What drives protocols and exchanges that claim to be "fair" to flip the table? When we talk about ADL, we cannot just talk about ADL. ADL is the final process of the entire liquidation mechanism. What we need to look at is the entire liquidation mechanism, including the liquidation price, bankruptcy price, order book liquidation, insurance fund, and other mechanisms - ADL is merely the final "socialized" result. The core issue is actually the liquidation mechanism, and it is the devastation after the exhaustion of the liquidation mechanism that has brought us to this moment. (You and I should both take responsibility~)
As for why ADL is a greedy queue? If you stand in the current context of ample liquidity and calmness, you cannot understand it. You need to put yourself in the context of when ADL occurs to understand why CEX is designed this way, as it is the solution with the least risk, lowest cost, and minimal psychological burden.
Reading Guide:
This article is over 7000 words long and contains very hardcore content. It is recommended that those who do not understand what contract liquidation rules are first supplement their background knowledge before reading: https://x.com/agintender/status/1949790325373026575?s=20
If you are clear about the exchange's liquidation process, you can start directly from Chapter 3.
If you are only interested in the HLP mechanism, it is recommended to jump directly to Chapter 5.
1. ADL is a Lifeline for Exchanges, Not a Fair Lever
ADL (Auto-Deleveraging) is a system-level risk backstop mechanism in the perpetual contract market. When the market experiences severe fluctuations, and some accounts face liquidation, and the exchange's insurance fund is insufficient to cover these losses, the system will initiate ADL by forcibly liquidating some profitable accounts to fill the gap, thereby preventing the overall liquidation system from failing. It is important to note that ADL is not a normal operation; it is a "last resort" that is only activated in extreme situations.
After ADL is triggered, the system reduces positions according to a set of clear but not fully disclosed priority rules. Generally speaking, the higher the leverage and the greater the proportion of floating profits, the more likely the position is to be prioritized in the ADL queue for "position optimization."
Regarding the core of ADL, here is a statement from Binance about ADL:
Key points:
- The current contract mechanism is already prepared for "liquidation."
- ADL is the last step of the liquidation process.
- It only occurs when the contract risk protection fund cannot absorb the losses.
- The larger the risk protection fund, the less frequently ADL is triggered.
- Initiating ADL has a negative impact on the market, equivalent to using the money of winners to subsidize the mistakes of losers (especially since winners are usually large players, reducing their profits is offending them).
- We cannot avoid ADL, but we will do everything possible to minimize it.
For exchanges/protocols, if the purpose of the liquidation mechanism is to ensure fairness, then ADL is for survival.
2. Liquidation Waterfall: From Market Transactions to ADL Trigger
Since ADL is part of the liquidation mechanism, to explore the details of ADL's trigger, we should start from the source.
Generally speaking, exchanges have a "waterfall" sequence for liquidation:
Phase One: Order Book Liquidation When a user maintains insufficient margin, the liquidation engine first attempts to throw that position into the order book as a market order.
Ideally, if the market depth is sufficient, the long liquidation orders will be consumed by short orders, closing the position, and the remaining margin will be refunded to the user. However, in a crash like that on October 11, when buying pressure is exhausted, a huge liquidation order can directly penetrate the order book, causing price slippage to spiral out of control, leading to liquidation, thus moving to the second step.
Phase Two: Risk Protection Fund Takes Over When the order book cannot absorb the position, or the user's position is close to the bankruptcy line, to prevent further price collapse, the exchange's insurance fund will intervene.
The risk protection fund acts as the "last buyer," taking over the position at a price close to (some exchanges may offer better than) the bankruptcy price. The risk protection fund will then attempt to slowly liquidate this position in the market. At this point, the fund holds a massive losing position (inventory risk). If the price continues to fall, the fund itself will incur losses.
Phase Three: ADL Trigger This is the most critical step. When the risk protection fund reaches its threshold, or the fund's risk control calculations indicate that taking over the position would lead to its own bankruptcy, the system will refuse to take over and directly trigger ADL.
The system looks for "sacrifices" among the counterparties (i.e., traders who are on the right side and making profits), forcibly liquidating their positions at the current mark price to offset the impending liquidation loss.
Here’s the key point: ADL actually has a very important but rarely mentioned "function" — to use the money of winners to stop the decline when market liquidity is insufficient.
Consider this: if there were no ADL, the insurance fund would have to keep executing orders in the order book to survive, causing the price to keep moving up/down, leading to more cascading liquidations.
