> **Source:** https://permissionless.fi/en/29-decentralized-clearing
> From *Permissionless Finance* (Permissionless Finance: From Perpetual Futures to the On-Chain Global Market) by Eric Cheung. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

# Chapter 29: Designing an Ideal Decentralized Clearing and Settlement Architecture

The first 28 chapters of this book have analyzed, one by one, the individual components of a decentralized clearinghouse and the ways in which each can fail: how novation absorbs bilateral credit risk through an impersonal central counterparty (Chapters 5 and 28); how multilateral netting compresses a large volume of bilateral exposures into net positions (Chapters 1 and 5); how the mark price becomes the measurement basis for unrealized profit and loss and for margin (Chapter 14); how margin and leverage define an account's liquidation boundary (Chapter 11); how the reflexivity of liquidation amplifies individual prudence into systemic fragility (Chapter 11); how the default waterfall absorbs losses layer by layer after a shortfall (Chapters 5, 11, and 28); and how insurance funds and auto-deleveraging (ADL) socialize the tail losses that cannot be eliminated (Chapter 12). Yet clarifying each component in isolation is not the same as knowing how to integrate them, absent a traditional central institution, into a whole that can be trusted.

This integration problem is not abstract. In October 2025, a liquidation cascade triggered the liquidation of approximately $19 billion in leveraged positions within a single day [1]. The mechanics of that cascade were analyzed in full in Chapter 11 and are not restated here; it is cited here to make one fact plain: when the components above are integrated into a single high-leverage, around-the-clock, unattended system, the transmission among those components can itself constitute system-level risk. It is not this chapter's argument but its backdrop.

Chapter 28 closed by establishing the identity of the clearing and settlement layer: the layer in an on-chain system that corresponds most closely to the functions of a traditional central counterparty, whose role is clearing (recomputation of the books) and settlement (commitment of account state), rather than mere default management (Section 28.4.3). That chapter also left three constructive questions to the present one: can an on-chain system achieve a default waterfall as deep as that of a traditional central counterparty? How should risk control be balanced against user experience? And how can incentives be aligned in a system in which no single actor can issue commands (Section 28.3.6)? Traditional finance took more than two centuries, driven by successive crises, to arrive at today's clearinghouse; the tiered structure of its default waterfall is the product of that evolution [2]. What the first 28 chapters provide this chapter is an inventory of components and a catalog of failures; they have not yet given a scheme for integrating those components into a whole, nor answered the three questions that integration necessarily raises.

These three questions must wait for the integration stage because none can be resolved at the level of a single component. Depth asks not whether any one buffer layer is thick enough, but in what order the layers of capital are arranged and who bears losses first. Degradation asks not how fast or slow any single liquidation is, but whether the system can maintain order when selling pressure, liquidity, and confidence contract at once. Incentive alignment asks not whether some parameter is appropriate, but who bears the ultimate loss when all parameters operate as designed and yet some participants rationally choose not to act. All three point to the coordination among components rather than to the performance of the components themselves, and they can therefore be answered only after those components have been integrated into a whole and their interactions made visible. This is why the chapter first carries out the system integration and only then addresses the three questions.

On this basis, the chapter undertakes two tasks: integration and answering the questions. Integration means assembling, for the first time, the components dispersed throughout the book into a complete decentralized clearinghouse, and showing that the system's true fragility lies not in the components themselves but in the seams between them. Answering the questions means addressing, one by one, along the structure of this system, the three questions Chapter 28 left open. Before that, four premises must be made explicit. First, the fragility of a clearinghouse system lies mainly not in any single component but in the seams between components; each component may be well designed, and what breaks the system is usually the transmission between them. Second, two layers of the ideal decentralized clearinghouse remain absent on-chain today: the skin-in-the-game first-loss layer of the operator's own equity, and the layer of prefunded mutualization among members. These two layers are the source of a traditional default waterfall's depth (Section 28.3.6). Third, there is a class of extreme scenarios that no purely algorithmic system can fully cover: absent a lender of last resort, the total losses may exceed all the buffers the system can currently draw upon, and full loss coverage is no longer an achievable goal [3]. Fourth, there is a further boundary that no design of market incentives can cross: there will always be moments when deterministic code must allow human discretion to intervene. These four points are not pessimistic concessions but the premises of the chapter's entire argument: only by first clarifying where integration is impossible, where losses cannot be fully covered, and where incentives fail can we discuss how to integrate, to the greatest extent possible, the parts that can be integrated.

## 29.1 The overall architecture of a decentralized clearinghouse

### 29.1.1 A single deterministic state machine

A clearinghouse system is not a simple superposition of several risk mechanisms but a single, deterministic state machine. Each component dissected separately above is, within this system, merely one stage; its value lies not in operating independently but in being incorporated into an uninterruptible chain of state transitions. Describing the margin-calculation module, netting, marking to market, the insurance fund, and auto-deleveraging separately does not automatically yield a clearinghouse system, just as analyzing each component in isolation does not yield a functioning whole. The components also require a determinate set of connections: the output of the previous stage must be the sole, unambiguous input of the next; wherever a connection is mismatched, the entire system's state diverges. Understanding a decentralized clearinghouse should begin with understanding this chain of state transitions, not with enumerating its components.

To understand the clearinghouse as a state machine is not a convenient metaphor but a definition with substantive consequences. The core promise of a state machine is determinism: given the same initial state and the same sequence of inputs, it necessarily evolves to the same final state, with no degree of freedom that depends on timing, on the executor, or on off-chain negotiation. This is the classic abstraction that distributed systems have used for decades to build fault-tolerant services: a service is expressed as a deterministic state machine so that a set of mutually distrusting nodes, each of which may crash or even submit malicious state, can agree on a single input sequence and thereby present themselves to the outside world as a single, never-failing whole [4]. Byzantine fault-tolerant (BFT) consensus extends this abstraction further, to environments in which nodes may exhibit Byzantine behavior, so that the consistency of the state machine holds even when some nodes deliberately submit false information [5]. A decentralized clearinghouse system is, in essence, this service placed within that abstract framework: its task is to let multiple validators who need not trust one another reach an unambiguous agreement on what each account's state should be at this instant.

