Contract Algorithm Sickle: Another Discussion on Liquidation: Another Analysis of HLP and ADL Mechanisms

Author: danny; Source: X, @agintender

What forces the agreements and exchanges that claim to be “fair” to overturn the table?When we talk about ADL, we can’t just talk about ADL.ADL is the final process of the entire liquidation mechanism.What we want to look at is the entire liquidation mechanism, including forced liquidation price, bankruptcy price, handicap liquidation, insurance fund and other mechanisms – ADL is only the final “socialization” result. The core is actually the liquidation mechanism. It is the devastation after the liquidation mechanism is exhausted that has brought us to this moment.(Both you and I should be responsible~)

As for why ADL is a greedy sequence (Greedy queue)?You can’t understand it now when there is abundant liquidity and calm conditions. If you put yourself into the context of the current ADL, you can understand why CEX is designed in this way, because it is the solution with the lowest risk, lowest cost and smallest psychological burden.

1. ADL is a life-saving tool for the exchange, not a fair weight.

ADL (Auto-Deleveraging) is a system-level risk reduction mechanism in the perpetual contract market.When the market fluctuates violently and some accounts are out of positions, and the exchange’s insurance fund is insufficient to cover these losses, the system will activate ADL to fill the gap by forcibly closing the positions of some profitable accounts, thereby preventing the overall liquidation system from failing.It should be noted that ADL is not a normal operation and will only be enabled as a “last resort” in extreme circumstances.

After an ADL is triggered, the system reduces positions according to a clear but not entirely public set of priority rules.Generally speaking, the higher the leverage and the larger the floating profit ratio of a position, the easier it is to be placed at the front of the ADL queue for “position optimization”.

Regarding the core of ADL, let me directly post Binance’s discussion on ADL:

A few key points:

1. The current contract mechanism is ready for “full position”

2. ADL is the final step in the liquidation process

3. Occurs when the contract risk protection fund cannot absorb

4. The larger the size of the risk protection fund, the less frequently ADL will be triggered.

5. Starting ADL has a bad impact on the market, and is equivalent to using the money of the profit-makers to subsidize the mistakes of the losers (especially the profit-makers are usually large investors, and reducing other people’s profits is to offend the big investors)

6. We cannot avoid ADL, but we will try our best to reduce it.

For exchanges/protocols, if the purpose of the clearing mechanism is to ensure fairness, then ADL is to save lives.

2. Liquidation waterfall: from market transaction to ADL triggering

Since ADL is an integral part of the liquidation mechanism, to explore the triggering details of ADL, we should start from the source.

Generally speaking, exchanges have a “waterfall” sequence for liquidation:

first stage: Order Book Liquidation: When a user maintains insufficient margin, the liquidation engine first attempts to throw the position into the order book as a market order (Market Order).

Ideally, the market depth is sufficient, long closing orders are eaten up by short pending orders, the position is closed, and the remaining margin is returned to the user.However, in a crash similar to 10.11, buying orders dry up and huge liquidation orders will directly penetrate the market, causing price slippage to get out of control, directly causing short positions, so the second step will be entered.

second stage: Risk protection fund takes over. When the market cannot be accepted, or the user’s position is close to the bankruptcy price, in order to prevent further price collapse, the exchange’s insurance fund intervenes.

The Risk Cover Fund acts as a “buyer of last resort”, taking over the position at a price close to (or better on some exchanges) the bankruptcy price.The risk cover fund then attempts to slowly unwind the position in the market.At this time the fund holds a huge losing position (inventory risk).If prices continue to fall, the fund itself will lose money.

The third stage:ADL trigger This is the most critical step.When the risk protection fund reaches the threshold, or when the fund believes that taking over the position will lead to its own bankruptcy through risk control calculations, the system will refuse to take over and directly trigger ADL.

The system looks for “victims” among counterparties (that is, traders who have done the right thing and are making profits) and forces them to close their positions at the then marked price to offset the losing position that is about to be exhausted.

Here’s the key point: ADL actually has a very important “function” here, but almost no one mentions it – when the market liquidity is insufficient, the winner’s money is used to stop the decline.

Think about it, assuming there is no ADL, then the insurance fund will keep placing orders at the market in order to survive, and the price will keep going up/down, which will cause more stampedes.

