Liquidation & ADL
When equity falls to the maintenance margin, a position is liquidated under strict per-block caps. If liquidation can't fully clear the loss, the Insurance Fund absorbs it; only when that is exhausted does auto-deleveraging engage.
Liquidation trigger
The Liquidation Engine scans open positions on a schedule and marks a position liquidatable when its equity — position margin plus unrealized PnL plus accrued funding, valued at the mark price — reaches the maintenance margin. Status moves OPEN → LIQUIDATING and a close order is submitted to the matching engine.
Pricing a liquidation
Liquidations don't close at market — they close at a fillable price derived from two primitives:
The smooth haircut prevents two failure modes at once: thin-book blow-throughs that hand away too much, and undercharging accounts that are only mildly distressed.
Per-block caps
Liquidation is partial-by-default and rate-limited so a single position or a cascade can't drain the system in one block:
| Cap | Purpose |
|---|---|
| One liquidation per position per block | Prevents same-block cascades on a single position. |
| Max position portion per liquidation | Closes at most a fraction of the position at a time (partial-by-default). |
| Min position notional liquidated | Tiny positions close in one shot rather than dust-cascading. |
| Max notional per account per block | Caps total liquidated across a user's markets each block. |
| Max insurance draw per block | Bounds how much the fund can be tapped per block; excess defers to the next block. |
| Max liquidation fee | Caps the fee as a fraction of fill notional. |
Insurance Fund
When a liquidation can't fully cover the loss — the fillable price is worse than the bankruptcy price — the residual is bad debt. The on-chain Insurance Fund covers it from accumulated fees and liquidation residuals, drawing through the market's escrow, subject to the per-block draw cap.
Auto-deleveraging (ADL)
ADL is the last line of defense, used only when liquidation plus the Insurance Fund cannot clear the loss. There are two modes:
In-flight ADL
Fires when a liquidation would leave total net collateral negative after the fund draw — i.e. fillable is below bankruptcy and the per-block insurance cap is hit or the fund is empty. It does not fire on healthy distress; liquidation and the fund must be exhausted first.
- Counterparty selection: PnL-ranked. The highest-PnL traders on the opposite side of the distressed position are deleveraged first — those who profited most from the move absorb the residual. Ties break by larger notional, then by older position age. The rule is deterministic and auditable.
- Execution price: the bankruptcy price of the distressed account — the price that zeros the loser's collateral.
Final-settlement ADL
A milder, deterministic mode. At the Resolved → Settled transition, any residual open position is force-closed at the oracle-resolved terminal value. This always runs — it's a clean close at the oracle, not a counterparty-selection problem.
Order of defense
- Position crosses maintenance margin → liquidation at the fillable price, partial and capped.
- Residual bad debt → Insurance Fund draw, within the per-block cap.
- Fund exhausted or capped → in-flight ADL, PnL-ranked, at the bankruptcy price (or market halt where the engine is not yet live).
- At resolution → final-settlement ADL closes any remainder at the terminal value.