Applying this abstraction to a clearinghouse requires distinguishing one level, without which the analytical boundary of the term *state machine* becomes unclear. Determinism is one problem; replicated determinism is another, and between them lies the entire decentralization content of the system. A traditional clearinghouse's computation module can, in principle, also be deterministic: given the same inputs, it too will compute the same books. But its determinism holds only within its own internal copies of the system; external participants can neither obtain that input sequence nor hold that rule set, still less recompute the books to check them. What makes state machine replication truly demanding is not that each node be individually deterministic, but that multiple mutually distrusting nodes, any of which may crash or be compromised, evolve from the same input sequence, under the same rules, to the same state, and that this agreement hold even when some of those nodes fail or submit false information [4]. In other words, the difficulty of a replicated state machine is not merely that the computed result is correct, but that, absent a trusted arbiter, no participant can raise conflicting valid claims about the state. Byzantine fault-tolerant consensus strengthens this condition further: it requires that even when some nodes deliberately submit forged state, honest nodes can identify and exclude it, so that the replicated state remains unique despite the presence of malicious nodes [5]. A decentralized clearinghouse system is decentralized because of this layer of replication: it requires not merely that a single computed result be accurate, but that no one can privately tamper with that result and that everyone can independently verify it has not been tampered with.

It is in this sense that the difference between a decentralized clearinghouse and a traditional central counterparty is not merely the removal of an intermediary. A traditional central counterparty does not satisfy the determinism promise of a state machine: its risk-control model is confidential, its stress-test parameters are not disclosed, and it retains room for discretion at extreme moments. Chapter 28 used the March 2022 nickel-contract crisis at the London Metal Exchange to illustrate how such discretion conflicts with the definition of neutral infrastructure (Section 28.7). A central counterparty is still trusted not because it can be recomputed but because its authority has another source: ample proprietary capital as an underlying backstop, a complete legal recourse regime as institutional guarantee, and strict regulation under continuous scrutiny [6]. Capital absorbs the consequences of error, law provides recourse against breaches of trust, and regulation imposes external constraint on internal loss of control; together these three constitute a form of ex post insurance about responsibility, not ex ante verification of process. An ordinary user has never checked, and could never check, whether a central counterparty's margin model is internally consistent or whether its stress-test parameters are prudent; what the user trusts is never the computation module itself but this institutional framework surrounding it. The trustworthiness of a traditional clearinghouse rests on the three institutional foundations of capital, law, and regulation, not on anyone's ability to recompute the books; the absence of verifiability is what these three institutional foundations compensate for. The central-counterparty institution is itself a transformation of counterparty risk from dispersed bilateral trust into trust in a single regulated professional institution—a transformation of trust, not its elimination [7].

A decentralized clearinghouse loses these three institutional foundations. It cannot appeal to capital, because it has no central-bank-scale proprietary capital; it cannot appeal to law, because its counterparty is borderless code; it cannot appeal to regulation, because it runs on a network that no one can unilaterally halt. What it can appeal to is chiefly determinism itself: expressing the clearinghouse in full as a state machine so that every step of its evolution is uniquely determined by public rules, and so that any node can, from the same inputs, independently recompute the same outputs. Hyperliquid's design is the most complete implementation of this approach to date: it unifies matching, liquidation, and settlement within an on-chain state machine called Hypercore, with HyperBFT consensus reaching agreement on each state transition, so that the entire clearing pipeline becomes a deterministic object recomputable by every validator on the network [8]. The authority of this system no longer derives from an institutional principal behind it but from the fact that each of its steps is independently recomputable (Section 28.6.2).

This substitution carries an often-overlooked cost that must be made clear at the outset of integration: determinism has a dual effect. Determinism makes the clearinghouse verifiable, but it also makes it predictable; the trigger conditions of a fully deterministic liquidation module, its execution path, and the boundaries of each of its steps can, in principle, all be computed in advance by an adversary with sufficient computational power, the root of the predictability attacks discussed in Chapter 12 (Section 12.4.1). A traditional clearinghouse purchases immunity from such prediction with discretion and secrecy; a decentralized clearinghouse exchanges verifiability for exposure to such prediction. This is not a design oversight but an intrinsic tension of the paradigm: the more a clearinghouse system relies on determinism, the more easily its execution boundaries can be computed in advance by participants able to parse the rules. This is the root of the incentive boundary and residual discretion discussed later in this chapter (Section 29.4).

The core difference between a decentralized clearinghouse and a traditional central counterparty lies not in whether an intermediary is removed but in the different bases of trust in the two: the latter's authority rests on capital, law, and regulation, the former's on the fact that anyone can recompute the books and arrive at the same answer (Sections 28.4.3 and 28.6.2). Every state transition described in the subsequent subsections—the ledger recomputation of clearing, the account-state commitment of settlement, the layer-by-layer bearing of losses in the default branch—must be understood as incorporated into this single state machine. Representing this chain of state transitions in full yields this chapter's core architecture diagram (Figure 29-1).