3. The transmission effects of the two liquidation models on ADL

Many people know about ADL, but it is estimated that not many people understand ADL’s previous liquidation model.Generally speaking, there are two main models. Some of the more innovative liquidation models currently are based on improvements on the two models.

Liquidation is a precursor to ADL.Different liquidation processing methods directly determine the frequency, depth and impact of ADL triggering on the market.To talk about ADL without talking about the liquidation model is to act like a rogue.

3.1 Mode A: Order Book Liquidation

Mechanism: When the user triggers the liquidation line, the liquidation engine directly throws the position into the order book as a market order for transaction.

The role of the insurance fund: only used to cover “losses”.That is, if a market order brings the price below the Bankruptcy Price, the difference will be compensated by the insurance fund.

ADL triggering logic: ADL will be triggered only when the insurance fund reaches zero, or the order book is completely exhausted (there are no more orders to buy).

Impact on the market:

Advantages: Respect market pricing as much as possible and not interfere with profitable users.

Disadvantages: In extreme market conditions like 10.11, huge liquidation orders will instantly break down liquidity and cause a series of liquidations.The price will plummet due to the liquidation order itself, causing more people to liquidate their positions, which in turn will cause the risk protection fund to be quickly depleted.

3.2 Mode B: Backstop/Absorption Mode (Backstop/Absorption)

Mechanism: When a user triggers the liquidation line, the system will not sell directly to the market, but the liquidity provider/insurance fund will directly take over the position.

The role of the risk protection fund: it “buys” the user’s liquidation order at the bankruptcy price.After absorption, the order is sold in the market at an appropriate opportunity. Assuming that the transaction price is better than the position price, the profit will be included in the insurance fund, otherwise the loss will be borne by the insurance fund.

ADL trigger logic: This is the most critical difference between modes.

In mode A, ADL is triggered when the liquidity of the market is exhausted and the insurance money is exhausted and “there is no money left to lose”.

In Mode B, ADL uses the risk control of the risk protection fund as the trigger switch.

4. In-depth verification and calculation of the two liquidation models

In order to answer “How do different liquidation mechanisms affect ADL?”, we first established a mathematical model to simulate the performance of Mode A and Mode B under extreme market conditions.

4.1 Scenario assumptions

Market environment: ETH price collapsed instantly.The current market depth is extremely poor and buy orders are scarce.

Default account (Alice):

Position: Long 10,000 ETH

Liquidation Price: $2,000

Bankruptcy Price (return to zero price): $1,980

Current market odds:

Buy price: $1,990 (only 100 ETH)

Second purchase price: $1,900 (only 5,000 ETH) – cliff-like depth

Buy three price: $1,800 (with 10,000 ETH)

4.2 Mode A: Handicap dumping mode

Mechanism: The liquidation engine directly throws Alice’s 10,000 ETH into the order book at market price sell order without any buffering.

Calculation process: (Simplified calculation, just give you a rough idea)

Transaction:

100 ETH @ $1,990; 5,000 ETH @ $1,900; 4,900 ETH @ $1,800

Weighted average price (VWAP):[(100*1990) + (5000*1900) + (4900 *1800)] / 10000 = $1852

Loss due to position loss:Alice’s bankruptcy price is $1,980.Loss per ETH: $1,980 – $1,852 = $128Total loss: $128 * 10,000 = $1,280,000

ADL trigger:If the insurance fund balance is < $1.28M, the system must trigger ADL immediately.The system will find Bob, a large profit maker who holds a short order, and force him to stop his profit at a price of $1,980 (even though the market price has now dropped to $1,800, Bob could have made more).

Mode A caused the price to instantly crash to $1,800, creating a huge slippage loss, which directly penetrated the insurance fund, causing ADL to be triggered immediately and massively..

4.3 Mode B: Takeover/absorption mode

Mechanism: The liquidation engine does not sell to the market.The insurance fund (or HLP pool) directly takes over Alice’s position at a forced liquidation price ($2,000) or slightly better than the bankruptcy price ($1,990).

Calculation process:

Takeover: The risk protection fund pool instantly held a long position of 10,000 ETH, and the entry cost was recorded as $1,990.

1. Market reaction: The market price still stayed at $1,990 (because there was no selling pressure to hit the market).The market looks “calm”.