3. Two Liquidation Models and Their Transmission Effects on ADL
Many people know about ADL, but probably not many understand the liquidation models prior to ADL. Generally, there are two main models, and some innovative liquidation models are also improvements based on these two models.
Liquidation is the prelude to ADL. Different liquidation handling methods directly determine the frequency, depth, and impact of ADL triggers on the market. Discussing ADL without discussing liquidation models is disingenuous.
3.1 Model A: Order Book Liquidation
Mechanism: When a user triggers the liquidation line, the liquidation engine directly throws that position into the order book as a market order.
Role of the insurance fund: Only used to cover "liquidation losses." That is, if the market order drives the price below the bankruptcy price, the difference will be compensated by the insurance fund.
ADL trigger logic: ADL will only be triggered when the insurance fund is depleted or the order book is completely exhausted (no buy orders left).
Impact on the market:
Advantages: Respects market pricing as much as possible, does not interfere with profitable users.
Disadvantages: In extreme market conditions like October 11, a huge liquidation order can instantly penetrate liquidity, causing a chain reaction of liquidations. Prices can plummet due to the liquidation order itself, leading to more liquidations and quickly depleting the risk protection fund.
3.2 Model B: Backstop/Absorption
Mechanism: When a user triggers the liquidation line, the system does not directly sell into the order book but has liquidity providers/insurance funds directly take over the position.
Role of the risk protection fund: It "buys" the user's liquidation order at the bankruptcy price. After absorbing it, it will sell the order in the market at an opportune time. If the selling price is better than the position price, the profit will be credited to the insurance fund; otherwise, the loss will be borne by the insurance fund.
ADL trigger logic: This is the most critical difference between the models.
In Model A, ADL is triggered only when the order book's liquidity is exhausted and the insurance fund is depleted, meaning "there's no money to compensate."
In Model B, ADL is triggered based on the risk control of the risk protection fund.
4. Deep Verification and Calculation of Two Liquidation Models
To answer "how different liquidation mechanisms affect ADL," we first establish a mathematical model to simulate the performance of Model A and Model B under extreme market conditions.
4.1 Scenario Assumptions
Market Environment: ETH price crashes instantaneously. Current market depth is extremely poor, with scarce buy orders.
Default Account (Alice):
Position: Long 10,000 ETH
Liquidation Trigger Price: $2,000
Bankruptcy Price: $1,980
Current Market Order Book:
Best Bid Price: $1,990 (only 100 ETH)
Second Bid Price: $1,900 (only 5,000 ETH) — cliff-like depth
Third Bid Price: $1,800 (10,000 ETH available)
4.2 Model A: Order Book Liquidation
Mechanism: The liquidation engine directly throws Alice's 10,000 ETH into the order book as a market sell order without any buffer.
Calculation Process: (Simplified calculation, just for a general idea)
Transactions:
100 ETH @ $1,990; 5,000 ETH @ $1,900; 4,900 ETH @ $1,800
Weighted Average Transaction Price (VWAP):
[ (1001990) + (50001900) + (4900*1800) ] / 10000 = $1852
Liquidation Loss:
Alice's bankruptcy price is $1,980.
Loss per ETH: $1,980 - $1,852 = $128
Total Liquidation Loss: $128 * 10,000 = $1,280,000
ADL Trigger:
If the insurance fund balance is $1.28M, the system must immediately trigger ADL.
The system will find the profitable large trader Bob holding short positions and forcibly liquidate his position at $1,980 (even though the current market price has dropped to $1,800, Bob could have made more).
Model A causes the price to instantly crash to $1,800, creating significant slippage losses, directly penetrating the insurance fund, leading to immediate and large-scale ADL triggering.
4.3 Model B: Backstop/Absorption
Mechanism: The liquidation engine does not sell into the order book. The insurance fund (or HLP pool) directly takes over Alice's position at the liquidation price ($2,000) or slightly better than the bankruptcy price ($1,990).
Calculation Process:
Takeover: The risk protection fund pool instantly holds a long position of 10,000 ETH, with an entry cost recorded as $1,990.
Market Reaction: The order book price remains at $1,990 (because there is no selling pressure). The market appears "calm."
Inventory Risk: One minute later, the external market (e.g., Coinbase) drops to $1,850. The risk protection fund pool holding this 10,000 ETH incurs a floating loss:
($1,990 - $1,850) * 10,000 = $1,400,000
ADL Trigger Judgment:
At this point, the system will not trigger ADL due to "no money to compensate" (because it hasn't sold yet). However, the system will conduct a risk check:
- If the total funds of HLP are $100M, a loss of $1.4M can be tolerated -> ADL is not triggered.