![Figure 29-1](./images/fig-29-1-en.png)

**Figure 29-1.** The overall state machine of a decentralized clearinghouse: the normal-conditions flow (trade → clearing → settlement → on-chain finality) and the default-management branch (liquidation → margin → insurance fund → liquidation vault → auto-deleveraging), together with the seams between their layers

### 29.1.2 The clearing stage: novation, multilateral netting, and recomputation

The main line of the state-transition chain processes every trade under normal conditions. After a trade enters the system, it first passes through clearing (recomputation of the books). Clearing, as a stage, consists of three actions each already treated in full earlier; this section does not restate their individual mechanisms but discusses only how they are composed into a single state transition. The first action is novation: the central counterparty interposes itself between buyer and seller, becoming the seller to the buyer and the buyer to the seller, so that a default by either party is no longer transmitted directly to its trading counterparty but is instead absorbed uniformly by the system (Sections 1.1 and 28.4.3). The second action is multilateral netting: multiple trades by the same account in the same contract, and even exposures across multiple counterparties, are consolidated into a single net position change, minimizing the number of entries that must be settled on the ledger (Section 5.2). The third action is recomputation: the system accordingly recomputes the account's position, realized profit and loss, and margin usage, producing a new set of account states. In the vocabulary of traditional clearing, these three steps correspond respectively to updating positions, netting down exposures, and recalibrating margin, and they are the core of a clearinghouse's daily operation [2].

These three actions were treated in separate chapters earlier; what the whole-architecture perspective must supply, and what the earlier discussion never made explicit, is this: within a state machine they are not three independent operations that occur in sequence but a single atomic state transition of the books. By atomic is meant that these three steps are either committed as a whole or rolled back as a whole, with no intermediate state observable from outside in which novation has completed but netting has not, or netting has completed but margin has not been recomputed. For a traditional clearinghouse this is an engineering goal to be approached only through end-of-day batch processing, reconciliation, and manual compensation, because its novation, netting, and margin management belong to different operational stages, even different legal moments, and aligning them into a seamless whole requires layer upon layer of rules, procedures, and end-of-day reconciliation [7]. For an on-chain state machine, by contrast, this atomicity comes from the native constraints of the state machine, because atomicity is inherent to the abstraction itself. Novation, netting, and recomputation can be composed on-chain into a single indivisible transition of the books because they were incorporated from the outset into the same deterministic system, rather than being assigned to three subsystems that must coordinate with one another.

Within this atomic transition there is also an often-overlooked ordering that directly affects how the subsequent default branch is understood: novation must precede netting, and netting must precede recomputation. Novation goes first because only once the central counterparty has become the common counterparty to every trade do exposures originally belonging to different bilateral pairs become eligible to be consolidated; without novation, A's long against B and A's short against C are two claims that cannot offset each other, and only with novation do they both become A's exposure to the system and thus nettable [7]. Netting goes before recomputation because margin and profit and loss must be computed against the net position, not against the trade flow; if margin were recomputed trade by trade before netting, the result would be a grossly overstated usage, and capital efficiency would fall markedly. This internal ordering—novation before netting, netting before recomputation—is the entire reason clearing can compress tens of thousands of bilateral exposures into a limited number of net states while still measuring each account's risk accurately.

This atomic transition also has a temporal feature: it occurs entirely before any funds actually move. The clearinghouse first computes, on the books, each account's receivable and payable amounts and each account's margin usage accurately; the actual transfer of funds is a matter for the next segment (settlement). This ordering, completing the clearing computation before the settlement commitment, is not an accounting convention but the foundation of risk management: because the clearing computation precedes the settlement commitment, the system can determine, before any funds leave, whether an account is already insolvent and whether it must be routed to the default branch. Understanding clearing as a single atomic transition of the books that occurs before funds move thus draws a clear starting point for the next section's settlement and for the triggering of the default branch.

### 29.1.3 The settlement stage: marking to market, funding, and finality

After the clearing computation is complete comes settlement (commitment of account state). If clearing translates trading events into accrued states on the books, settlement realizes those accrued states as the accounts' actual states. It, too, consists of several actions treated in full earlier; this section addresses only how they string together into the second segment of the state-transition chain. The system continuously marks open positions to market at the mark price, so that each account's floating profit and loss updates continuously with price (Section 14.4); it charges and pays the periodic funding unique to perpetual futures, continually pulling the contract price toward spot, since perpetual futures have no delivery date and funding is the mechanism that substitutes for expiry-based delivery to maintain the anchor (Section 10.1); at close, it formally books the profit and loss and releases the corresponding margin; and finally, the chain's finality confirms this series of account changes as irrevocable (Section 28.4.3).

What the whole-architecture perspective must supply is the state-machine meaning of the settlement stage: it is the state commitment the clearinghouse makes to the outside world, and the chain's finality is the mechanism that confirms that commitment. Marking to market, funding, and booking are, during the clearing-computation stage, still only numerical evolutions on the books; only when they are settled by the settlement stage and confirmed by consensus into an irreversible stretch of on-chain history do they pass from what the system holds *should be* to what the system holds *already is*. This commitment must be identified separately, and must not be conflated with the clearing computation, because it marks the point at which responsibility transfers: before commitment, an unsettled profit or loss is only an internal computation of the module and may be overwritten or corrected by subsequent inputs; after commitment, it becomes the account's established entitlement, and any change to it can be made only through a new state transition that is likewise verifiable, not revoked without basis. The settlement stage is therefore the sole boundary at which this system confirms a computed result as an established state. One point is easily misunderstood: finality is never a natural fact but a constructed one. Intuitively, people assume that an asset transfer becomes final the moment it is confirmed, as if irreversibility were an inherent property of the transaction itself; but anyone who has experienced a bank transfer being reversed or a settlement being clawed back because a counterparty went bankrupt knows that *when* finality takes effect is the mechanism most in need of being fixed deliberately. A settlement commitment is irrevocable not because it is physically impossible to reverse but because a set of rules expressly forbids reversal and imposes consequences on anyone who attempts it. In traditional finance this distinction is carried by the legal construction of settlement finality: when a settlement becomes irrevocable is defined jointly by clearinghouse rules, settlement-system rules, and bankruptcy law; the European Union even legislated specifically (the Settlement Finality Directive) to ensure that instructions entering a settlement system are not retroactively unwound because one participant goes bankrupt, thereby preventing systemic risk from spreading through that gap [9]. That this legislation was necessary shows that, absent intervention, this boundary is inherently blurred: the retroactive effect of bankruptcy law would collide head-on with the irrevocability of settlement, and only a dedicated statute carving out an exemption for settlement lets finality hold within that carve-out. On-chain, this same line of *when it becomes irrevocable* is drawn no longer by statute but is carried by the finality of consensus and defined by the consensus protocol itself [5]. Both draw the same boundary: before it, states can still be reordered; after it, no one may renege. The difference lies only in the instrument: traditional finance relies on legal text and court enforcement, on-chain systems on the liveness and safety of the consensus protocol itself.

