This page describes the contract that holds your builder fees after activation, how funds move through it, and who operates each part.
Overview
Floatout deploys one contract for each activated DEX. The contract’s address is your builder code. Builder fees accrue to that contract on eligible fills. Floatout’s ledger tracks who is owed what from the fees the contract holds. Floatout publishes a root, a summary of the ledger, and the contract pays claims against that root.
How funds move
Hyperliquid collects the builder fee on eligible fills and credits it to your contract. An agent key registered to the contract collects the accrued fees into the contract’s balance. The agent key can do nothing else with that balance. It cannot send funds anywhere.
Funds leave the contract only through a claim. A claim names a wallet, a cumulative amount, and a merkle proof. The contract checks the proof against the current root, subtracts what that wallet already claimed, and sends the difference to that wallet. Anyone can submit a claim for any wallet. The funds always go to the wallet named in the proof. Re-submitting a claim pays nothing extra.
What the contract does not have
The contract has no withdraw function, no sweep function, no transfer function, and no administrative drain. Claims pay the wallet named in the published allocation. Correct allocation depends on the root publisher. The contract code is public on-chain.
Roots are cumulative
Floatout carries cumulative allocations forward when publishing roots. The contract records paid amounts and prevents the same entitlement being claimed twice.
The contract does not independently verify the off-chain allocation. A malicious root can omit an entitlement or allocate fee funds to the wrong wallet.
Roles
| Role | Held by | Can do | Cannot do |
|---|---|---|---|
| Administration | The timelock, a contract that delays every action | Change roles and upgrade the contract, after a 48-hour delay | Skip the enforced administrative delay |
| Operator | A key Floatout holds | Publish roots that determine claim recipients and amounts | Change administrative roles directly |
| Guardian | Your owner wallet | Pause claims for up to 72 hours, after which the pause ends by itself | Move funds, extend a pause past 72 hours |
The 48-hour delay applies to administrative actions, not root publication. A malicious published root can cause irreversible loss of available fee funds through claims.
Claims stay open during an upgrade delay. An upgrade keeps the contract address, the accrued fees, the root, and the claimed balances.
What Floatout operates
Floatout operates the hosting for your DEX and the console. It also operates the ledger, which computes who is owed what from recorded fills. Floatout publishes roots and holds the deployment keys and the operator key.
Checks on what Floatout operates
With each root, Floatout publishes a digest of the accrual inputs and the rates in effect. You can use the digest to recompute your own entry. A separate process compares the ledger against the chain after each publication and raises an alert on any mismatch. Administrative powers sit behind the timelock. These checks do not remove trust in the publisher or delay a newly published root.
Console changes
Console changes require a verified owner signature or a supported fast-edit authorization. A fee change can never exceed Hyperliquid’s caps or a trader’s approved maximum. Money changes are never delegated to a fast edit. They always require a wallet signature.
Trader funds
Trader balances remain in their own Hyperliquid accounts. The fee contract described here does not hold those trading balances.
Trading, protocol, wallet, and website risks remain. Non-custodial operation does not guarantee safety or establish regulatory permission.
Domain isolation
Your DEX is served on floatout.trade. The console is served on floatout.xyz. A DEX never shares cookies with the console.