- If HLP funds are only $5M, a loss of $1.4M is too large -> To protect LPs, the system decides to throw this hot potato away -> ADL is triggered.
- Model B protects the order book price in the first second of a crash, avoiding a chain of liquidations. However, it accumulates risk within the insurance fund. If the subsequent market does not rebound, the losses of the insurance fund will continue to amplify, potentially leading to more aggressive ADL (or, like Hyperliquid on October 11, to prevent HLP from losing all its funds, aggressively triggering ADL).
To add, Hyperliquid's large-scale triggering of ADL on October 11 was not because the system ran out of money, but because the HLP Vault actively transferred risk to profitable users for self-protection. This was to prevent a repeat of the previous "Whale Slap" incident (where whales exploited insufficient liquidity to harm HLP).
Although Model B protected the order book price from being instantly breached, it concentrated the "inventory risk" on HLP. Once HLP feels fear (reaching the risk control threshold), it will aggressively "kill" the positions of profitable users through ADL to balance the books and ensure its survival. Imagine if HLP experienced a 30% drawdown in a day, what would most people do? They would directly withdraw their investments, leading to a bank run.
To add, my long-time followers know that I have repeatedly stated that the current Perp DEXs copying the liquidation mechanisms of CEXs will eventually encounter major problems. I believe everyone can understand this a bit better now, right? Hahaha
5. Hyperliquid's Special Structure: Sensitivity of HLP and ADL
The uniqueness of Hyperliquid lies in the fact that it does not have a large, opaque insurance fund accumulated over the years like Binance or OKX. Its insurance fund is borne by the HLP Vault.
5.1 HLP: Both Market Maker and Insurance Fund
HLP is a fund pool composed of USDC deposited by community users. It has a dual personality:
Market Maker: It provides liquidity on the order book and earns the spread.
Liquidator: When the aforementioned "second phase" occurs, HLP is responsible for taking over the user's liquidated position.
This structure leads to a liquidation mechanism for Hyperliquid that is fundamentally different from centralized exchanges:
Binance Model: The insurance fund is the exchange's "private money," usually accumulating billions of dollars (?). (This is my guess, without basis), so Binance can tolerate significant drawdowns, trying to avoid triggering ADL to maintain the experience of large traders.
Hyperliquid Model: HLP is the users' money. If HLP incurs excessive losses to take over a large toxic position, it will cause LPs (liquidity providers) to panic and withdraw their funds, triggering a "bank run," leading to the death of the exchange. (The Jelly incident has already shown HLP the power of drawdowns.)
Therefore, Hyperliquid's risk control engine is designed to be extremely sensitive. Once the system detects that the risk of HLP taking over a position is too high, it will immediately skip the second phase and directly initiate ADL. This is why on October 11, Hyperliquid triggered large-scale ADL (over 40 times in 10 minutes), while some CEXs chose to withstand internal liquidations with their own funds.
5.2 In-Depth Analysis: Liquidator Vault Mechanism
The Liquidator Vault is a sub-strategy within HLP. It is not an independent fund pool but another set of "liquidation" logic.
Hyperliquid's liquidation order
When a trader is liquidated and the market cannot absorb that order (1st layer failure), the Liquidator Vault "buys" the defaulted position.
Example: A trader goes long 1000 SOL at $100. The price drops to $90 (liquidation price). The order book has thin buy orders. The Liquidator Vault takes over this 1000 SOL long position at $90.
Immediate PnL Confirmation: The user's remaining margin is confiscated. If the margin covers the difference between the entry price and the current mark price, HLP immediately records a "liquidation fee" profit.
Inventory Release: HLP now holds a long position of 1000 SOL in a crashing market. It must sell these SOL to neutralize the risk. However, if these positions cannot be cleared in time, it will trigger ADL.
6. Review of the October 11 Incident: The Game of Algorithms
Now let's return to the core of the controversy: On October 11, 2025, Hyperliquid handled over $10 billion in liquidation volume; ADL was triggered over 40 times in 10 minutes. Some say this is completely overblown? Is it really so?
6.1 The Core of the Controversy: Greedy Queue vs. Pro-Rata
Tarun Chitra, CEO of Gauntlet, pointed out that the ADL algorithm used by Hyperliquid led to approximately $653 million in "unnecessary losses" (opportunity costs).
