Contract Algorithm Scythe (13): From Forced Liquidation to ADL, Who Should Be Responsible for “Overturning the Table”?

What drove these supposedly "fair" protocols and exchanges to the brink of collapse? When we talk about ADL (Alliance, Liquidation, and Debt) mechanisms, we can't just talk about ADL itself. ADL is the final step in the entire liquidation mechanism. We need to look at the whole liquidation mechanism, including liquidation prices, bankruptcy prices, order book liquidation, insurance funds, and other mechanisms. ADL is merely the final "socialized" outcome; the core is the liquidation mechanism itself, and it's the devastation left after the liquidation mechanism has been exhausted that has brought us to this point. (You and I are both responsible.)

As for why ADL is a greedy queue, you can't understand it if you're in the current context of abundant liquidity and calm. You have to put yourself in the context of ADL happening right now to understand why CEXs design it this way, because it's the solution with the least risk, lowest cost, and least psychological burden.

Reading Guide:

This article is over 7000 words long and contains very technical content. It's recommended that readers unfamiliar with contract liquidation rules first acquire some background knowledge before proceeding: https://x.com/agintender/status/1949790325373026575?s=20

To understand the exchange's clearing process, you can start directly from Chapter 3.

If you are only interested in the HLP mechanism, it is recommended that you skip directly to Chapter 5.

First, ADL is a lifeline for exchanges, not a fair bargaining chip.

Auto-Deleveraging (ADL) is a systemic risk mitigation mechanism in the perpetual contract market. When the market experiences severe volatility, some accounts suffer margin calls, and the exchange's insurance fund is insufficient to cover these losses, the system activates ADL. This involves forcibly liquidating the positions of some profitable accounts to fill the gap, thereby preventing the overall liquidation system from failing. It's important to note that ADL is not a normal operation; it's a "last resort" used only in extreme circumstances.

After an ADL (Advanced Limit Up) is triggered, the system reduces positions according to a set of explicit but not fully disclosed priority rules. Generally speaking, positions with higher leverage and larger floating profit ratios are more likely to be prioritized at the front of the ADL queue for "position optimization".

Regarding the core of ADL, here's a direct quote from Binance's discussion of ADL:

Several key points:

1. The current contract mechanism is already prepared for "margin call".
2. ADL is the final step in the forced liquidation process.
3. This will only occur if the contract risk protection fund is unable to absorb the losses.
4. The larger the risk protection fund, the less frequently ADLs will be triggered.
5. Launching ADL has a negative impact on the market, as it's equivalent to using the profits of those who profit to subsidize the mistakes of those who lose (especially since those who profit are usually large investors, and reducing their profits is tantamount to offending them).
6. We cannot avoid ADLs, but we will try our best to reduce them.

For exchanges/protocols, if the purpose of the liquidation mechanism is to ensure fairness, then ADL is for survival.

II. Liquidation Waterfall: From Market Execution to ADL Trigger

Since ADL is a component of the liquidation mechanism, to explore the triggering details of ADL, we should start from the source.

Generally, exchanges have a "waterfall" order for clearing:

Phase 1: Order Book Liquidation When a user's maintenance margin is insufficient, the liquidation engine first attempts to put the position into the order book as a market order.

Ideally, with sufficient market depth, long positions are absorbed by short orders, positions are closed, and remaining margin is refunded to users. However, in crashes like the one on October 11th, buying pressure dries up, and massive liquidation orders can overwhelm the order book, causing uncontrolled price slippage and resulting in margin calls, thus leading to the second step.

Phase Two: Risk Protection Fund Takes Over. When the order book is unable to absorb the losses, or when users' positions are close to the margin call level, the exchange's insurance fund will intervene to prevent further price collapse.

The risk-protection fund acts as the "buyer of last resort," taking over the position at a price close to (or even better than) the bankruptcy price on some exchanges. The risk-protection fund then attempts to slowly liquidate the position in the market. At this point, the fund holds a large losing position (inventory risk). If prices continue to fall, the fund itself will incur losses.

Phase Three: ADL Triggering This is the most crucial step. When the risk protection fund reaches its threshold, or when the fund's risk control calculations determine that taking over the position would lead to its own bankruptcy, the system will refuse to take over and directly trigger ADL.

The system identifies "victims" among the opposing side (i.e., traders who have correctly predicted the direction and are currently profitable) and forcibly closes their positions at the then-current mark price to offset the impending margin call loss.

Here's the key point: ADL actually has a very important but rarely mentioned "function" here – it's used to stop market declines with winners' money when there's insufficient market liquidity.