This comparison reveals a subtlety of on-chain settlement that optimism easily obscures: finality comes in strong and weak forms, and the difference bears directly on the safety of the clearinghouse. Traditional settlement finality is a legal fact, absolute once attained; whereas the finality of many blockchains is probabilistic: a transaction included in a block means only that it very probably will not be rolled back, and the deeper the block, the lower the rollback probability, though not necessarily zero [10]. The divide between these two kinds of finality has its root in distributed-systems theory: for protocols that reach consensus by the longest-chain rule, safety is a decreasing function of the adversary's hashpower or stake share, and the rollback probability decays exponentially with confirmation depth yet never reaches zero; whereas for finality reached by Byzantine fault-tolerant consensus, once a block has been confirmed by a lawful number of validators' signatures, it is, under the protocol's assumptions, absolute and irreversible. The former delivers near-certainty, the latter certainty [10]. For general applications, near-certainty is good enough; waiting a few more blocks pushes the rollback probability down to negligible. But for a clearinghouse system this difference has substantive consequences, and those consequences manifest as an asymmetry. The clearinghouse's loss-bearing has a one-directional execution feature: once a profit or loss is settled by the settlement stage and, on that basis, triggers the next layer of default-branch actions, that layer of action has often already drawn on non-defaulting parties' capital: the insurance fund is tapped, and profitable parties are deleveraged. If at this point a chain reorganization reverses the profit or loss already booked, the tapped insurance fund and the deleveraged profitable parties are difficult to restore: the prior book state can be rolled back, but the loss-bearing already executed downstream cannot correspondingly be restored. Probabilistic finality therefore leaves a new gap in the loss-bearing of the default branch, arising from a mismatch in which the antecedent is reversible but the consequent is not. This is one reason systems like Hyperliquid choose Byzantine fault-tolerant consensus and pursue deterministic finality that is irreversible once confirmed: a clearinghouse's demand on finality is far more stringent than a general application's, because it cannot afford this asymmetry [8]. Understanding settlement as a state commitment confirmed by finality is therefore not merely an abstract qualitative characterization; it is at the same time a hard constraint on what kind of finality the underlying consensus must provide.

Having clarified the role of finality, one often-confused ordering can be sorted out. Under normal conditions, clearing (recomputation of the books) and settlement (commitment of account state) together constitute all the work this system does: translating a continuous stream of trading events into a continuous stream of account-state changes confirmed by finality. This main line closes on itself: trades come in, states change, finality lands, in a continuous cycle, requiring no default handling. The default branch is a branch rather than part of the main line because it is triggered only when the main line cannot close on itself, that is, when an account's equity falls below maintenance margin under marking to market and the clearing computation, preceding the settlement commitment, determines it to be insolvent. The main line applies to states in which an account is still solvent; the default branch applies to states in which an account is already insolvent. The next section analyzes the latter.

### 29.1.4 Default management: liquidation and the loss waterfall

Beyond the main line lies a default branch, triggered only when an account's equity falls below maintenance margin. Its place in the state machine is a set of conditional state transitions, wholly dormant under normal conditions and activated only when the clearing stage determines that an account can no longer cover its exposure with its own margin. Its trigger point is liquidation: the system forcibly closes the insolvent position, confining the loss within its margin (Section 11.1.3). Liquidation is itself a default-management submechanism, not a clearing function; placed within the state-machine framework, it is the trigger point from the main line into the branch, and the first node in the entire system that turns a single account's individual loss into a problem that may affect other participants.

But liquidation often cannot confine the loss entirely. Market gaps, insufficient depth, and divergence between the mark price and the execution price can all leave the proceeds of closing out insufficient to cover the position's shortfall, leaving an uncovered shortfall (Chapter 12). The branch therefore continues downward into the default waterfall: after margin comes the insurance fund, after the insurance fund the liquidation vault (such as Hyperliquid's HLP), and after the vault, auto-deleveraging (Section 28.3.6; Chapter 12) [8]. Placed within the state-machine framework, each layer of the default waterfall is a conditional state transition: the exhaustion of the previous layer's buffer is the condition that activates the next; and each layer, when activated, answers the same question in a different way: who next bears this loss that the defaulter cannot bear for itself. The answer at the margin layer is the defaulter itself; at the insurance-fund layer, the public pool prepaid by all traders; at the vault layer, the capital that voluntarily provides liquidity to the system; and at the auto-deleveraging layer, the profitable parties who are forcibly deleveraged. The waterfall is designed as a descending layered structure so that the bearers are arranged in an order running from those who most ought to bear to those who are most blameless, so that non-defaulting parties are affected as late and as little as possible [2].

Reading the waterfall as a series of conditional state transitions also clarifies an easily overlooked point: this branch shares the same state machine, the same determinism, and the same verifiability as the main line. When liquidation triggers, when the insurance fund is drawn upon, and whom auto-deleveraging selects are all uniquely determined by public rules, with no step left to off-chain negotiation or ex post discretion, in sharp contrast to the discretionary room a traditional central counterparty still retains in default handling, room that must be constrained by dedicated governance procedures [11]. The default branch is therefore not a separate logic outside the main line but the continuation of the same system in the world where it cannot pay in full; for that reason, each of its steps must likewise submit to recomputation by all, a point to which Section 29.1.5 returns.

