Liquidation Engine Design: What Operators Have to Get Right at Scale

The liquidation engine is where a venue quietly succeeds or publicly explodes. Nothing else on the platform gets scrutinised the same way - not by traders, not by the risk desk, not by the operator's own compliance team when something goes wrong. Every large loss event in perpetuals history traces back to a design decision made at the platform layer: a mark-price feed that was not properly blended, a close-out algorithm that dumped the whole position at market, a cross-margin engine that let one position cascade into unrelated books, or an ADL queue that surprised profitable counterparties.

This is a playbook for operators - what has to be designed into the liq engine so it does not produce nasty edge cases at scale. It is written from the perspective of a team that has shipped matching engines, hedging stacks and venue infrastructure across roughly thirty combined years, and has seen every one of the failure modes below happen on someone else's platform.

Mark Price Is the Trigger - Design the Feed First

Liquidations do not trigger on the last-traded price of the perpetual. Every serious venue triggers on a mark price - a smoothed, index-weighted fair value computed from external spot sources and blended with the perpetual's own funding basis. The mark-price feed is the single most important input to the liq engine, and the design decisions that go into it determine how often the venue publishes incident reports.

The pattern that works:

• At least three independent spot sources per symbol. Two is not enough - a single upstream outage takes the median with it. Three lets the engine reject one bad source cleanly
• Median filtering, not mean. A glitching upstream printing $58,000 while the other two sources sit at $63,500 must not shift the mark. Mean weighting cascades; median rejects
• Rate limiting on ingestion. Sub-second updates are fine; unbounded updates from a burst source can move the mark faster than the engine can react
• Staleness gates. If a source stops printing for more than a few seconds it drops out of the median automatically. The engine has to know the difference between a quiet market and a dead feed
• Blended funding basis, not raw perpetual mid. The perpetual book itself is one input, weighted low, so book manipulation on the venue cannot swing the mark against the trader

Get the feed right and most of the failure modes below become theoretical. Get it wrong and every other design decision in the liq engine is compensating for a broken input. The team has seen venues that shipped every other layer correctly and still cascaded because someone chose a two-source feed to save cost. See the mark-price section of Matching Engine Architecture for the fuller decomposition.

Bankruptcy Price and Maintenance Margin Interplay

Bankruptcy price is the price at which the position's remaining margin equals zero. Maintenance margin rate is the buffer between the mark price at which the engine starts closing and the bankruptcy price at which the trader has nothing left. That gap is the operator's slippage budget.

The design decision is how wide to make it. Too narrow and the engine cannot close cleanly during volatility - every close-out eats into the insurance fund. Too wide and the venue pushes traders into liquidation earlier than a competitor, and the flow moves. The bands that have converged across institutional venues:

• BTC and ETH perpetuals: 0.5% maintenance
• Large-cap alt perps: 1.0%
• Equity perps: 2.0-3.0%
• Major forex pairs: 0.3-0.5%
• Commodities: 1.0%

These are not arbitrary. Each is calibrated to the typical fast-move behaviour of the underlying and the depth of the perpetual book against which close-out orders will actually fill. An operator running an equity-perp book on a 0.5% maintenance margin is one earnings gap away from a socialised loss event.

The Close-Out Algorithm: Partial, Banded, Reduce-Only

The worst thing a liquidation engine can do is dump the entire position at market the moment the account crosses maintenance. Every design that has done this has produced the same result - a self-inflicted price cascade that liquidates more accounts, deepens the discount, and burns through the insurance fund faster than the operator can respond.

The pattern that works:

• Partial close first. Close only enough to restore the account above maintenance. If that is 30% of the position, close 30% and stop. The remaining 70% still belongs to the trader
• Priority queue by unrealised loss. In cross-margin, the position with the largest unrealised loss (as a percentage of posted margin) closes first. Not the largest notional, not the oldest position - the worst one
• Reduce-only routing. Close orders route through the live order book with the reduce-only flag set. They cannot flip the position or open new exposure elsewhere
• Price bands, not market orders. The engine walks the book with a price band relative to mark - typically 1-3% depending on symbol depth. Beyond the band the order pauses; it does not chase
• TWAP for large positions. Positions above a size threshold slice into TWAP tranches over 30-120 seconds rather than hitting the book all at once. Full-size market orders on a stressed book are how a $10M position becomes a $6M realised loss

The design intent is minimum harm. Close what is needed, at the best price the book actually offers, without inflating the very move that triggered the liquidation.

Cross-Margin Cascade Prevention

Cross-margin is the default on modern venues because it captures the efficiency of a shared collateral pool. It also introduces a specific failure mode: one position hitting maintenance can drag unrelated positions through slippage on the shared pool, even when those positions are perfectly healthy on their own.

