Insurance Fund

When a position is liquidated at a price worse than its bankruptcy price, the account's collateral is insufficient to make its counterparties whole — the difference is bad debt, a loss that must land somewhere. The Exchange's first line of defense is the insurance fund: a pool of USDX that grows when liquidations execute at better-than-bankruptcy prices (spread profit) and shrinks when it absorbs bad debt. The mechanism is deliberately simple and total: every unit of bad debt is either absorbed by the fund or passed on, with nothing lost and nothing created.

The fund cannot go negative. If a liquidation's bad debt exceeds the current balance, the fund contributes everything it has — draining to exactly zero — and the remainder becomes an auto-deleveraging instruction: the Exchange forcibly closes the most profitable, most leveraged opposing positions to settle the shortfall. This document derives the exact arithmetic of that waterfall — absorption, depletion, the ADL handoff amount, the trigger condition, and the counterparty ranking — together with the accounting identities the implementation preserves.

A single bad-debt event splits exactly into a min-term the fund absorbs and a max-term ADL settles (their sum is D by construction), while spread profits close the replenishment loop back into the balance that determines the next split.

A single bad-debt event splits exactly into a min-term the fund absorbs and a max-term ADL settles (their sum is D by construction), while spread profits close the replenishment loop back into the balance that determines the next split.

Setting

A market is parameterized by an ADL trigger threshold $\kappa \ge 0$. The fund's state is the triple $(F, \Sigma_{\mathrm{abs}}, \Sigma_{\mathrm{rec}})$ of current balance, cumulative bad debt absorbed, and cumulative funds received; all three are non-negative USDX amounts, and a fresh fund starts at $(F_0, 0, F_0)$. Each liquidation presents a bad debt $D \ge 0$; each ADL candidate carries an unrealized-PnL fraction $\pi$ and leverage $L$ from which its priority score $\rho$ is formed. The admissible region is $F \ge 0$, $D \ge 0$, $g \ge 0$, $\kappa \ge 0$.

Symbol	Name	Description	Units	Domain
$\Phi$	fund_balance	Current insurance fund balance available to absorb bad debt.	USDX	[0, ∞)
$D$	bad_debt	Bad debt produced by a liquidation: the shortfall between the bankrupt account's obligations and its collateral. Zero when the liquidation closed at or better than bankruptcy price.	USDX	[0, ∞)
$\Sigma_{\mathrm{abs}}$	total_absorbed	Cumulative bad debt the fund has absorbed over its lifetime; monotonically non-decreasing.	USDX	[0, ∞)
$\Sigma_{\mathrm{rec}}$	total_received	Cumulative funds the fund has received — the initial balance plus all spread profits; monotonically non-decreasing.	USDX	[0, ∞)
$g$	spread_profit	Liquidation spread profit credited to the fund when a liquidation fills at a better-than-bankruptcy price.	USDX	[0, ∞)
$\kappa$	adl_threshold	Per-market ADL trigger threshold on the fund balance. The default of zero means ADL only triggers when the fund is fully depleted; a positive value triggers ADL earlier.	USDX	[0, ∞)
$\pi$	pnl_percent	ADL candidate's unrealized PnL as a fraction of position value.	fraction	unbounded
$L$	leverage	ADL candidate's effective leverage.	multiplier	(0, ∞)
$\rho$	priority_score	ADL ranking score for a counterparty candidate; candidates are deleveraged in descending order of this score.	dimensionless	unbounded

The mechanism

Bad-Debt Absorption

A liquidation presents bad debt $D$ to the fund, and the fund contributes as much as it can without going negative: the full debt when it is covered, and the entire balance otherwise. This is the amount by which the cumulative absorption ledger $\Sigma_{\mathrm{abs}}$ advances, and its complement — (I.4) — is what escapes to auto-deleveraging. The case $D = 0$ is included: the fund absorbs nothing and no ADL is produced.

$$D_{\mathrm{abs}} = \min(D, \Phi) \tag{I.1}$$

The balance after a liquidation is the previous balance less the absorbed amount (I.1), which collapses to a clamped subtraction: the fund keeps whatever the debt did not consume, and never dips below zero. When $D > F$ the two branches of the implementation meet exactly at zero — the fund is drained with no residual dust and no overdraw.

$$\Phi' = \max(\Phi - D, 0) \tag{I.2}$$

Every liquidation advances the lifetime absorption ledger by exactly the absorbed amount (I.1), never by the full bad debt when the fund cannot cover it. This keeps the ledger an honest record of what the fund itself paid, which is what makes the accounting-closure invariant hold.