Imagine if there were no ADL (Advanced Investment Promotion Agency). In order to survive, the insurance fund would keep placing orders on the order book, causing the price to keep going up or down, which would lead to more panic selling.

III. The Transmission Effect of the Two Liquidation Models on ADL

Many people know about ADL, but probably not many know about the previous clearing models. Generally speaking, there are two main models, and some innovative clearing models today are improvements based on these two models.

Liquidation is the prelude to ADL (Advance Debt Litigation). Different liquidation methods directly determine the frequency, depth, and market impact of ADL triggering. To discuss ADL without discussing liquidation models is simply irresponsible.

3.1 Mode A: Order Book Liquidation

Mechanism: When a user triggers the liquidation line, the liquidation engine directly places the position as a market order into the order book for execution.

The role of the insurance fund: It is used solely to cover "margin call losses". That is, if a market order drives the price below the bankruptcy price, the difference will be covered by the insurance fund.

ADL trigger logic: ADL will only be triggered when the insurance fund reaches zero or the order book is completely exhausted (no more orders).

Impact on the market:

Advantages: Respects market pricing as much as possible and does not interfere with profitable users.

Disadvantages: In extreme market conditions like 10.11, massive liquidation orders can instantly overwhelm liquidity, causing a chain reaction of liquidations. Prices will plummet due to the liquidation orders themselves, leading to even more liquidations and ultimately depleting the risk protection fund.

3.2 Mode B: Backstop/Absorption Mode

Mechanism: When a user triggers the liquidation line, the system will not sell directly to the order book, but the liquidity provider/insurance fund will take over the position directly.

The role of the risk protection fund is to "buy" users' liquidated orders at the bankruptcy price. After absorbing them, the fund sells the orders on the market at an opportune time. If the transaction price is better than the position price, the profit will be credited to the insurance fund; otherwise, the loss will be borne by the insurance fund.

ADL triggering logic: This is the most critical difference between the patterns.

In Mode A, ADL is triggered when the liquidity of the betting market is exhausted and the insurance premium is depleted, meaning there is "no money left to pay out".

In Mode B, ADL is triggered by the risk control of the risk protection fund.

IV. In-depth verification and calculation of the two liquidation models

To answer the question "How do different clearing mechanisms affect ADL?", we first establish a mathematical model to simulate the performance of Mode A and Mode B under extreme market conditions.

4.1 Scenario Assumptions

Market environment: ETH price crashed instantly. Current market depth is extremely poor, with a scarcity of buy orders.

Default Account (Alice):

Positions: Long 10,000 ETH

Liquidation Price: $2,000

Bankruptcy Price (Zero Value): $1,980

Current market conditions:

Buy one price: $1,990 (only 100 ETH)

Buy-second price: $1,900 (only 5,000 ETH) — a precipitous drop

Buy three at $1,800 (includes 10,000 ETH)

4.2 Mode A: Order Book Dumping Mode

Mechanism: The liquidation engine directly puts Alice's 10,000 ETH into the order book at market price without any buffering.

Calculation process: (Simplified calculation, just take a look at the general idea)

make a deal:

100 ETH @ $1,990; 5,000 ETH @ $1,900; 4,900 ETH @ $1,800

Weighted average transaction price (VWAP):

[(100*1990) + (5000*1900) + (4900*1800)] / 10000 = $1852

Loss due to margin call:

Alice's bankruptcy valuation is $1,980.

Loss per ETH: $1,980 - $1,852 = $128

Total loss due to margin call: $128 * 10,000 = $1,280,000

ADL Trigger:

If the insurance fund balance is less than $1.28M, the system must immediately trigger the ADL.

The system will find Bob, a big winner holding short positions, and force him to take profits at $1,980 (even though the market price has now fallen to $1,800, Bob could have earned more).

Scenario A caused the price to plummet to $1,800 instantly, creating huge slippage losses that directly impacted the insurance fund, triggering an immediate and large-scale ADL (Advanced Debt Liability) event.

4.3 Mode B: Takeover/Absorption Mode

Mechanism: The liquidation engine does not sell to the order book. The insurance fund (or HLP pool) directly takes over Alice's position at the forced liquidation price ($2,000) or slightly better than the bankruptcy price ($1,990).

Calculation process:

Takeover: The risk protection fund pool instantly acquired a long position of 10,000 ETH, with an entry cost of $1,990.

Market reaction: The order book price remained at $1,990 (because there was no selling pressure). The market appeared "calm and peaceful".

Inventory Risk: One minute later, external markets (such as Coinbase) dropped to $1,850. The 10,000 ETH held in the risk protection fund pool incurred a floating loss.