Design guards that stop this:

• Position-level fair-value marking. Each open position is marked independently against its own mark price. The engine never uses a cross-position blended mark that lets a stale symbol pull down a fresh one
• Sequential liquidation with re-evaluation. After each partial close, the engine recomputes the account margin ratio. If maintenance is restored, the cascade stops. It does not blindly work down the queue
• Hedge recognition inside the pool. A short perp offsetting a long spot on the same instrument must be recognised as a net position, not two independent risks. Otherwise the operator liquidates hedged books that carry near-zero real risk. See Multi-Asset Margin Explained for the netting mechanics
• Isolated-margin escape hatch per position. Traders opting into isolated for a specific trade get a hard cap; the rest of the account is not exposed. The engine has to enforce that boundary even under a broader cross-margin cascade

The venues that get this wrong publish incidents that look like "trader lost their whole account when only one position failed". The venues that get it right host balanced books that survive shocks the naive design cannot.

Insurance Fund Routing and ADL Queue Construction

When a close-out completes above bankruptcy price, the small spread between mark and bankruptcy accrues to the insurance fund. When it completes below bankruptcy - because the book was too thin, the market gapped, or the price band was blown through - the fund absorbs the shortfall so the trader stops at zero rather than going negative.

The design decisions:

• Automatic top-up on successful liquidations. Every clean close-out contributes; the fund grows organically with venue volume
• No commingling with fee revenue or house books. The fund is a segregated pool with its own ledger. Auditability under stress is what makes it trusted
• Explicit floor and disclosure. Traders should be able to see the fund balance in real time. Opacity is where disputes start

Auto-deleveraging is the last-resort mechanism when the fund is exhausted mid-event. The ADL queue matches the residual bankrupt position against profitable counterparties at bankruptcy price. Queue construction is where operator disputes are born:

• Priority by profit-and-leverage rank. Profitable traders at the highest effective leverage sit at the top of the queue. The intuition is that they benefited most from the venue's leverage, so they carry the residual first
• Real-time queue visibility. Traders should be able to see their ADL rank at any time. Surprising a large profitable counterparty with a forced close at bankruptcy price is the fastest way to lose them
• Fund-first, ADL-last. ADL fires only when the insurance fund is genuinely exhausted, not as a routine mechanism. On a well-capitalised venue it is a rare event. See The Insurance Fund and Why It Is the Quietest Part of the Exchange for the deeper mechanics.

Failure Modes That Break Liquidation Engines

Four patterns account for most published incidents:

• Cascading liquidations from a mark-feed glitch. A single upstream exchange prints an outlier, the mark shifts, the liq engine fires, close-outs hit the book, book depth thins, further accounts breach maintenance, and the cascade runs. Prevented by median filtering and staleness gates
• Socialised losses from an under-capitalised insurance fund. The fund gets depleted mid-event, ADL fires against unwilling counterparties, and the venue owes explanations to its largest customers. Prevented by conservative maintenance margins and disciplined fund top-up
• ADL disputes from an opaque queue. Traders discover their ADL rank only after being force-closed. Prevented by real-time queue visibility and clear priority documentation
• Front-run liq flow. Predictable close-out routing lets latency-sensitive participants front-run every liquidation. Prevented by TWAP slicing on large positions, price bands, and randomised micro-jitter on order dispatch

Each of these is a design decision made at the platform layer, not a market accident.

What Basis Points Ships

Every default in the Basis Points liquidation engine reflects the team's combined experience shipping this exact category of infrastructure. Mark price is blended from at least three independent sources per symbol with median filtering, staleness gates and rate limiting. Maintenance margins are set per-asset-class at the bands the institutional pattern has converged on. Close-outs are partial-first, priority-queued by unrealised loss, reduce-only, price-banded and TWAP-sliced above configurable size thresholds. Cross-margin recognises hedged positions natively and re-evaluates the account after each partial close. The insurance fund is segregated, transparent, and topped up automatically on every clean liquidation. ADL is fund-last and queue-visible in real time.

Operators licensing the platform inherit these defaults and tune them per their own risk appetite - maintenance margin rates, price-band widths, TWAP slice cadence, ADL priority weighting. The ops surfaces expose the shape of the liq queue, insurance fund flow, mark-feed source health and cascade guards so the risk team can see the engine's behaviour, not just its outputs.

The liquidation engine is the last thing a venue wants to be famous for. Getting it right at the platform layer is the difference between a venue that absorbs shocks quietly and one that publishes incident reports.

Frequently Asked Questions

Evaluating the platform?

Related articles