But this branch also has the strictest limit in the entire system, corresponding directly to the third promise in the opening. Auto-deleveraging is the last layer of the waterfall, and its very existence announces one thing: when the total loss exceeds the capital available at all the preceding layers, the system no longer attempts to make up the shortfall but instead directly cuts the profitable parties' positions proportionally, rebalancing the books at a lower level. Chapter 12 has proved that among determinism, robustness to shocks, and fairness, no purely algorithmic default handling can satisfy all three at once, which constitutes a structural lower bound on bad debt: there is always a class of extreme scenarios in which losses cannot be fully covered and can only be mutualized or truncated (Section 12.2.3) [12]. Placed within the state-machine framework, auto-deleveraging is not a mark of failure but this system's second-best deterministic handling, under given constraints, of the fact that full loss coverage is impossible.

It is on the question of *who bears* that the on-chain waterfall reveals its core difference from the traditional default waterfall, and this difference constitutes the first of Chapter 28's three questions. A traditional central counterparty's default waterfall has five layers: the defaulter's margin, the default fund contributed by the defaulter, the central counterparty's own capital (its skin in the game), the default fund contributed by non-defaulting members (mutualization), and finally recovery and resolution (Sections 5.2.3 and 28.6.2) [2]. Empirically, the resources of these five layers are highly concentrated at the front end: in the default waterfall of credit-derivatives central counterparties, the initial margin posted by defaulters accounts for approximately 77.9% of all prefunded resources, while the central counterparty's own skin-in-the-game capital accounts for only about 2.0%; the latter is small in amount, but its position has structural significance, because it is placed ahead of all non-defaulting members' mutualized funds, forcing the central counterparty to bear losses first (Section 5.2.3) [13]. The on-chain waterfall has only four layers, and what it skips is those two middle layers, allocating loss-bearing directly from the public pool prepaid by all traders to the profitable parties who are forcibly deleveraged, with neither a layer of skin-in-the-game own equity that bears losses ahead of users nor a layer of prefunded mutualization among members to share them. The depth of a waterfall lies not in how many layers it has but in how many layers of capital willing to bear losses first are placed before losses are allocated to non-defaulting profitable parties; the consequence of these two missing layers is the seam that Section 29.2 will audit specifically. This section establishes only the structure of the branch: it is the extension of the main line when it cannot pay in full, each layer is a conditional state transition, and each transition re-designates the bearer of the loss.

### 29.1.5 Concentrated adjudicative authority, open verification

Combining the main line and the branch (Figure 29-1) yields the overall architecture diagram of the complete clearinghouse system. The focus of this diagram is not the mechanisms inside each box, which have been analyzed separately in Chapters 5, 11, 12, 14, and 28; the focus is the connection relationships between the boxes and the overall constraint the system as a whole must satisfy. Before discussing this overall constraint, an often-confused pair of concepts must be distinguished: adjudicative authority, and the verification of that adjudicative authority.

Adjudicative authority is the power by which some mechanism determines the final state of each account. In this system, this power is single-point: all clearing computation, settlement commitment, and default handling converge on one deterministic computation module, which issues the sole ruling. Formally, this resembles centralization; the discretion over adjudication is indeed not dispersed but concentrated in one place. But the decentralization of a decentralized clearinghouse never promises to disperse adjudicative authority itself among everyone; handing the power to rule to multiple actors ruling separately yields not a clearinghouse system but a divergence of states that cannot converge. A telling point of comparison: a traditional central counterparty is likewise single-point in adjudication, and the decentralized design does not differ from it here; the entire engineering effort of blockchain consensus is to let multiple dispersed nodes agree on the same determinate state, rather than each maintaining a mutually conflicting ledger [4]. What it truly promises is something else: although adjudicative authority is single-point, the verification of that single point can be performed by anyone.

The technical carrier of this principle is an object often passed over in a sentence yet directly affecting the mechanisms that follow: the state fingerprint. Each time the computation module completes a state transition, its complete state is reduced by a cryptographic hash to a fixed-length fingerprint; the key property of this fingerprint is collision resistance: finding two different states that yield the same fingerprint is computationally infeasible, so identical fingerprints are almost equivalent to bit-for-bit identical states [14]. This property appears ordinary but in fact carries the entire weight of the verification logic. What a collision-resistant hash provides is a commitment in the cryptographic sense: compressing the positions, margins, and profits and losses of tens of thousands of accounts into a fingerprint of a few dozen bytes, so that once this fingerprint is published, the publisher can no longer claim that the state at the time was substantively otherwise, and any subsequent tampering with the state would be exposed as a fingerprint mismatch. The checkability of this commitment is universal and cheap: a verifier need not trust the publisher, nor replicate all of its computational power, but need only run its own independently computed state through the same hash and compare whether the two fingerprints match—so the problem of comparing enormous states bit for bit is reduced to a single comparison of a few dozen bytes. Without such a commitment object, one that anyone can cheaply recompute yet the publisher cannot repudiate, verification by all would be only a slogan; with it, verification becomes, for the first time, an operation an ordinary node can actually undertake [14]. In an on-chain clearinghouse centered on this state machine, this fingerprint is typically written into each block as an `app_hash`: each validator independently substitutes the same batch of inputs into the same set of rules, computes its own state fingerprint, and then compares through consensus; as long as all nodes compute the same `app_hash`, this proves that they have seen the same path traversed by the same clearinghouse system (Sections 28.4.3 and 28.6.2). This is the concrete implementation of *verifiable by all*: verification is not to trust the module's self-declaration but to independently recompute its account states and then check them with an unforgeable fingerprint. Hyperliquid's HyperBFT consensus is a system that institutionalizes this single-point ruling with recomputation by all: the ruling is uniquely produced by the protocol, while every validator continuously recomputes and agrees on the result [8].