($1,990 - $1,850) * 10,000 = $1,400,000

ADL trigger condition:

At this point, the system will not trigger the Action Deadline (ADL) due to "lack of funds to compensate" (because the product hasn't been sold yet). However, the system will perform a risk check:

• If HLP's total funds are $100M, a loss of $1.4M is tolerable -> ADL will not be triggered.
• If HLP only has $5M in funds, a loss of $1.4M is too large -> In order to protect LPs, the system decides to get rid of this hot potato -> triggering ADL.
• Model B protected the order book price in the first second of the crash, preventing a chain reaction of liquidations. However, it stored the risk in the insurance fund. If the market fails to rebound, the insurance fund's losses will continue to amplify, potentially leading to a more aggressive ADL (or, like Hyperliquid 10.11, aggressively ADLing to prevent HLP from being wiped out).

To elaborate further, the reason Hyperliquid triggered ADL on a large scale on October 11th was not because the system ran out of funds, but because HLP Vault, in order to protect itself, proactively transferred the risk to profitable users. This was to prevent a repeat of the previous "Whale Slap" incident (where whales exploited liquidity shortages to harm HLP).

While Mode B protects the order book price from being instantly driven down, it concentrates the "inventory risk" on HLP. Once HLP senses fear (reaching the risk control threshold), it will aggressively use ADL to wipe out profitable users' positions to liquidate accounts and ensure its own survival. Imagine if HLP's daily drawdown reaches 30%—what would most people do? They would immediately withdraw their funds, ultimately leading to a bank run.

One more thing, as my long-time followers know, I've said many times before that the current Perp DEX's clearing mechanism, which is copied from CEXs, will inevitably cause big problems sooner or later. Hopefully, you all understand now, hahaha.

V. Hyperliquid's Unique Architecture: Sensitivity to HLP and ADL

What makes Hyperliquid unique is that, unlike Binance or OKX, it doesn't have a massive, opaque insurance fund backed by the exchange's accumulated profits over the years. Its insurance fund is provided by the HLP Vault.

5.1 HLP: Both a market maker and an insurance fund

HLP is a pool of funds comprised of USDC deposited by community users. It has a dual nature:

Market Maker: It provides liquidity on the order book and earns the spread.

Liquidator: When the above "second phase" occurs, HLP takes over the user's liquidated positions.

This structure results in Hyperliquid's ADL triggering mechanism being significantly different from that of centralized exchanges:

Binance model: Insurance funds are the exchange's "private stash," usually accumulating billions of dollars (?) (this is just my guess, without any basis), so Binance can tolerate huge drawdowns and try not to trigger ADLs in order to maintain the experience of large investors.

Hyperliquid Model: HLPs are users' money. If HLPs lose too much money trying to take over a huge toxic position, it can cause LPs (liquidity providers) to panic and withdraw their funds, triggering a "run" and potentially leading to the exchange's demise. (The Jelly incident has already shown HLPs the power of drawdowns.)

Therefore, Hyperliquid's risk control engine is designed to be extremely sensitive. Once the system detects that the risk of HLP taking over a position is too high, it immediately skips the second stage and directly initiates ADL (Advance Deployment). This is why on October 11, Hyperliquid triggered a large-scale ADL (more than 40 times in 10 minutes), while some CEXs, even if they may have already suffered margin calls internally, chose to hold on with their own funds.

5.2 In-depth analysis: Liquidator Vault mechanism

Liquidator Vault is a sub-strategy within HLP. It is not a separate liquidity pool, but rather a separate "liquidation" logic.

Hyperliquid's liquidation order

When a trader is liquidated and the market is unable to absorb the order (Level 1 failure), the liquidation vault "buys" the defaulted position.

Example: A trader goes long 1000 SOL at $100. The price drops to $90 (liquidation price). The order book has few buy orders. The liquidation vault takes over the 1000 SOL long position at $90.

Instant PnL Confirmation: The user's remaining margin is forfeited. If the margin covered the difference between the entry price and the current mark price, HLP immediately records a "Clearing Fee" profit.

Inventory Unwinding: HLP currently holds a long position of 1000 SOL in a crashing market. It must sell these SOL to mitigate risk. However, assuming these positions cannot be unwound in time and reach their target, an ADL (Advance Limit) will be triggered.

VI. October 11th Incident Retrospective: The Game of Algorithms

Now let's return to the heart of the controversy: On October 11, 2025, Hyperliquid processed over $10 billion in liquidations; more than 40 ADLs occurred within 10 minutes. Some say this is making a mountain out of a molehill? Is that really the case?