The focus of the controversy is on the sorting algorithm of ADL.
Hyperliquid's Algorithm: Greedy Queue, a classic algorithm inherited from the BitMEX era. The system ranks all profitable users based on profitability and leverage:
Ranking Score = Profit / Principal * Leverage Multiple
Execution Method:
The system starts with the top-ranked user, completely liquidating their position until the loss gap is filled. As a result, the "best-performing traders" at the top of the ranking are "killed." Their positions are gone, and while they preserve their current profits, they lose out on the huge potential gains from the subsequent market downturn.
Gauntlet's Proposed Algorithm: Risk-Aware Pro-Rata:
Execution Method: Instead of completely liquidating the top-ranked user, a portion of the positions of the top 20% of profitable users is reduced (e.g., each is liquidated by 10%).
Advantages: Retains part of the users' positions, allowing them to continue enjoying the subsequent market. Gauntlet's backtesting shows that this method can retain more open interest (OI) and reduce harm to users.
6.2 Why Does Hyperliquid Insist on Using the "Greedy Queue"?
Although Gauntlet's algorithm is theoretically fairer, Hyperliquid founder Jeff Yan's rebuttal reveals the constraints of reality:
Speed and Certainty: On L1 chains, computational resources are expensive. Proportional reductions for thousands of users require a lot of computation and state updates, which may lead to block delays. The "Greedy Queue" only requires sorting and cutting off the head, with low computational complexity and extremely fast execution (in milliseconds). In a market crash, speed is life.
HLP's Vulnerability: As mentioned earlier, HLP has limited funds. Proportional ADL means HLP needs to hold some toxic positions for a longer time (waiting for the system to slowly calculate and execute everyone's reductions). For Hyperliquid, quickly cutting off risk (by completely liquidating large traders) is more important than so-called "fairness."
7. What is the Truth About the Greedy Queue?
If everyone can read through this, they will know that the 40+ ADLs in 10 minutes are the essence of HLP's mechanism. In front of large traders, HLP's contributors are the foundation of Hyperliquid.
The Greedy Queue is not a new algorithm created by Hyperliquid; in fact, this algorithm has existed for years and is still widely used by many CEXs. Did they not consider the safety of the fund pool when using the Greedy Queue? Did they not consider the limitations of computation and speed? And with so many historical ADLs, did those affected large traders not defend their rights? Did they not protest? Obviously not.
The real reason is: For centralized exchanges (CEXs), the Greedy Queue is a solution that is reasonable, relatively fair, and cost-controllable based on existing mechanisms.
Returning to the earlier discussion of liquidation Model A and Model B, the conditions for triggering ADL are:
- Market volatility
- Market liquidity is essentially in a "vacuum" state
- The risk protection fund has suffered significant losses
For the large traders affected by ADL, they also understand that at that time, there was not enough liquidity in the market to absorb their profitable positions. In fact, due to some technical reasons in the early years, during severe market fluctuations, even the exchange accounts could not be logged in, so the ADL operation effectively became a function of the exchange assisting in "locking in profits," as many profits at that critical moment might not be able to be executed.
Moreover, compared to losses, earning less is psychologically easier to accept, especially after learning that the exchange itself also suffered significant losses. This sense of happiness, once compared, can make people feel somewhat relieved.
As for why it must be a greedy sequence, aside from the somewhat strange logic that the more one earns = the greater the responsibility, the main reason is: fewer people are affected.
What do CEXs fear the most? Not liquidation? Not losses? But public opinion! Rather than having a large number of people suffer losses, they prefer to see only a small portion of people affected. In this way, they can communicate privately one-on-one or in small groups to resolve issues. Everyone should know that the game in the market does not end with liquidation/ADL; there are also subsequent disputes, complaints, threats, etc. Many disputes are resolved off the books.
8. Is There a Better Algorithm?
Yes, but it is not a better ADL algorithm. At this stage, the focus should be on how to prevent the occurrence of ADL.
Since this is not the focus of this article, I will simply use a table to summarize it. The hints in the chart should be sufficient for practitioners in exchanges.
Of course, if you have the "courage" to implement a circuit breaker system, it would really prevent a lot of unnecessary discussions:
https://x.com/agintender/status/1990373165957091590?s=20
Know the facts and understand the reasons behind them.
May we always hold a heart of reverence for the market.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
