Perpl
The deployed Vessel contracts do not hedge on Perpl. They hedge against SimVenue SIMVENUE — SIMULATED, a simulated venue with an owner-settable funding rate, behind the IVenue interface. Perpl integration is next. Until a Vessel adapter calls the Perpl Exchange contract on a public network, every funding number the testnet shows comes from a parameter an owner set, not from a market.
Status
IN PROGRESSPerpl is live on Monad mainnet with live trading, a deployed Exchange contract, and six markets (BTC, MON, ETH, SOL, HYPE, ZEC); the Vessel adapter that would open a short there does not exist yet, as of 2026-08-29.
The grade is about Vessel's side, not Perpl's. The venue is deployed and tradable. The route from a Vessel contract to it is not.
What Vessel uses it for
Perpl is the short leg. Vessel holds spot and sells perp notional equal to that spot on a perp CLOB, so net delta stays inside the 1% band. The position is held to collect the funding rate, which the litepaper calls the market price of leverage. At launch leverage λ ≤ 2, that means roughly 66.7% of each dollar in spot, 33.3% posted as short margin, and 66.7% of notional hedged.
Everything Hull is promised and everything Ballast earns comes through this leg. Hull's rate is a contract parameter, r_H = clamp(EWMA_30d(net funding APR) × (1 − h), 0, r_cap), and the funding series that EWMA reads will be Perpl's once the adapter ships. Today it is SimVenue's.
What is actually wired today
SimVenue SIMVENUE — SIMULATED sits behind IVenue. Its funding rate is set by an owner, not by an order book. That is the whole of the hedge venue on testnet.
IVenue is the seam the Perpl adapter will fill. Conceptually it covers four things a venue must do for the engine:
- open and adjust a short position of a given notional;
- read the current mark price;
- read the current funding rate, which feeds the accrual waterfall and the Hull EWMA;
- post and withdraw margin, which the keeper uses for top-ups and de-risking.
The interface is design-stage. The public repository contains only a README and a licence, so no function signatures, parameter types, or events are published; none appear here. The exact IVenue surface, and whether the Perpl adapter will call the Exchange contract directly or route through a delegated account, is not published. UNVERIFIED — PENDING GATE-0
Interface
This is Perpl's surface, which the adapter and the keeper will consume. It is verified against Perpl's documentation and API repository; nothing in this section is Vessel code.
Public context
REST base on mainnet is https://app.perpl.xyz/api. The context endpoint needs no auth and returns the chain, instances, tokens, and markets:
curl -s https://app.perpl.xyz/api/v1/pub/context
# Context { chain, instances, tokens, markets }
Live mainnet market ids per Perpl's docs: BTC=1, MON=10, ETH=20, SOL=31, HYPE=40, ZEC=50. Read them from the endpoint rather than from this page; the endpoint is the source.
Two channels, two limits
Perpl's api-docs README, verbatim:
Trading and market data are separate servers with separate limits. Sizing a market-data client against the trading numbers will get it closed.
| Channel | Path | Rate | Cap |
|---|---|---|---|
| Trading WS | /ws/v1/trading | 120 req/min mainnet (60 testnet) | 4 connections per wallet address |
| Market-data WS | /ws/v1/market-data | 10 req/min | 16 subscriptions per connection |
The trading connection cap is keyed on the owning wallet address, not the individual API key. Four keys on one wallet share four connections. A Vessel keeper that opens a trading socket, a delegated-account operator that opens another, and a monitoring process that opens two more has used the wallet's entire allowance.
The websocket page on docs.perpl.xyz states roughly 50 messages per second per connection and roughly 5 connections per IP, combined. The api-docs README states the two-server model above with wallet-keyed caps. Both are official Perpl sources. This page follows the api-docs model. The verification ledger records the conflict.
Builder codes
Vessel's litepaper lists execution rebates via a Perpl builder code as a revenue line. The fee semantics below matter because the accounting that feeds the waterfall must not double-count.
Fees are reported gross. On OrdersUpdate (mt 24) and FillsUpdate (mt 25), each Order or Fill object carries f, the total fee paid, protocol plus builder. The builder portion is broken out separately as bfa, and bfa is omitted when zero. f already contains bfa. Never sum f and bfa.
The same rule holds for lifetime totals. AccountStats carries tf (total fees) and tbf (lifetime builder fees) as sibling fields, and tbf is already included in tf. Never sum tbf and tf. AccountStats arrives on mt 28 and inside the WalletSnapshot (mt 19) under sts.
The fee tier ft arrives on the account update (mt 21). It indexes the maker and taker fee schedule in MarketConfig, derives from rolling 14-day volume, is re-evaluated in the background, and is resolved on-chain at fill time. Re-read ft on every account update. Never cache it.
The builder code Vessel will register is unpublished UNVERIFIED — PENDING GATE-0. So is the rebate share it earns.
