Appearance
Liquidation & Backstops
This doc explains what happens when an account can no longer support its positions: when liquidation triggers, how positions are closed, and what absorbs any leftover loss when a trader goes underwater faster than their collateral can cover.
Two ideas do most of the work. First, liquidation is collateral-driven, not price-execution-driven: a triggered account is closed at the reference mark, not swept aggressively into the order book. Second, any shortfall flows through an ordered waterfall of backstops, so a single blown-up trader cannot leave the exchange short.
This doc builds on the margin model. If you have not read it, see the cross-margin and scenario-margin doc — the same maintenance-margin check that gates orders and withdrawals is the check that triggers liquidation.
What triggers liquidation
An account is liquidated when its equity drops below its maintenance margin (MM) — the minimum collateral required to keep its positions open.
- Initial margin (IM) is what you must post to open a position.
- Maintenance margin (MM) is the lower threshold you must stay above to keep it open.
MM is set below IM, so there is a buffer: a position you opened at full IM can move against you somewhat before it reaches the maintenance threshold. When equity falls to MM, the account becomes eligible for liquidation.
The trigger is worst-case, not a single number
Margin is evaluated under a portfolio, worst-case (scenario) model: the account must remain solvent across the full range of outcomes it is exposed to, and offsetting positions require far less margin than positions taken in isolation. The trigger inherits the same logic. An account is eligible for liquidation when its worst-case outcome would breach maintenance margin — the requirement reflects the worst case, not the average. A position that looks healthy on its current marks can still be liquidatable if one resolution outcome would leave it underwater.
The same predicate that admits orders also decides liquidation. (For the full margin model, see the cross-margin doc; this doc only uses the result.)
Resting orders count, and cancelling them can save you
Your maintenance requirement includes the margin reserved by your resting orders, not just your open positions. A resting order continuously reserves margin against the position it would create if it filled.
Because of this, liquidation first cancels your resting orders and re-checks. Freeing that reserved margin lowers your requirement, and that alone can bring you back above MM — in which case no positions are closed. So if you are near the edge, cancelling resting orders is a real lever: it reduces your requirement, not just your exposure.
Closing at the reference mark
When an account is still under MM after its resting orders are cancelled, its positions are closed. The key property: positions are closed at the reference (risk) mark — the book is not swept.
This is the most important and most commonly misunderstood point. Liquidation does not fire an aggressive order into the order book, eat the available depth, and pay whatever slippage results. Instead, the position is closed directly at the reference mark (the price the engine uses for margin), and the resulting profit or loss is realized against that price.
Why this design:
- No slippage spiral. Forcing a large liquidation into a thin book would push the price further against the liquidated trader, deepening the loss and potentially cascading into other accounts. Closing at the reference mark removes that feedback loop.
- Resistant to spoofing-induced liquidations. Because the perpetual risk marks are oracle-based rather than book-based, ordinary book noise, thin liquidity, and a single spoofed print on those markets do not feed directly into the reference price. A momentary order-book flash crash on a perp does not trigger a liquidation on its own.
- No "liquidation flow" to trade against. There is no in-book liquidation order for other participants to fill. Market makers cannot expect to pick up forced liquidation flow at a discount — there is none. Any shortfall is instead absorbed by the backstops described below.
For conditional positions, the practical rule is to be solvent in the post-resolution world: flatten or fully box your conditional inventory before an event resolves. A perpetual that is hedged only in the branch where a conditional fires is left exposed if the other outcome occurs and the conditional voids — and the margin model prices that branch in, which is exactly why such a position can be flagged even when it looks delta-flat on today's marks.
The bankruptcy price
When a position is closed at a loss larger than the trader can cover, the relevant reference point is the bankruptcy price — the price at which the position's loss exactly equals the trader's remaining collateral, i.e. the point at which their equity hits zero.
- For a long, the bankruptcy price sits below the entry price.
- For a short, it sits above the entry price.
Closing at the reference mark leaves the trader some residual collateral whenever the mark is better than their bankruptcy price. When the mark is worse than it, the trader's loss exceeds their collateral and leaves a deficit the exchange absorbs. The bankruptcy price is the natural settlement reference for that absorption: it is the price at which the loss is exactly fully collateralized, so counterparties can be made whole without the trader owing more than they had.
The bankruptcy price reappears below as the price at which auto-deleveraging closes the other side of a bankrupt position.
The backstop waterfall
A deficit — a realized liquidation loss that exceeds the trader's own collateral — is never written off, and it never leaves the exchange short. It flows through an ordered waterfall of loss-absorbing layers. Each layer absorbs what it can; whatever remains passes to the next.
The layers, in order:
Protocol backstop. A protocol-owned reserve is the first layer. It contributes down to a configured floor that keeps it preserved as a healthy reserve rather than drained as a sacrificial buffer — the protocol's first line of defense stays solvent.
Insurance fund. A dedicated insurance fund absorbs the next slice of the deficit, up to its available balance. This is the standard backstop for liquidation shortfalls; in normal operation, deficits are absorbed here.
Socialized loss (capped). If a deficit is large enough to exhaust the layers above, a small, capped pro-rata haircut is distributed across open positions. The cap is deliberately tight, so the most any bystander can lose to someone else's liquidation in a single event is bounded and small. Affected traders keep their positions and lose only a thin sliver of cash. Positions whose risk is already self-contained are excluded from the haircut base.
Auto-deleverage (ADL). As a final layer, if a deficit survives all three above, the exchange force-closes profitable counterparties of the bankrupt trader, at the bankrupt trader's bankruptcy price, until the deficit is cleared. Counterparties are ranked so the most-profitable, most-levered positions are deleveraged first. An ADL'd counterparty never owes anything — it only forfeits some unrealized profit down to the bankruptcy price, and if only part of a position is needed, the rest survives at its original entry. Self-contained positions are excluded, because their loss is already bounded by their own settlement.
Pools are isolated
These backstops are organized into isolated pools. A deficit in one pool draws only on that pool's insurance fund and that pool's positions — it cannot reach into another pool's insurance fund or socialize loss onto unrelated markets. The blast radius of any single event is bounded to its own pool.
Why it is designed this way
The whole apparatus follows from a few principles.
Solvency before everything. The exchange must always be able to make winners whole. Liquidation exists to close a losing position before it can run a negative balance, and the waterfall ensures that even when a gap-move blows through the maintenance buffer, the loss is absorbed in a defined, bounded order rather than left to chance.
Don't make a crisis worse. Closing at the reference mark instead of sweeping the book keeps a liquidation from feeding on itself. Because the perpetual risk marks are oracle-based rather than book-based, ordinary book noise, thin liquidity, and spoofed prints on those markets do not manufacture liquidations. The act of liquidating does not itself move the price that triggered it.
Bound the contagion. The socialized-loss cap limits how much any uninvolved trader can lose to someone else's liquidation. Pool isolation limits which traders are exposed at all. Together they convert an unbounded, system-wide risk into a small, contained, predictable one.
Defense in depth. The full machinery — the insurance fund, the capped socialized-loss layer, and ADL — forms layered protection. Normal liquidations are covered by a trader's own collateral and the insurance fund; the lower layers stand behind them so that no single failure can threaten the exchange's solvency.
What this means for you as a trader. Keep a buffer above maintenance margin; do not run right at the maintenance edge, because a single block's move can take you under. Remember that resting orders consume margin, and cancelling them can pull you back above the line. And be solvent in the post-resolution world before any conditional event resolves — a hedge that only holds in one branch is not a hedge against liquidation.