Liquidations and risk
Losses stay in the market that made them. Keepers repay unhealthy loans first, and any shortfall burns junior capital before it reaches senior LPs.
Updated Nov 9, 2026
Losses in a market are allocated in a fixed order and never leave the market.
Lending positions
A public borrow becomes liquidatable when its debt exceeds its stored liquidation factor applied to a linear mark at the symmetric price average. From there, a keeper requests a permitted quote; no observation transaction or timer comes first.
An atomic flash fill releases collateral and collects a fixed net debt-token payment in one transaction. Partial fills must improve health after all costs.
The ordinary discount, 0.5%–5%, follows current health and does not grow with time.
Emergency internal settlement uses EMA price and smoothed depth once the position meets the separate emergency health boundary. Full closure has additional on-chain feasibility rules. It can realize losses; it is not a guarantee that the reference valuation is executable elsewhere.
Recovery protects principal first. A funded principal loss falls on Junior LP, up to its entire backing, then on senior srLP for any remainder. Unpaid interest is cancelled without generating revenue.
Junior capital is the market's only loss buffer, and it stays in the pool earning LP income rather than sitting in a separate fund. The solvent liquidation charge is fixed at 300 bps.
See Liquidations for the numeric defaults, owner payouts and timing. Keepers remain a liveness dependency: a permitted liquidation does not execute automatically, and a larger discount cannot guarantee a buyer.
Leverage positions
Leverage eligibility uses linear symmetric-EMA equity against the position's stored maintenance requirement. It does not require a failing live-AMM exit quote.
Removing liquidity alone does not change that health trigger. Price impact and fees still matter to execution and recovery once liquidation is permitted.
hLP vaults
A vault whose funding debt outgrows its opposite claim can attract recovery swaps with a discount of up to 5%, or use atomic hLP flash recovery to source payment externally.
An insolvent vault can use terminal closeout with principal-first recovery, junior-first then senior principal loss allocation and cancellation of unpaid interest. Already funded holder yield remains accounted for.
There is no separate rescue_hlp instruction. The hLP mechanics page describes these paths.
Controls that keep failures local
-
Isolation. Collateral, debt and losses belong to one market.
-
Reduce-only. An emergency key fixed in the program can switch a market, or the whole protocol, into reduce-only: no new borrows, deposits, leverage or proposals, while spot swaps, repayments, liquidations, collateral top-ups and cash-available withdrawals keep working.
-
Market health floor. A borrow or withdrawal that would push the market below its health floor is refused.
-
The daily borrow bucket. New public credit per asset is capped at 20% of conservative depth per day by default.
-
Launch controls. A market can open trading at a set time, gate liquidity, and run a fee schedule and a directional size premium during launch.
-
Operator changes. Settings execute only after full notice and their required market admission checks. Oracle providers and feeds are creation-only; LP balances do not grant authority.
-
First-loss capital. Junior LP absorbs funded losses before srLP, and leaving it takes a notice of seven to ten days, so the capital is still there when a loss arrives.
-
Cached risk books. Risk prices are rolled from cached observations, so a same-transaction swap cannot steer a borrow or a liquidation.
What each participant is exposed to
| You are a | Your main risks | What limits them |
|---|---|---|
| Trader | Price impact in thin markets; surcharges in stress; transfer fees on Token-2022 mints | A quoted minimum output enforced on-chain; the 50% fee cap |
| Borrower | Price falls reaching liquidation health through the symmetric average; interest climbing while Junior LP coverage is low; liquidation costs | The 5% buffer, the stored factor, the health readout, sponsored protection orders |
| Liquidity provider (srLP) | Impermanent loss; loss beyond all junior capital; slow exits under high utilization | Junior LP's first-loss capital, atomic fills, bounded emergency settlement |
| Junior LP (jrLP) | The market's funded losses first, up to a wipeout; a notice before leaving | The junior income share, the coverage-driven borrow rate |
| hLP depositor | Funding erosion; settlement waits; a vault exhausted by funding | Deposit admission against cash headroom, recovery discounts, terminal closeout that protects principal |
| Leverage trader | Execution losses in thin depth; declining EMA equity; orders that need a keeper | Stored margin terms, maintenance buffer and partial recovery |
| Keeper | Races with other keepers and with liquidations; stale state | Typed skip outcomes and revalidation, described in keeper operations |
Limitations the design does not remove
The whitepaper is explicit about these, and so are we. Cash exhaustion can stop an otherwise valid withdrawal or quote from settling.
Internal price filters lag and can be manipulated over time, and a positive tail does not guarantee useful size at every price. Funding growth can erode hLP equity even when the hedge is reconstructed correctly.
Liquidator participation, hLP flash recovery and terminal calls are liveness assumptions. Junior capital is finite, and explicit loss accounting decides who bears a loss rather than preventing it.