2. Stock risk: 1 minute later, external markets (such as Coinbase) fell to $1,850.The 10,000 ETH held by the risk protection fund pool generated a floating loss:($1,990 – $1,850) * 10,000 = $1,400,000

3. ADL trigger judgment:At this time, the system will not trigger ADL due to “no money to compensate” (because it has not been sold yet).However, the system will perform a risk check:

• If the total capital of HLP is $100M, a loss of $1.4M can be tolerated -> ADL will not be triggered.

• If the HLP funds are only $5M, the loss of $1.4M is too large -> In order to protect LP, the system decides to throw this hot potato out -> trigger ADL.

• Mode B protects the market price in the first second of the crash and avoids serial liquidations.But it hoards risks in insurance funds.If the subsequent market fails to rebound, the losses of the insurance fund will continue to amplify, which may eventually lead to more violent ADL (or, as in Hyperliquid 10.11, in order to prevent HLP from losing money, aggressive ADL).

One more thing, the reason why Hyperliquid triggered ADL on a large scale on 10.11 was not because the system ran out of money, but because HLP Vault actively transferred the risk to profitable users in order to protect itself.This is to prevent a repeat of the previous “Whale Slap” incident (where whales took advantage of insufficient liquidity to trap HLP).

Although Mode B protects the handicap price from being instantly smashed, it concentrates the “inventory risk” on HLP.Once HLP feels scared (reaches the risk control threshold), it will use ADL to “kill” the positions of profitable users extremely aggressively to close accounts to ensure its own survival.Imagine if HLP’s retracement reaches 30% in one day, what will most people do?They will directly withdraw funds and withdraw cash, which will eventually lead to a run.

In addition, old fans who are familiar with me know that I have said many times before that the current Perp dex copies the liquidation mechanism of CEX, and there will be big problems sooner or later. I think everyone can understand it a little now, right?hahaha

5. Hyperliquid’s special architecture: sensitivity of HLP and ADL

The particularity of Hyperliquid is that it does not have a huge, opaque insurance fund like Binance or OKX, which is cushioned by the profits accumulated by the exchange over the years.Its insurance fund is borne by HLP Vault.

5.1 HLP: both a market maker and an insurance fund

HLP is a fund pool composed of community users depositing USDC.It has a dual personality:

Market Maker: It provides liquidity on the order book and earns the spread.

Liquidator: When the above-mentioned “second phase” occurs, HLP is responsible for taking over the user’s liquidated position.

This structure results in Hyperliquid’s ADL triggering mechanism being completely different from that of centralized exchanges:

Binance model: The insurance fund is the “private money” of the exchange, usually accumulating billions of dollars (?) (this is my guess, there is no basis), so Binance can tolerate huge retracements and try not to trigger ADL to maintain the experience of large users.

Hyperliquid mode: HLP is the user’s money.If HLP loses too much in order to take over a huge toxic position, it will cause LPs (liquidity providers) to panic and withdraw funds, triggering a “run” and leading to the death of the exchange.(The Jelly incident has already shown HLP the power of retracement)

Therefore, Hyperliquid’s risk control engine is designed to be extremely sensitive.Once the system detects that the risk of HLP taking over a position is too high, it immediately skips the second stage and directly initiates ADL.This is why on October 11, Hyperliquid triggered a large-scale ADL (more than 40 times in 10 minutes), and some CEX chose to use their own funds to resist even though they may have been exhausted internally.

5.2 In-depth analysis: Liquidator Vault mechanism

Liquidator Vault is a sub-strategy within HLP.It is not an independent fund pool, but another set of “liquidation” logic.

When a trader is liquidated and the market is unable to absorb the order (Tier 1 failure), the clearing vault “buys” the defaulted position.

Example: Trader goes long 1000 SOL at $100.Price dropped to $90 (hardened price).The order book is thin on buy orders.The liquidation vault takes over the long position of 1000 SOL at $90.

Instant PnL Confirmation: The user’s remaining margin is forfeited.If the margin covers the difference between the entry price and the current mark price, HLP immediately credits a “liquidation fee” profit.

Stock Unwind: HLP is now long 1000 SOL in a collapsing market.It must sell these SOLs to neutralize the risk.But if these positions cannot be cleared and reached in time, ADL will be triggered.

6. 10.11 Event Review: The Game of Algorithms

Now let us return to the core of the controversy: On October 11, 2025, Hyperliquid processed more than 10 billion US dollars in liquidation volume; within 10 minutes, ADL exceeded 40 times. Some people say that this is all a fuss?Is this really the case?