$$\Sigma_{\mathrm{abs}}' = \Sigma_{\mathrm{abs}} + \min(D, \Phi) \tag{I.3}$$

Auto-Deleveraging Handoff

When bad debt exceeds the fund balance, the excess is packaged into an ADL instruction whose settlement amount is exactly the shortfall the fund could not cover. Together with (I.1) this conserves the debt: $D_{\mathrm{abs}} + D_{\mathrm{adl}} = D$ always. No instruction is issued when $D \le F$ — the expression evaluates to zero there, and the implementation returns no ADL at all.

$$D_{\mathrm{adl}} = \max(D - \Phi, 0) \tag{I.4}$$

Independently of any single liquidation, the Exchange can consult a market-level trigger: auto-deleveraging is armed whenever the fund balance has fallen to or below the market's threshold $\kappa$. With the default $\kappa = 0$ this arms only when the fund is fully depleted; a positive threshold arms ADL earlier as a safety margin. The comparison is inclusive — balance exactly at the threshold triggers.

$$\mathrm{trigger}_{\mathrm{adl}} = \mathbb{1}\left[\Phi \le \kappa\right] \tag{I.5}$$

The ADL instruction lists counterparties in the order they will be deleveraged: descending by priority score, the product of a candidate's unrealized-PnL fraction $\pi$ and its leverage $L$. The most profitable, most leveraged opposing positions absorb the shortfall first — the accounts that gained most from the move that bankrupted the liquidated trader. Ties on score are broken by ascending account identifier for deterministic replay.

$$\rho = \pi \cdot L \tag{I.6}$$

Spread-Profit Crediting

The fund's only inflow after inception is liquidation spread profit: when a liquidation fills at a better-than-bankruptcy price, the surplus $g$ is credited to the fund. The balance increases by exactly the profit — no fee, no haircut — and $g = 0$ leaves the state unchanged.

$$\Phi' = \Phi + g \tag{I.7}$$

Each spread-profit credit also advances the lifetime receipts ledger, which was seeded with the fund's initial balance at construction. Liquidations never touch this ledger — bad debt moves value from $F$ to $\Sigma_{\mathrm{abs}}$, not out of $\Sigma_{\mathrm{rec}}$ — so receipts are monotonically non-decreasing and the closure identity with (I.7) and (I.3) is preserved on every path.

$$\Sigma_{\mathrm{rec}}' = \Sigma_{\mathrm{rec}} + g \tag{I.8}$$

Invariants

• The fund balance is never negative: $F \ge 0$ after every operation, and it is exactly zero whenever an ADL instruction is emitted. Why it holds: Absorption subtracts $D$ only on the branch $D \le F$, so the result is non-negative; on the other branch the balance is assigned literally to zero after contributing everything ((I.2)). Spread-profit crediting only adds a non-negative amount. No other path writes the balance.
• Accounting closure: $F = \Sigma_{\mathrm{rec}} - \Sigma_{\mathrm{abs}}$ at all times, equivalently $F + \Sigma_{\mathrm{abs}} = \Sigma_{\mathrm{rec}}$. Why it holds: The initial state $(F_0, 0, F_0)$ satisfies it. Absorption moves the same amount $\min(D,F)$ out of $\Phi$ and into $\Sigma_{\mathrm{abs}}$ ((I.1), (I.3)), leaving the difference unchanged; spread profit adds the same $g$ to both $\Phi$ and $\Sigma_{\mathrm{rec}}$ ((I.7), (I.8)).
• Bad-debt conservation: every liquidation's debt splits exactly as $D = D_{\mathrm{abs}} + D_{\mathrm{adl}}$ with $D_{\mathrm{abs}} = \min(D,F)$ and $D_{\mathrm{adl}} = \max(D-F,0)$ — nothing is lost or double-counted between the fund and ADL. Why it holds: The identity $\min(D,F) + \max(D-F,0) = D$ holds pointwise. The covered branch sets $D_{\mathrm{adl}} = 0$ implicitly (no instruction); the depleted branch computes the ADL amount as $D - F$ ((I.4)) after absorbing exactly $\Phi$.
• Both ledgers are monotone: $\Sigma_{\mathrm{abs}}$ and $\Sigma_{\mathrm{rec}}$ never decrease, and liquidations leave $\Sigma_{\mathrm{rec}}$ untouched. Why it holds: Absorption adds a non-negative $\min(D,F)$ to $\Sigma_{\mathrm{abs}}$ and never writes $\Sigma_{\mathrm{rec}}$; spread profit adds a non-negative $g$ to $\Sigma_{\mathrm{rec}}$ and never writes $\Sigma_{\mathrm{abs}}$. ADL counterparty settlements happen outside the fund's books entirely.