This places the trustworthiness of a decentralized clearinghouse on a foundation utterly different from that of a traditional central counterparty. Decentralization lies not in adjudicative authority itself but in the verification of adjudicative authority. This proposition must be set against common understandings to be understood accurately. One common understanding holds that decentralization should hand every decision to a vote of the many, and that the more power is dispersed among more actors, the more decentralized the system. But a clearinghouse is precisely the setting in which this understanding is hardest to sustain, because the books require a single, convergent ruling; if the state of a particular account at a particular moment were also handed to the many to rule on separately, the result would be not a more decentralized clearinghouse but a system that can never be reconciled and never converge. The key here is that what can and must be dispersed is not the ruling itself but the right to verify the ruling. The ruling must be single-point, or the system will not converge; verification must be by all, or the single point cannot be trusted. The entire engineering effort of blockchain consensus, letting multiple dispersed nodes agree on the same determinate state, was never meant to hand the power of decision to each person, but to let each person independently confirm that the sole decision has not been tampered with or manipulated [4]. The decentralization it promises is always the decentralization of verification, not the decentralization of adjudication. A traditional central counterparty is also single-point in adjudication, but its single point is tolerable because external capital, law, and regulation continuously constrain it and hold it to account when it fails; an ordinary user cannot verify the quality of its risk control and can only trust that external constraint (what Chapter 28 calls regulated opacity, Section 28.7) [6]. A decentralized clearinghouse adopts the opposite design: it does not require users to trust that the single point will not act maliciously; it requires that every step of that single point be public to all participants and recomputable and falsifiable by anyone at any time. The former guarantees the single point with external authority; the latter constrains the single point with universal verifiability. This principle is the entire reason the chain of state transitions in the preceding sections is called a decentralized clearinghouse rather than merely an automated one: an automated clearinghouse need only be deterministic, whereas a decentralized clearinghouse must also be recomputable by all. For this very reason, this chain of verifiability cannot break at any link: even if only one critical input (for example, the source of the mark price) escapes the range of what can be recomputed, the entire chain's decentralization promise fails, which leads to the seam problem analyzed in the next section.

### 29.1.6 Inter-layer transmission and systemic fragility

Regarding the connections between the boxes, the true starting point for the rest of this chapter is a proposition more worthy of vigilance than single-point authority and verification by all. Chapter 28 traced a cascading-failure path: an oracle fails, causing the liquidation module to be unable to price correctly, leading in turn to large-scale erroneous liquidations or liquidation delays; erroneous liquidations rapidly exhaust the insurance fund; the exhaustion of the insurance fund triggers the auto-deleveraging mechanism to forcibly cut profitable positions; and the deleveraging destroys the market's last loss-absorbing capacity, inviting a collapse of confidence and run-like liquidity withdrawals (Section 28.8.1). Every link on this mechanistic path is, viewed alone, well designed: the oracle has multi-source aggregation, liquidation has trigger thresholds, the insurance fund has an actuarial model, and auto-deleveraging has ordering rules. Yet once they are connected, the disaster grows from the transmission from one link to the next: the failure of the previous link becomes the trigger condition of the next.

This is not an accident unique to on-chain systems but a commonality of all complex financial networks. Systemic-risk research has repeatedly noted that the most dangerous fragility of a financial system often stems not from the size of any single node but from the connection structure among nodes: risk contagion along these connections amplifies a shock that could have been absorbed locally into a global collapse [15]. This research also reveals a nonlinearity especially pertinent to clearinghouses: the robustness and fragility of a financial network do not vary monotonically with the degree of connection but exhibit a phase-transition-like reversal. When shocks are small, dense connections are beneficial, spreading a loss thinly across many counterparties so that no single node is crushed; but once a shock crosses a certain critical scale, the same dense connections abruptly turn from a robust sharing network into a fragile contagion network, and each connection that just now was used to spread losses becomes, at this moment, a conduit that transmits losses in amplified form [15]. This means that the system's safety margin does not improve smoothly as buffers thicken but has a nonlinear critical point: within the critical point everything appears robust, and beyond it the connections themselves turn into carriers of contagion. Chapter 28 noted that the value of a layered architecture lies in severing this contagion chain, downgrading an instantaneous total collapse into a gradual pressure transmission, but it also conceded that layering does not eliminate systemic risk—it only changes the path of its transmission (Section 28.8.1). This section pushes that insight to its logical conclusion: since risk transmits along the seams, and transmission amplifies phase-transition-like at the critical point, the safety margin of a clearinghouse system is not the simple sum of its layer buffers but is limited singly by its weakest seam, because collapse always opens a gap at the first critical point to be crossed.

This leads to the core proposition that runs throughout this chapter: the strength of a clearinghouse system depends not on its strongest component but on its most fragile seam. The item-by-item analysis of the first 28 chapters directed attention chiefly to the components: each chapter analyzed one mechanism down to the level of formulas, proving how complex each is and how each fails. But what the whole-architecture perspective reveals is a fact that chapter-by-chapter narration does not readily present—that a system-level collapse almost never begins inside some component but always begins at the seam between two components, a seam for which no one is specifically responsible. The seam between the oracle and liquidation, between liquidation and the insurance fund, between the insurance fund and auto-deleveraging, between auto-deleveraging and market liquidity: the cascading path described above is, in essence, the trajectory of these successive seams being breached in turn. Seams are especially dangerous for a structural reason: each component has a clear owner (market makers are responsible for liquidity, the risk-control team for margin parameters, the oracle team for price-feed quality), but the transmission between two components often falls at the edge of everyone's field of view, becoming a link for which no one is specifically responsible. This ownerlessness is not negligence but a structural byproduct of the division of labor: because each team is assigned to optimize its own component and is assessed on its local metrics, the transmission between components is naturally excluded from clear responsibility boundaries, belonging to no job description, so that no one is specifically responsible for its failure. The strength of the system therefore obeys a near-weakest-link constraint: it is limited singly by the weakest seam, not raised by the strongest component; wherever one seam is breached, the individual complexity of the two components on either side cannot prevent a cascade. The entire point of integrating the clearinghouse into a state machine ultimately falls on identifying and reinforcing these seams, not on adding still more complexity to any component that is already complex enough.

