Every rule a position lives by, with the numbers.

A position is one signed quantity per account and market. Its margin is collateral moved from the account’s available bucket into the locked bucket of the vault, and only that margin can be lost on that position. Up to 32 positions per account may be open at once; each is independent.

Initial margin

Opening or increasing a position requires initialMarginFraction (IMF) of the new notional, where IMF = 1 / maximum leverage. The launch markets use 20x for BTC, ETH, SOL and the indices (IMF 5%), 10x for HYPE, equities and metals and oil (10%), and 5x for natural gas (20%).

Maintenance margin

A position may be liquidated when its equity, margin plus unrealized PnL at the mark, falls below maintenanceMarginFraction (MMF) of its notional at the mark. In the launch catalogue MMF is half the IMF.

Reservation for resting orders

An order reserves, at placement, the initial margin and the taker fee for its full quantity at its limit price. The reservation moves from available to reserved, returns on cancellation or expiry, and is released in proportion as the order fills (the fill then locks the real margin and charges the real fee). Reduce-only orders reserve nothing.

Adding and removing margin

A position’s owner can add margin from available at any time, and remove it as long as the position stays at or above its initial margin requirement at the mark with funding settled first. There is no cross-margin: a healthy position never covers an unhealthy one.

• Two-sided book: the mid of the best bid and best ask, clamped to the band around the index.
• One-sided or empty book: the index itself.
• Invalid index: there is no mark. Liquidation, funding settlement and margin removal revert with OracleInvalid; the market is halted.

Three prices are therefore never conflated: the index (the validated reference from the registry), the mark (above), and the last trade (a fact about the book, used by charts and nothing else). Market orders use the mark too: their protective limit is the mark moved by maxImpactBps (1% at launch), tightened by the trader’s own protection price.

Premium accrual

On every state change of a market, and whenever anyone calls accruePremium, the engine adds premium × elapsed seconds to the market’s accumulator, where premium is (mark − index) / index. Seconds during which the index was invalid add nothing: a halted market neither pays nor receives funding for the gap.

Settlement

At each interval boundary (every 60 minutes at launch) settleFunding, callable by anyone, turns the average premium into a rate. Premiums are quoted per 8 hours, the industry reference period, and prorated to the market’s interval, so an hourly interval pays one eighth of the 8-hour premium. The rate is clamped to maxFundingRatePerInterval (0.0375% per interval (0.000375)).

Payment

A position pays or receives qty × (cumulativeIndex now − cumulativeIndex at its last settlement) whenever it is touched: on a fill, a liquidation or a margin change. A positive rate means longs pay shorts; a negative rate means shorts pay longs. Payments owed are taken from the position’s margin (and, should the margin not suffice, from the insurance fund, which halts the market if it cannot cover); payments received are added to margin.

Who and when

Anyone except the position’s owner may call liquidate(account, marketId, maxQty) on a position whose equity is below maintenance margin, in a market that is not halted or inactive, with a valid index. maxQty is the most the liquidator is willing to take over; the call reverts with LiquidationQtyTooSmall if that is less than the quantity the formula requires.

How much

A partial liquidation leaves the remaining equity in the position and must bring it back to the initial margin ratio after the fee. The engine solves for the smallest quantity that does so, rounds it up to the lot, and liquidates everything if the result would be the whole position or would leave less than the minimum order quantity.

What happens

1. Funding is settled for both the position and the liquidator.
2. PnL on the liquidated quantity is realized at the mark: a gain is added to the margin; a loss is taken from it, and past the margin from the insurance fund.
3. The penalty, liquidationFeeBps (1%) of the liquidated notional, is taken from the remaining margin (never more than remains) and split: liquidatorShareBps (50%) to the liquidator’s available collateral, the rest to the insurance fund.
4. The liquidator takes over the quantity at the mark on the same side, locking its own initial margin for it, subject to the market’s position limit.
5. On a full liquidation whatever margin remains after loss and penalty is returned to the trader’s available collateral.
6. Liquidated and two PositionChanged events record it all; if any bad debt was recorded the market is halted with reason BadDebt.

1. The position’s margin. A loss, a funding payment or a liquidation penalty is taken from the position’s own locked margin first.
2. The insurance fund. Whatever the margin could not cover is requested from the fund (coverFromInsurance). The covered amount moves into the PnL pool, where it backs the counterparties’ gains in full.
3. Bad debt. Whatever the fund could not cover is recorded as bad debt (BadDebtRecorded), the market is halted with reason BadDebt, and the status page shows the total. A bad-debt halt is never lifted automatically: a market manager lifts it after the fund has been replenished.

The fund is credited by 50% of every trading fee, by the insurance share of every liquidation penalty, and by voluntary contributions through fundInsurance. In this version no function pays it out: it can only grow or cover losses. When the collateral is the test dollar, the fund is seeded with it at deployment.

There is no auto-deleveraging. The thesis requires any such mechanism to be separately specified, simulated and tested before it is enabled, and none has been.

Prices are USD per unit of the underlying, quantities are units of the underlying, collateral is USD. Token decimals are normalised once, at the vault’s edge: a deposit of 1,000.000000 tUSD (6 decimals) becomes 1,000 × 10¹⁸ in the ledger, and scale = 10¹². Basis-point parameters are the only non-WAD numbers and are always named *Bps.

The dust these rules leave between a gain rounded down and the matching loss rounded up stays in the vault’s PnL pool, so rounding can never create collateral. The terminal’s estimates use the same functions (@elysta/protocol’s mulWad, mulWadUp, divWadUp) so that what you see before signing is what the chain computes.

On every refreshIndex the registry reads the market’s primary adapter, falls back to the secondary when the primary is missing or stale, and accepts a price only when all of the following hold:

1. The price is positive and the observation is no older than heartbeatSeconds (90 s for crypto, 180 s for scheduled markets at launch).
2. The move from the last valid price is within maxDeviationBps (2%), or within reopenDeviationBps (20%) when more than reopenGapSeconds (2 h) have passed since the last accepted update, because a market reopening after a closed session may gap.
3. Otherwise the price is held as pending. If later observations stay consistent with it for deviationConfirmSeconds (120 s) the move is confirmed and adopted; if they return to the old level the pending price is discarded.

While a market has no acceptable price its status becomes Halted, the safe state: no orders, no matching, no liquidation, no funding settlement. Open positions keep their margin and can still be cancelled out of resting orders. A fresh valid price lifts an oracle halt automatically (MarketStatusChanged, reason OracleRecovered); an oracle manager can also lift it by hand after review, optionally adopting the pending price. A halt caused by bad debt is never lifted by a price.

The status page shows the same vault figures beside the health of every service and oracle feed, refreshed every ten seconds.