Worked example

Start a market's fund at $F_0 = 1{,}000$ USDX, so the state is $(F, \Sigma_{\mathrm{abs}}, \Sigma_{\mathrm{rec}}) = (1000, 0, 1000)$. A first liquidation fills slightly better than bankruptcy and yields a spread profit of $g = 250$: by (I.7) and (I.8) the state becomes $(1250, 0, 1250)$, and closure $F = \Sigma_{\mathrm{rec}} - \Sigma_{\mathrm{abs}}$ holds.

A second liquidation leaves bad debt $D = 1{,}500$. Since $D > F$, the fund contributes everything: (I.1) gives $D_{\mathrm{abs}} = \min(1500, 1250) = 1250$, the balance drops to $\max(1250 - 1500, 0) = 0$ by (I.2), and $\Sigma_{\mathrm{abs}}$ advances to $1250$. The shortfall becomes an ADL instruction for $D_{\mathrm{adl}} = \max(1500 - 1250, 0) = 250$ by (I.4). With the default threshold $\kappa = 0$, the trigger (I.5) now reads $\mathbb{1}[0 \le 0] = 1$ — ADL is armed.

The instruction ranks counterparties by (I.6). Consider three profitable longs with $(\pi, L)$ of $(0.02, 10)$, $(0.1, 15)$, and $(0.04, 10)$: their scores are $0.2$, $1.5$, and $0.4$, so the second account — the most profitable and most leveraged — is deleveraged first to settle the $250$ USDX shortfall. Throughout, the final state $(0, 1250, 1250)$ still satisfies closure exactly.

Analysis

Sensitivity

Elasticities ε = (∂y/∂x)·(x/y), computed numerically from the verified expressions at each worked-example point. |ε| > 1 means the output moves more than proportionally with that input.

Expression	Input	Elasticity ε
absorbed_amount	bad_debt	1
absorbed_amount	fund_balance	0
post_liquidation_balance	fund_balance	2
post_liquidation_balance	bad_debt	-1
total_absorbed_update	bad_debt	1
total_absorbed_update	total_absorbed	0
total_absorbed_update	fund_balance	0
adl_settle_amount	bad_debt	3
adl_settle_amount	fund_balance	-2
adl_priority_score	pnl_percent	1
adl_priority_score	leverage	1
spread_profit_balance	fund_balance	0.9756
spread_profit_balance	spread_profit	0.02439
total_received_update	total_received	0.9756
total_received_update	spread_profit	0.02439

Sensitivity tornado — Fund balance after absorption

Sensitivity tornado — ADL settlement amount

Sensitivity tornado — ADL counterparty priority score

Response curves

The balance falls one-for-one with bad debt until it clamps at exactly zero, where auto-deleveraging takes over; initial balance held at 10,000 USDX.

The balance falls one-for-one with bad debt until it clamps at exactly zero, where auto-deleveraging takes over; initial balance held at 10,000 USDX.

The ADL settlement amount is zero while the fund covers the debt and grows one-for-one with the excess beyond the fund balance, shown for three fund sizes.

The ADL settlement amount is zero while the fund covers the debt and grows one-for-one with the excess beyond the fund balance, shown for three fund sizes.

Counterparties are deleveraged in descending score order, so more profitable and more leveraged positions absorb the shortfall first; three leverage levels shown.

Counterparties are deleveraged in descending score order, so more profitable and more leveraged positions absorb the shortfall first; three leverage levels shown.

Parameter space

Joint parameter effects evaluated from the verified expressions over 2-D grids.

The fund fully absorbs losses below the diagonal bad_debt = fund_balance; above it, the excess passes linearly to ADL counterparties, making the diagonal the socialization boundary.

The fund fully absorbs losses below the diagonal bad_debt = fund_balance; above it, the excess passes linearly to ADL counterparties, making the diagonal the socialization boundary.

Priority hyperbolas show that a modestly profitable high-leverage position outranks a highly profitable low-leverage one, while loss-making positions (negative scores) are deprioritized regardless of leverage.

Priority hyperbolas show that a modestly profitable high-leverage position outranks a highly profitable low-leverage one, while loss-making positions (negative scores) are deprioritized regardless of leverage.

ADL arms exactly on and below the diagonal fund_balance = adl_threshold, showing how the threshold parameter directly sets the fund depletion level at which deleveraging begins.

ADL arms exactly on and below the diagonal fund_balance = adl_threshold, showing how the threshold parameter directly sets the fund depletion level at which deleveraging begins.

References

• Derived from and adversarially verified against the Exchange's Rust implementation and its test suite.
• Sibling model: funding-rate
• Sibling model: liquidation-engine
• Sibling model: margin-math
• Sibling model: oracle
• Sibling model: order-book
• Sibling model: position-tracker
• Sibling model: settlement