> For the complete documentation index, see [llms.txt](https://docs.nexus.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexus.xyz/math-engine/insurance-fund.md). # Insurance Fund When a position is liquidated at a price worse than its bankruptcy price, the account's collateral is insufficient to make its counterparties whole — the difference is bad debt, a loss that must land somewhere. The Exchange's first line of defense is the insurance fund: a pool of USDX that grows when liquidations execute at better-than-bankruptcy prices (spread profit) and shrinks when it absorbs bad debt. The mechanism is deliberately simple and total: every unit of bad debt is either absorbed by the fund or passed on, with nothing lost and nothing created. The fund cannot go negative. If a liquidation's bad debt exceeds the current balance, the fund contributes everything it has — draining to exactly zero — and the remainder becomes an auto-deleveraging instruction: the Exchange forcibly closes the most profitable, most leveraged opposing positions to settle the shortfall. This document derives the exact arithmetic of that waterfall — absorption, depletion, the ADL handoff amount, the trigger condition, and the counterparty ranking — together with the accounting identities the implementation preserves. ![A single bad-debt event splits exactly into a min-term the fund absorbs and a max-term ADL settles (their sum is D by construction), while spread profits close the replenishment loop back into the balance that determines the next split.](/files/3OhGNAzRmqXtUktkUAsk) *A single bad-debt event splits exactly into a min-term the fund absorbs and a max-term ADL settles (their sum is D by construction), while spread profits close the replenishment loop back into the balance that determines the next split.* ## Setting A market is parameterized by an ADL trigger threshold $$\kappa \ge 0$$. The fund's state is the triple $$(F, \Sigma\_{\mathrm{abs}}, \Sigma\_{\mathrm{rec}})$$ of current balance, cumulative bad debt absorbed, and cumulative funds received; all three are non-negative USDX amounts, and a fresh fund starts at $$(F\_0, 0, F\_0)$$. Each liquidation presents a bad debt $$D \ge 0$$; each ADL candidate carries an unrealized-PnL fraction $$\pi$$ and leverage $$L$$ from which its priority score $$\rho$$ is formed. The admissible region is $$F \ge 0$$, $$D \ge 0$$, $$g \ge 0$$, $$\kappa \ge 0$$. | Symbol | Name | Description | Units | Domain | | -------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | --------- | | $$\Phi$$ | fund\_balance | Current insurance fund balance available to absorb bad debt. | USDX | \[0, ∞) | | $$D$$ | bad\_debt | Bad debt produced by a liquidation: the shortfall between the bankrupt account's obligations and its collateral. Zero when the liquidation closed at or better than bankruptcy price. | USDX | \[0, ∞) | | $$\Sigma\_{\mathrm{abs}}$$ | total\_absorbed | Cumulative bad debt the fund has absorbed over its lifetime; monotonically non-decreasing. | USDX | \[0, ∞) | | $$\Sigma\_{\mathrm{rec}}$$ | total\_received | Cumulative funds the fund has received — the initial balance plus all spread profits; monotonically non-decreasing. | USDX | \[0, ∞) | | $$g$$ | spread\_profit | Liquidation spread profit credited to the fund when a liquidation fills at a better-than-bankruptcy price. | USDX | \[0, ∞) | | $$\kappa$$ | adl\_threshold | Per-market ADL trigger threshold on the fund balance. The default of zero means ADL only triggers when the fund is fully depleted; a positive value triggers ADL earlier. | USDX | \[0, ∞) | | $$\pi$$ | pnl\_percent | ADL candidate's unrealized PnL as a fraction of position value. | fraction | unbounded | | $$L$$ | leverage | ADL candidate's effective leverage. | multiplier | (0, ∞) | | $$\rho$$ | priority\_score | ADL ranking score for a counterparty candidate; candidates are deleveraged in descending order of this score. | dimensionless | unbounded | ## The mechanism ### Bad-Debt Absorption A liquidation presents bad debt $$D$$ to the fund, and the fund contributes as much as it can without going negative: the full debt when it is covered, and the entire balance otherwise. This is the amount by which the cumulative absorption ledger $$\Sigma\_{\mathrm{abs}}$$ advances, and its complement — (I.4) — is what escapes to auto-deleveraging. The case $$D = 0$$ is included: the fund absorbs nothing and no ADL is produced. $$ D\_{\mathrm{abs}} = \min(D, \Phi) \tag{I.1} $$ The balance after a liquidation is the previous balance less the absorbed amount (I.1), which collapses to a clamped subtraction: the fund keeps whatever the debt did not consume, and never dips below zero. When $$D > F$$ the two branches of the implementation meet exactly at zero — the fund is drained with no residual dust and no overdraw. $$ \Phi' = \max(\Phi - D, 0) \tag{I.2} $$ Every liquidation advances the lifetime absorption ledger by exactly the absorbed amount (I.1), never by the full bad debt when the fund cannot cover it. This keeps the ledger an honest record of what the fund itself paid, which is what makes the accounting-closure invariant hold. $$ \Sigma\_{\mathrm{abs}}' = \Sigma\_{\mathrm{abs}} + \min(D, \Phi) \tag{I.3} $$ ### Auto-Deleveraging Handoff When bad debt exceeds the fund balance, the excess is packaged into an ADL instruction whose settlement amount is exactly the shortfall the fund could not cover. Together with (I.1) this conserves the debt: $$D\_{\mathrm{abs}} + D\_{\mathrm{adl}} = D$$ always. No instruction is issued when $$D \le F$$ — the expression evaluates to zero there, and the implementation returns no ADL at all. $$ D\_{\mathrm{adl}} = \max(D - \Phi, 0) \tag{I.4} $$ Independently of any single liquidation, the Exchange can consult a market-level trigger: auto-deleveraging is armed whenever the fund balance has fallen to or below the market's threshold $$\kappa$$. With the default $$\kappa = 0$$ this arms only when the fund is fully depleted; a positive threshold arms ADL earlier as a safety margin. The comparison is inclusive — balance exactly at the threshold triggers. $$ \mathrm{trigger}\_{\mathrm{adl}} = \mathbb{1}\left\[\Phi \le \kappa\right] \tag{I.5} $$ The ADL instruction lists counterparties in the order they will be deleveraged: descending by priority score, the product of a candidate's unrealized-PnL fraction $$\pi$$ and its leverage $$L$$. The most profitable, most leveraged opposing positions absorb the shortfall first — the accounts that gained most from the move that bankrupted the liquidated trader. Ties on score are broken by ascending account identifier for deterministic replay. $$ \rho = \pi \cdot L \tag{I.6} $$ ### Spread-Profit Crediting The fund's only inflow after inception is liquidation spread profit: when a liquidation fills at a better-than-bankruptcy price, the surplus $$g$$ is credited to the fund. The balance increases by exactly the profit — no fee, no haircut — and $$g = 0$$ leaves the state unchanged. $$ \Phi' = \Phi + g \tag{I.7} $$ Each spread-profit credit also advances the lifetime receipts ledger, which was seeded with the fund's initial balance at construction. Liquidations never touch this ledger — bad debt moves value from $$F$$ to $$\Sigma\_{\mathrm{abs}}$$, not out of $$\Sigma\_{\mathrm{rec}}$$ — so receipts are monotonically non-decreasing and the closure identity with (I.7) and (I.3) is preserved on every path. $$ \Sigma\_{\mathrm{rec}}' = \Sigma\_{\mathrm{rec}} + g \tag{I.8} $$ ## Invariants * The fund balance is never