.
• Lagging replacement. Rule-based removal is reactive and always acts after the evidence.
• Execution risk. Mirrored fills differ from the leader's, and worst during volatility.
• Venue risk. Everything runs on Hyperliquid; protocol, oracle or liquidity failure there is not diversified away.
• Funding and cost drag. In quiet regimes, fees and funding can exceed thin trading PnL.

Conclusion: layered containment, not protection

None of these layers is a guarantee, and stacking them does not produce one. What they do is bound specific failures: isolation bounds contagion between leaders, weight caps bound concentration, probation bounds persistence of a stale selection, mode gating bounds structurally broken sizing, and permission scope bounds what an operator failure can cost you.

The residual — correlated directional exposure to leveraged perpetual futures — is the risk you are actually taking, and it is not small. Perpetual futures can lose you your entire position, and past performance says nothing reliable about future results.

The risk page states the same limits in shorter form, and the onboarding flow shows the exact permissions you are granting before you sign anything.