The tasks of the remaining sections of this chapter can therefore be precisely defined along these seams. This chapter will answer, one by one, Chapter 28's three questions, and each question is, in substance, a question about some seam. The depth of the default waterfall is the seam between liquidation and the ultimate bearing of loss: starting from the defaulter's margin, through how many layers of capital willing to bear losses first must the loss pass before it reaches non-defaulting profitable parties? This is the subject of Section 29.2. Orderly degradation under extreme scenarios is the seam between the liquidation shock and the market's loss-absorbing capacity: when liquidation selling pressure strikes and no one plays lender of last resort, how does the system convert an instantaneous total collapse into a controlled, gradual failure? This is the subject of Section 29.3 [3]. Incentive alignment, in turn, is the seam between deterministic code and the human discretion that can never be replaced by code no matter what: where do pure market incentives fail, and how can the residual discretion be constrained to its narrowest? This is the subject of Section 29.4. Reading the three questions as three seams is the key step by which this chapter turns from local mechanism analysis to whole-architecture analysis, and it is also the first time the catalog of failures discussed piecemeal earlier is gathered into a unified map of fragility.

## 29.2 The missing layers of the default waterfall

The end of Section 29.1 decomposed Chapter 28's three questions into three seams, of which the first is the most direct and the first to arise: the depth of the default waterfall is the seam between liquidation and the ultimate bearing of loss. Liquidation stops the loss at the defaulter's own margin, and this is the branch's trigger point; but liquidation often cannot confine the loss entirely (market gaps, insufficient depth, and divergence between the mark price and the execution price all leave an uncovered shortfall), so the loss exceeds the range covered by margin, moves down the default waterfall layer by layer, and continues to shift to the next loss-bearing party. Depth is concerned with how many layers this waterfall can draw upon, and from what capital sources, to absorb the loss before allocating it to non-defaulting parties. Chapter 28 condensed this seam into a question—whether an on-chain system can achieve a default waterfall as deep as that of a traditional central counterparty (Section 28.3.6)—and left it to this chapter.

This section's answer is direct, and rather severe: current on-chain systems cannot yet achieve it. This does not mean the chain lacks a waterfall. Section 29.1 already described its four-layer structure—margin, insurance fund, liquidation vault, auto-deleveraging—which is not even fewer in number than the traditional waterfall. The problem is that among these four layers, what is missing is precisely the two key resources that give the traditional waterfall its depth. What is lacking is not imagination in mechanism design but a layer of capital that no clear actor is yet willing to bear: whether the protocol's own equity is willing to sit in the first-loss position. This section proves this judgment through six subsections: first clarifying where depth actually comes from, then examining one by one the various attempts made on-chain to fill these two layers and analyzing why none has yet formed a sustainably operating mechanism, and finally returning to the repeatedly deferred but never avoidable question: what kind of capital is willing to bear the first loss.

### 29.2.1 The sources of default-waterfall depth

To judge whether the chain can replicate a traditional central counterparty's default waterfall, one must first define what the depth of the traditional waterfall actually means. A common misunderstanding is to understand depth as a large number of layers or a large reserve size. Chapter 28 already gave the complete layer ordering: the defaulter's margin is the first line of defense, the default fund contributed by the defaulter is the second, the central counterparty's own capital is the third (this layer is specifically called skin in the game), the default fund jointly contributed by the remaining non-defaulting members is the fourth, and below that come recovery and resolution procedures (Section 28.6). Among the five layers, what makes this waterfall qualitatively different from a clearinghouse that relies on margin alone is not that it has as many as five layers but the two layers between the defaulter's resources and the non-defaulting parties' resources: the skin-in-the-game own capital and the members' prefunded mutualized default fund. These two layers are key not because of their size but because of their position.

The significance of the skin-in-the-game layer lies almost entirely in its ordering. Paddrik and Zhang's 2020 statistics on credit-derivatives central counterparties give a starkly contrasting pair of figures: the initial margin posted by defaulting members themselves accounts for approximately 77.9% of all prefunded resources, while the own capital contributed by the central counterparty accounts for only about 2.0% (Section 5.2.3) [13]. It should be noted that these proportions differ by cleared product; the figures cited here are the empirical values for credit-derivatives central counterparties (CCPs), and their absolute magnitudes should not be extrapolated as universal values for all CCPs. The 2.0% proportion is so small as to be almost negligible; by size alone, its actual contribution to loss absorption is minimal. But what traditional central-counterparty rules and regulatory practice retain this layer for is never its thickness but the ordering in which it is placed: it is typically positioned after the defaulter's own resources and before the remaining members' mutualized fund, bearing losses ahead of non-defaulting members' capital [2][13]. The entire purpose of this placement is to bind the clearinghouse's own interests to the risk control it operates.

To show why this ordering matters, imagine removing it. How high a margin a clearinghouse sets for members, what collateral it accepts, and how strict a standard it uses for stress testing—these discretionary choices all directly determine whether the waterfall will be breached, and they are all held by the clearinghouse itself. If the clearinghouse's own capital were not within the waterfall, or were placed after all members' mutualized fund, then the losses occasioned by relaxing its standards by an inch would be borne first by member capital rather than by its own capital, and it would then have a clear incentive: to set margins loosely so as to attract more business, transferring risk as much as possible to members. This is the basic moral hazard in the central-counterparty business model: the party operating risk control can avoid bearing losses for the failure of risk control. The skin-in-the-game layer is the structural corrective to this moral hazard. Once its own equity is forcibly placed ahead of other members' capital, it is, in making every risk-control discretionary choice, no longer a rule-maker that need bear no consequences but an interested party that will bear losses ahead of its clients. It realigns the operator of risk control with the bearer of the consequences of risk-control failure, which is the origin of its name and the reason its value cannot be measured by size. Theoretically, this layer is understood as a calibration of the central counterparty's incentives: when the clearinghouse can fully pass the cost of risk-control failure onto members, it has an incentive to relax standards and expand business; forcing it to place its own capital in the first-loss position is the most direct way to recalibrate this distorted incentive [6][7]. In other words, the 2.0% corresponds not to the principal loss-absorbing capacity but to a credible commitment: that the clearinghouse believes in the risk-control parameters it sets, believes in them enough to bear the risk of those parameter choices with its own capital.