negative: $$F \ge 0$$ after every operation, and it is exactly zero whenever an ADL instruction is emitted. *Why it holds:* Absorption subtracts $$D$$ only on the branch $$D \le F$$, so the result is non-negative; on the other branch the balance is assigned literally to zero after contributing everything ((I.2)). Spread-profit crediting only adds a non-negative amount. No other path writes the balance. * Accounting closure: $$F = \Sigma\_{\mathrm{rec}} - \Sigma\_{\mathrm{abs}}$$ at all times, equivalently $$F + \Sigma\_{\mathrm{abs}} = \Sigma\_{\mathrm{rec}}$$. *Why it holds:* The initial state $$(F\_0, 0, F\_0)$$ satisfies it. Absorption moves the same amount $$\min(D,F)$$ out of $$\Phi$$ and into $$\Sigma\_{\mathrm{abs}}$$ ((I.1), (I.3)), leaving the difference unchanged; spread profit adds the same $$g$$ to both $$\Phi$$ and $$\Sigma\_{\mathrm{rec}}$$ ((I.7), (I.8)). * Bad-debt conservation: every liquidation's debt splits exactly as $$D = D\_{\mathrm{abs}} + D\_{\mathrm{adl}}$$ with $$D\_{\mathrm{abs}} = \min(D,F)$$ and $$D\_{\mathrm{adl}} = \max(D-F,0)$$ — nothing is lost or double-counted between the fund and ADL. *Why it holds:* The identity $$\min(D,F) + \max(D-F,0) = D$$ holds pointwise. The covered branch sets $$D\_{\mathrm{adl}} = 0$$ implicitly (no instruction); the depleted branch computes the ADL amount as $$D - F$$ ((I.4)) after absorbing exactly $$\Phi$$. * Both ledgers are monotone: $$\Sigma\_{\mathrm{abs}}$$ and $$\Sigma\_{\mathrm{rec}}$$ never decrease, and liquidations leave $$\Sigma\_{\mathrm{rec}}$$ untouched. *Why it holds:* Absorption adds a non-negative $$\min(D,F)$$ to $$\Sigma\_{\mathrm{abs}}$$ and never writes $$\Sigma\_{\mathrm{rec}}$$; spread profit adds a non-negative $$g$$ to $$\Sigma\_{\mathrm{rec}}$$ and never writes $$\Sigma\_{\mathrm{abs}}$$. ADL counterparty settlements happen outside the fund's books entirely. ## Worked example Start a market's fund at $$F\_0 = 1{,}000$$ USDX, so the state is $$(F, \Sigma\_{\mathrm{abs}}, \Sigma\_{\mathrm{rec}}) = (1000, 0, 1000)$$. A first liquidation fills slightly better than bankruptcy and yields a spread profit of $$g = 250$$: by (I.7) and (I.8) the state becomes $$(1250, 0, 1250)$$, and closure $$F = \Sigma\_{\mathrm{rec}} - \Sigma\_{\mathrm{abs}}$$ holds. A second liquidation leaves bad debt $$D = 1{,}500$$. Since $$D > F$$, the fund contributes everything: (I.1) gives $$D\_{\mathrm{abs}} = \min(1500, 1250) = 1250$$, the balance drops to $$\max(1250 - 1500, 0) = 0$$ by (I.2), and $$\Sigma\_{\mathrm{abs}}$$ advances to $$1250$$. The shortfall becomes an ADL instruction for $$D\_{\mathrm{adl}} = \max(1500 - 1250, 0) = 250$$ by (I.4). With the default threshold $$\kappa = 0$$, the trigger (I.5) now reads $$\mathbb{1}\[0 \le 0] = 1$$ — ADL is armed. The instruction ranks counterparties by (I.6). Consider three profitable longs with $$(\pi, L)$$ of $$(0.02, 10)$$, $$(0.1, 15)$$, and $$(0.04, 10)$$: their scores are $$0.2$$, $$1.5$$, and $$0.4$$, so the second account — the most profitable and most leveraged — is deleveraged first to settle the $$250$$ USDX shortfall. Throughout, the final state $$(0, 1250, 1250)$$ still satisfies closure exactly. ## Analysis ### Sensitivity Elasticities ε = (∂y/∂x)·(x/y), computed numerically from the verified expressions at each worked-example point. |ε| > 1 means the output moves more than proportionally with that input. | Expression | Input | Elasticity ε | | -------------------------- | --------------- | ------------ | | `absorbed_amount` | bad\_debt | 1 | | `absorbed_amount` | fund\_balance | 0 | | `post_liquidation_balance` | fund\_balance | 2 | | `post_liquidation_balance` | bad\_debt | -1 | | `total_absorbed_update` | bad\_debt | 1 | | `total_absorbed_update` | total\_absorbed | 0 | | `total_absorbed_update` | fund\_balance | 0 | | `adl_settle_amount` | bad\_debt | 3 | | `adl_settle_amount` | fund\_balance | -2 | | `adl_priority_score` | pnl\_percent | 1 | | `adl_priority_score` | leverage | 1 | | `spread_profit_balance` | fund\_balance | 0.9756 | | `spread_profit_balance` | spread\_profit | 0.02439 | | `total_received_update` | total\_received | 0.9756 | | `total_received_update` | spread\_profit | 0.02439 | ![Sensitivity tornado — Fund balance after absorption](/files/jBRBlSFQ0PAjm0rAjsMv) ![Sensitivity tornado — ADL settlement amount](/files/ZdK3aVGaoRCarmm4FTFZ) ![Sensitivity tornado — ADL counterparty priority score](/files/xeHFeI7AIjoSoEuAPgcR) ### Response curves ![The balance falls one-for-one with bad debt until it clamps at exactly zero, where auto-deleveraging takes over; initial balance held at 10,000 USDX.](/files/7D3VYG7q7VQZvlKVKKor) *The balance falls one-for-one with bad debt until it clamps at exactly zero, where auto-deleveraging takes over; initial balance held at 10,000 USDX.* ![The ADL settlement amount is zero while the fund covers the debt and grows one-for-one with the excess beyond the fund balance, shown for three fund sizes.](/files/AERStG69hKFHK6WnFT41) *The ADL settlement amount is zero while the fund covers the debt and grows one-for-one with the excess beyond the fund balance, shown for three fund sizes.* ![Counterparties are deleveraged in descending score order, so more profitable and more leveraged positions absorb the shortfall first; three leverage levels shown.](/files/vaMWa2jCdlj1UE3Zew0Z) *Counterparties are deleveraged in descending score order, so more profitable and more leveraged positions absorb the shortfall first; three leverage levels shown.* ### Parameter space Joint parameter effects evaluated from the verified expressions over 2-D grids. ![The fund fully absorbs losses below the diagonal bad\_debt = fund\_balance; above it, the excess passes linearly to ADL counterparties, making the diagonal the socialization boundary.](/files/ziN2o3kvIIbU8xqwYkt8) *The fund fully absorbs losses below the diagonal bad\_debt = fund\_balance; above it, the excess passes linearly to ADL counterparties, making the diagonal the socialization boundary.* ![Priority hyperbolas show that a modestly profitable high-leverage position outranks a highly profitable low-leverage one, while loss-making positions (negative scores) are deprioritized regardless of leverage.](/files/CS2T68msYstIM1YaXDYO) *Priority hyperbolas show that a modestly profitable high-leverage position outranks a highly profitable low-leverage one, while loss-making positions (negative scores) are deprioritized regardless of leverage.* ![ADL arms exactly on and below the diagonal fund\_balance = adl\_threshold, showing how the threshold parameter directly sets the fund depletion level at which deleveraging begins.](/files/hOaz60ayMjFXRJLuUcZj) *ADL arms exactly on and below the diagonal fund\_balance = adl\_threshold, showing how the threshold parameter directly sets the fund depletion level at which deleveraging begins.* ## References * Derived from and adversarially verified against the Exchange's Rust implementation and its test suite. * Sibling model: [funding-rate](/math-engine/funding-rate.md) * Sibling model: [liquidation-engine](/math-engine/liquidation-engine.md) * Sibling model: [margin-math](/math-engine/margin-math.md) * Sibling model: [oracle](/math-engine/oracle.md) * Sibling model: [order-book](/math-engine/order-book.md) * Sibling model: [position-tracker](/math-engine/position-tracker.md) * Sibling model: [settlement](/math-engine/settlement.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.nexus.xyz/math-engine/insurance-fund.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.