Insurance Funds & Auto-Deleveraging

The previous lesson ended on a dangling risk: the liquidation engine tries to close a doomed position in the window between the liquidation price and the bankruptcy price — but in a fast, gappy market it can fail, closing below bankruptcy, where the position’s loss exceeds its margin. That shortfall is bad debt, and it has to be paid by someone. This lesson is about the two backstops that catch it: the insurance fund and, when that’s not enough, auto-deleveraging (ADL). These are the shock absorbers that keep a perp exchange solvent through a crash.

Why bad debt happens at all

In a perfect market, the liquidation engine always closes a position somewhere between the liquidation and bankruptcy prices, the trader’s margin covers the loss, and nobody else is affected. Reality is messier.

Analogy. Think of a fire department that liquidates burning buildings before the fire spreads. Usually they arrive in time and the damage stays inside the lot. But in a firestorm — high wind, many fires at once — they sometimes can’t contain a blaze before it jumps the property line, and the damage spills onto the neighbors. The insurance fund is the city’s disaster reserve that pays for that overspill so the neighbors are made whole.

Bad debt arises when the close happens worse than bankruptcy:

• Price gaps. A sudden crash jumps straight past the liquidation price to well below bankruptcy before any keeper can execute — the close fills at a loss bigger than the margin.
• Thin liquidity. Dumping a large liquidated position into a shallow order book pushes the fill price far past bankruptcy.
• Cascades. Many liquidations firing at once flood the book with forced sells, each one worsening the fill for the next — the very cascade we model below.

In all three, the liquidated trader’s margin runs out before the position is closed, and the difference is owed to the profitable counterparties. The system must source that money somewhere.

The insurance fund: a shared reserve that absorbs the overspill

Definition. The insurance fund is a pooled reserve of collateral held by the exchange/protocol whose job is to absorb bad debt from liquidations that close below bankruptcy, so the winning side of every trade still gets paid in full. It’s the first line of defense after a position’s own margin is exhausted.

Where does its money come from? Mostly from liquidation surpluses. Here’s the elegant part: most liquidations close better than bankruptcy — the trader is liquidated at, say, the liquidation price, but the engine actually fills slightly above bankruptcy, leaving a small surplus (the equity that remained between the liquidation trigger and the fill). That surplus is swept into the insurance fund. So in calm markets the fund quietly grows on the back of orderly liquidations, building a war chest for the violent ones.

$\text{insurance fund} \mathrel{+}= \sum (\text{liquidation fills above bankruptcy}) - \sum (\text{bad debt below bankruptcy}).$

In normal conditions the first term dominates and the fund grows; in a crash the second term spikes and the fund is drawn down. A healthy exchange runs a fund large enough to absorb realistic crashes without ever touching the next backstop.

When even the fund runs dry: auto-deleveraging (ADL)

Suppose the cascade is so violent that bad debt exhausts the insurance fund. The winning traders are owed profits that the losing traders’ margin and the fund can’t cover. The exchange refuses to go insolvent. The last-resort tool is auto-deleveraging.

Definition. Auto-deleveraging (ADL) is a mechanism that, when the insurance fund can’t cover a bankruptcy, forcibly closes the positions of profitable traders on the opposite side at the bankruptcy price, using their unrealized profit to absorb the loss. It socializes the unpayable loss onto the traders who can most afford it.

Analogy. Imagine a poker table where one player goes bust owing more than their chips, and the house’s emergency fund is empty. ADL is the table rule that says: the biggest winners must cash out a chunk of their winnings right now, at a fixed price, to cover the deadbeat’s debt — because they’re the ones holding the profit that the loss has to come from. It’s not theft; it’s the only way to settle the table without the house itself going broke.

Who gets deleveraged — the ADL ranking. Not everyone is hit equally. The exchange ranks opposing-side traders by a priority score, and deleverages from the top down. The score combines:

• Profitability — how much unrealized profit the position has (more profit → higher priority to be closed).
• Leverage — higher effective leverage → higher priority.

So the traders most in profit and most leveraged on the opposite side are the first to be auto-closed. The intuition: they have the most “house money” to give up, and their high leverage makes them the riskiest positions to leave open anyway. Most exchanges show you an ADL indicator (a row of lights) warning how near the front of the queue you are.

Worked example: insurance fund, then ADL

Make it concrete. A short position with $2,000 margin and $100,000 notional gets caught in a crash. Its bankruptcy price is where its $2,000 of equity is wiped — but the market gaps, and the engine can only close it at a price where the realized loss is $3,500.

Step 1 — bad debt. Loss ($3,500) exceeds margin ($2,000), so the bad debt is

$3{,}500 - 2{,}000 = \$1{,}500.$

Step 2 — insurance fund absorbs it. Suppose the insurance fund holds $50,000. It pays the $1,500 shortfall to the profitable longs on the other side, so they’re made whole. The fund drops to $48,500. No ADL needed — this is the normal, healthy path.

Step 3 — the fund-exhaustion scenario. Now imagine a far bigger cascade where total bad debt is $70,000 but the fund holds only $50,000. The fund covers $50,000 and is drained to zero; $20,000 of bad debt remains. ADL kicks in: the system walks down the ADL ranking of profitable longs, force-closing them at the bankruptcy price until $20,000 of their unrealized profit has absorbed the remaining loss. A long sitting at the top of the queue with, say, $8,000 of unrealized profit might be fully closed, contributing its profit; the queue continues until the $20,000 is covered.

The punchline: the exchange stays solvent at every step. Bad debt is paid first by the loser’s margin, then by the shared insurance fund, then — only if that’s exhausted — by clawing back the winners’ profits via ADL. Nobody’s deposited collateral is confiscated; ADL only touches unrealized profit on the opposing side.

Seeing the cascade that creates the bad debt

The whole reason bad debt clusters is the cascade: liquidations beget forced selling, which begets lower prices, which begets more liquidations. The simulator below makes the reflexive loop tangible — set a shock, then step it and watch each rung of liquidations push the price into the next rung. Every position closed in that downdraft is a candidate to fill below bankruptcy and feed the insurance fund’s bad-debt tally.

You now understand the full solvency stack of a perp: margin, liquidation engine, insurance fund, and ADL — the layered backstops that let a leveraged 24/7 market survive a crash without the venue going broke. So far we’ve treated “the exchange” as a black box. Next we crack it open: the three competing architectures for a perp DEX — on-chain order books, virtual AMMs, and oracle/pool designs — and the deep trade-offs between decentralization, capital efficiency, and oracle risk that each one makes.