Delegated accounts
Perpl publishes a delegated-account repository under BUSL-1.1. It is a smart contract that holds an account on the Perpl Exchange with separated owner and operator roles: a BeaconProxy DelegatedAccount, deployed through a Factory. The operator is restricted by a function-selector allowlist covering order execution (execOrder, execOrders, and similar). withdrawCollateral is owner-only and permanently blocked for the operator.
Mainnet Factory: 0xc535276e3e446e4f28d95ed27ccd5c32e4c8907a.
This is the shape Vessel needs. Keepers execute margin top-ups, rebalancing, and funding harvest permissionlessly, so a keeper must hold enough authority to move the position and provably none to move the collateral out. The delegated-account split is that division, enforced by selector allowlist rather than by policy. The design commitment for the Perpl adapter is that the intended delegation scope is exactly this: operator authority limited to position management, withdrawal authority held by the Vessel contract that owns the account, never by a keeper. Whether the shipped adapter uses Perpl's delegated-account contracts or an equivalent restriction inside Vessel's own contracts is not published. UNVERIFIED — PENDING GATE-0
One correction the ledger records: the phrase describing a programmable smart account with whitelist-only DeFi delegation belongs to a different PerplFoundation repository (invairiant), not to delegated-account. It does not describe the contracts above.
Addresses
Perpl's contracts, verified against Perpl's docs and, for the mainnet Exchange, the monad-crypto/protocols registry. AUSD is verified against Perpl's docs and the MONSKILLS registry.
| Contract (mainnet) | Address | Actions |
|---|---|---|
| Perpl Exchange | 0x34B6552d57a35a1D042CcAe1951BD1C370112a6F | Explorer ↗ |
| AUSD (Perpl collateral) | 0x00000000eFE302BEAA2b3e6e1b18d08D69a9012a | Explorer ↗ |
| DelegatedAccount Factory | 0xc535276e3e446e4f28d95ed27ccd5c32e4c8907a | Explorer ↗ |
| Contract (testnet) | Address | Actions |
|---|---|---|
| Perpl Exchange | 0x1964C32f0bE608E7D29302AFF5E61268E72080cc | Explorer ↗ |
| Perpl testnet collateral token | UNVERIFIED — PENDING GATE-0 | |
| Vessel Perpl adapter (IVenue) | UNVERIFIED — PENDING GATE-0 | |
| Vessel delegated account | UNVERIFIED — PENDING GATE-0 | |
| SimVenue (IVenue adapter, current) | UNVERIFIED — PENDING GATE-0 |
The testnet collateral token is not published here because Perpl's two official sources, the api-docs repository and the docs site, give different addresses. Neither is shipped until they agree. The Vessel rows are unpublished; the repository has no contracts as of 2026-08-29.
Verify it yourself
Confirm Perpl's public surface answers, and that the markets it reports match the ids above:
curl -s https://app.perpl.xyz/api/v1/pub/context | head -c 600
Confirm the Exchange contract has code:
cast code 0x34B6552d57a35a1D042CcAe1951BD1C370112a6F --rpc-url https://rpc.monad.xyz | head -c 66
Or open it on the explorer: Perpl Exchange on monadscan.com.
What you cannot verify today is any Vessel transaction touching that contract. There are none. When the adapter ships, this section will carry the adapter address and a transaction hash; until then a reader who searches the Exchange for Vessel activity should find nothing, and that is the correct result.
Failure mode
The hedge is observable, not invincible. The litepaper's transparency claim is a claim about observability: every position, every funding payment, and every margin move is on-chain and readable. It is not a claim that the position cannot be lost.
Once the adapter ships, the short leg lives on Perpl's contracts, and Perpl's collateral token holds Vessel's margin. A Perpl failure is a Vessel failure. Concretely:
If Perpl halts trading, the short cannot be opened, closed, or resized. Spot is still held, so Vessel is long-only for the duration, with delta drifting outside the 1% band and no way to correct it. Funding stops accruing. The Hull EWMA keeps reading the last rate until new data arrives; how the engine treats a stale funding read is not published UNVERIFIED — PENDING GATE-0.
If Perpl liquidates the short, the margin is gone and Vessel is unhedged. The design keeps the liquidation price at least 40% above mark and uses the idle buffer for maintenance, with a buffer breach triggering de-risking rather than added leverage. That is distance, not immunity. A move larger than the distance, or a period during which keepers cannot post margin, ends in liquidation.
If the Perpl Exchange contract is exploited or its collateral token fails, the margin is lost at the venue. The shortfall ordering applies: Ballast NAV absorbs first, then the Reserve, and only after both is Hull principal impaired, which the litepaper calls a credit event.
If the Perpl API degrades while the contracts keep running, the keeper loses its view but not its authority. Rebalancing and margin top-ups are on-chain calls and do not depend on the WebSocket; the fee and funding reads that the accounting uses do. A keeper that sizes a market-data client against trading limits gets closed by Perpl, which is a self-inflicted version of this failure.
None of this applies to the testnet deployment today, because the testnet deployment does not touch Perpl. It applies to SimVenue in a simpler form: the owner can set the funding rate to anything, including a value that makes the hedge look like it earns when a real venue would not.