6.1 The Heart of the Controversy: Greedy Queue vs. Pro-Rata

Gauntlet CEO Tarun Chitra pointed out that the ADL algorithm used by Hyperliquid resulted in an “unnecessary loss” (opportunity cost) of approximately $653 million.

The focus of the controversy is ADL’s sorting algorithm.

Hyperliquid’s algorithm: The Greedy Queue (The Greedy Queue) This is a classic algorithm inherited from the BitMEX era.The system sorts all profitable users based on profitability and leverage:

Ranking score = Profit/Principal * Leverage multiple

Execution method:

Starting from the top ranked user, the system will completely close their positions until the loss gap is filled.Result: The top “best performing trader” was “killed”.Their position was gone. Although they kept their profits at the time, they lost the huge potential gains from the subsequent market decline.

Algorithm proposed by Gauntlet: Risk-Aware Pro-Rata:

Execution method: Instead of killing the first place completely, each of the top 20% profitable users will haircut a part of their positions (for example, each person will close 10%).

Advantages: Part of the user’s position is retained so that they can continue to enjoy the subsequent market trends.Gauntlet’s backtest shows that this method can retain more positions (OI) and reduce harm to users.

6.2 Why does Hyperliquid insist on using “greedy queues”?

Although Gauntlet’s algorithm is theoretically fairer, Hyperliquid founder Jeff Yan’s rebuttal points to real-world constraints:

Speed and determinism: On L1 chains, computing resources are expensive.Prorating deductions for thousands of users requires extensive computation and state updates, potentially causing block delays.The “greedy queue” only needs to sort and cut off the head, which has low computational complexity and extremely fast execution speed (millisecond level).When markets crash, speed is of the essence.

Vulnerability of HLPs: As mentioned earlier, HLPs have limited funding.Prorated ADL means HLP needs to hold a portion of the toxic position for a longer period of time (waiting for the system to slowly calculate and execute everyone’s cuts).For Hyperliquid, cutting off risk quickly (by completely liquidating large players) is more important than so-called “fairness”.

7. What is the truth about the greedy queue?

If you can read the entire article, you will know that 40+ ADLs in 10 minutes is the essence of HLP’s mechanism. In front of major traders, HLP’s contributors are the foundation of Hyperliquid.

Greedy queue is not a new algorithm created by Hyperliquid. In fact, this algorithm existed as early as n years ago, and it is still not used by most CEXs. Did they not think about the security of the fund pool when using greedy queue?Also reduce the computational load and speed limitations?And with so many ADLs happening in history, didn’t any of the affected large households defend their rights?Are you making trouble at your door?Obviously not.

The real reason is: For the centralized exchange CEX, the greedy queue is a reasonable, relatively fair and cost-controllable solution based on the existing mechanism.

Returning to the liquidation mode A and mode B mentioned earlier, the conditions for ADL triggering are

1. Severe market fluctuations

2. Liquidity in the market is basically in a “vacuum” state

3. Risk protection funds suffered serious losses

For the large investors who were ADLed, they also knew that at that time point, there was not enough liquidity in the market to take on their profitable positions. Even in the early years, due to some technical reasons, when the market fluctuated violently, even the exchange account could not be logged in. Therefore, the ADL operation became a disguised function of the exchange to assist in “taking profits”, because many profitable profits were likely to be unable to be traded at that juncture.

In addition, making less money is psychologically easier to accept than losing money, especially after learning that the exchange itself has suffered a lot of losses. This feeling of happiness will make people feel a little more comfortable once compared.

As for why it must be a greed sequence, apart from the somewhat strange simple logic of earning more = greater responsibility, the main reason is actually: fewer people are affected.

What is CEX most worried about?Not through warehouse?Not a loss?But public opinion!Rather than a group of people suffering losses, they would rather see only a small number of people suffer losses. In this case, it can be resolved through one-to-one or many-to-one private communication.Everyone should know that the game in the market does not end only after liquidation/ADL. There are also subsequent disputes, complaints, threats, etc. Many disputes are resolved behind the scenes.

8. Is there a better algorithm?

There is, but it is not a better ADL algorithm. At this stage, the focus should be on how to prevent the occurrence of ADL.

Because it is not the focus of this article, I will simply use a table to explain it below. For exchange practitioners, the tips in the chart should be enough.

Of course, if all exchanges have the “courage” to build a circuit breaker system, it will really block a lot of unnecessary words.