6.1 The core of the controversy: Greedy Queue vs. Pro-Rata

Gauntlet CEO Tarun Chitra pointed out that the ADL algorithm used by Hyperliquid resulted in approximately $653 million in “unnecessary losses” (opportunity costs).

The crux of the controversy lies in ADL's sorting algorithm.

Hyperliquid's algorithm: The Greedy Queue. This is a classic algorithm inherited from the BitMEX era. The system sorts all profitable users based on profitability and leverage ratio.

Sorting Score = Profit / Principal * Leverage Ratio

Execution method:

The system starts with the top-ranked user, completely closing out their positions until the losses are covered. Result: The top-performing traders are "killed." Their positions are gone; while they may have preserved their initial profits, they've missed out on the huge potential gains from further market declines.

Gauntlet's proposed algorithm: Risk-Aware Pro-Rata:

Implementation method: Instead of completely eliminating the top performer, the top 20% of profitable users will each have a portion of their positions reduced (e.g., each person closes out 10%).

Advantages: This method preserves a portion of the user's position, allowing them to continue benefiting from subsequent market movements. Gauntlet's backtesting shows that this approach retains more open interest (OI) and reduces harm to users.

6.2 Why does Hyperliquid insist on using a "greedy queue"?

While Gauntlet's algorithm is theoretically fairer, Hyperliquid founder Jeff Yan's rebuttal highlights the real-world constraints:

Speed vs. Determinism: On the L1 chain, computational resources are expensive. Proportional deductions for thousands of users require significant computation and state updates, potentially leading to block delays. In contrast, a "greedy queue" only requires sorting and head removal, resulting in low computational complexity and extremely fast execution speed (milliseconds). In market crashes, speed is life.

HLP's vulnerability: As mentioned earlier, HLP has limited funds. Proportional ADL means that HLP needs to hold some toxic positions for a longer period (waiting for the system to slowly calculate and execute everyone's cuts). For Hyperliquid, quickly cutting off risk (by completely liquidating large positions) is more important than so-called "fairness".

VII. What is the truth about greedy queues?

If everyone reads the whole thing, they will know that 40+ ADLs in 10 minutes is the essence of HLP's mechanism. In the eyes of big traders, HLP contributors are the foundation of Hyperliquid.

Greedy queues are not a new algorithm created by Hyperliquid; in fact, this algorithm has existed for many years and is still widely used by centralized exchanges. Did they not consider the security of the liquidity pool when using greedy queues? Or the limitations of computational load and speed? And in the numerous ADLs that have occurred throughout history, did the affected large investors not seek redress? Did they protest? Obviously not.

The real reason is that, for centralized exchanges (CEXs), the greed queue is a solution that is reasonable, relatively fair, and cost-controllable within the existing mechanisms.

Returning to the previously mentioned liquidation modes A and B, the conditions for triggering ADL are:

1. Market volatility
2. Market liquidity is essentially in a "vacuum" state.
3. The risk protection fund suffered severe losses.

For large investors using ADL (Alternative Leverage), they are well aware that at that point in time, there is not enough liquidity in the market to absorb their profitable positions. In fact, in the past, due to some technical reasons, it was even impossible to log in to the exchange account during periods of severe market volatility. Therefore, ADL operations have become a function of the exchange assisting in "profit-taking," because many profitable positions may not be able to be executed at that critical juncture.

In addition, it is psychologically easier to accept earning less than losing money, especially after learning that the exchange itself has also suffered a heavy loss. This sense of happiness is somewhat comforting when compared.

As for why it must be a greedy sequence, besides the somewhat strange and simplistic logic that the more you earn, the greater your responsibility, the main reason is actually that fewer people are affected.

What CEXs fear most isn't margin calls or losses, but public opinion! They prefer to see only a small group of people suffer losses rather than a large group, allowing for private, one-on-one or group-to-one communication to resolve issues. It's important to understand that market dynamics don't end after liquidation/ADL; there are subsequent disputes, complaints, threats, and so on. Many conflicts are resolved off-market.

8. Is there a better algorithm?

Yes, there are, but they are not better ADL algorithms. At this stage, the focus should be on how to prevent ADL from occurring.

Since this is not the focus of this article, I will simply use a table to illustrate it below. For those working in the exchange industry, the hints in the chart should be sufficient.

Of course, if any traders have the "courage" to implement a circuit breaker system, it would truly prevent a lot of unnecessary noise.

Not only do we know what it is, but we also know why it is so.

May we always maintain a sense of awe and respect for the market.