The significance of the member-mutualization layer lies on another dimension, and it turns on two points: first, prefunded; second, non-defaulting. Prefunded means that this capital is already in place and locked up before the crisis arrives, and does not depend on any party's ad hoc goodwill or resolve in a stress scenario. What a crisis most tests is the ability to raise funds on the spot, because at that moment market liquidity dries up, each actor prioritizes protecting its own liquidity, and participants generally lack the willingness to provide liquidity in extreme stress scenarios; a mutualized fund prepaid and locked up in advance eases this predicament: in a stress scenario it is a definite resource already on the books, not a promise still to be honored amid the crisis. Non-defaulting means that those who bear the loss are the originally non-defaulting members, not some blameless profitable party. These two points together give the central counterparty, when facing the collapse of a single member, a buffer within its authority that need not be raised on the spot and will not be withdrawn on the spot. It converts a single point of default into a bounded collective loss that the entire membership has agreed in advance to share, rather than letting the loss be randomly allocated across the market to some non-defaulting participant [11]. The prior agreement here is especially important: when members join the clearinghouse and contribute to the default fund, they have already accepted the rule that their contributions may be drawn upon when another defaults and its resources are insufficient; so when losses actually occur and the mutualized fund is drawn upon, no one is requisitioned by surprise; every contributor bears, according to the prior contract, a bounded and foreseeable obligation.

A well-designed default waterfall, by means of these two layers (one that makes the operator bear losses first so as to correct its incentives, and one of capital that the benefiting collective prepares in advance and shares by agreement), forms a buffer between the defaulter's margin and the non-defaulting market participants that is thick enough and clearly ordered. At the normative level, the Principles for Financial Market Infrastructures require central counterparties to hold sufficient prefunded resources, to establish default-management procedures, and to disclose key rules; the CPMI-IOSCO recovery guidance and the FSB resolution guidance further institutionalize recovery tools, loss allocation, and resolution continuity [2][16][17]. The specific layer ordering of skin in the game and the member default fund is embodied, in central-counterparty rules and in empirical waterfalls, as an arrangement whereby the clearinghouse, the defaulting member, and non-defaulting members bear losses in a predetermined order [13]. Depth, fundamentally, is this institutionalized, clearly ordered arrangement of resources; what it measures is not the size of capital but how many layers of preplaced capital can, before losses are allocated to non-defaulting parties, absorb losses first, in a set order and unconditionally. With this understanding of depth (ordering, prefundedness, and unconditionality, not the number of layers or their size), turning to look at the chain, the missing places come clearly into view.

### 29.2.2 The layer gaps in the on-chain waterfall

Placing the depth standard clarified in the previous section back onto the chain, the four-layer structure described in Section 29.1—margin, insurance fund, liquidation vault, auto-deleveraging—forms gaps at the two most critical points of the traditional waterfall, as soon as one asks after the funding source of each layer.

Take the skin-in-the-game layer. What comes closest on-chain to the form of a default fund is a USDC insurance fund like that of dYdX v4 or Perp v2; these funds do exist in advance and are positioned before users bear losses, and from these two points they seem already to have the appearance a buffer layer should have. But as soon as one asks where these funds come from, the difference emerges: their funding source is almost entirely the accumulation of trading fees [18][19]. This is a public pool collected by the protocol and remitted back into the risk buffer: in essence, it uses the fees that market participants themselves pay, accumulated for loss absorption, rather than the protocol putting up its own equity to bear risk. This distinction appears subtle on the surface, yet it is the whole crux of the skin-in-the-game layer. Every unit of capital in the fee public pool ultimately comes from the fees traders pay; it is a redistribution of market participants' funds within the system, and the protocol is merely the aggregator and manager of these funds: its own financial interest is not placed in the loss-bearing order. No one's equity, like the central counterparty's 2.0%, is forcibly placed in the first-loss position and bears losses ahead of everyone else. So on-chain there is a fund but no skin-in-the-game layer. As the previous section said, what skin in the game obtains is a credible commitment: that the operator is willing to bear the economic consequences of its own risk-control parameters; and a public pool supplied by traders' fees, however thick it accumulates, cannot form this commitment, because the financial fate of the protocol operating the system is not bound to the consequences of risk-control failure. This is what Chapter 28's verbatim judgment refers to: the on-chain waterfall typically lacks a layer corresponding to the central counterparty's skin in the game (Section 28.3.6).

Take the member-mutualization layer. The very last end of the on-chain four-layer waterfall is auto-deleveraging, which, after both the insurance fund and the liquidation vault are exhausted, forcibly cuts the profitable parties' positions to make up the shortfall. Formally, auto-deleveraging also shares out losses and seems to play the role of mutualization, but compared against the two conditions above, it is not equivalent to traditional mutualization in either respect. First, it is not prefunded. Auto-deleveraging is a forced allocation that occurs only ex post; before the crisis no capital was set aside for it: it is not a definite resource already on the books but a resource extracted on the spot from profitable parties' positions when the crisis occurs. Prefunded mutualization avoids the ad hoc fundraising constraint, whereas auto-deleveraging extracts this capital on the spot precisely when the crisis occurs, and it does so by forcibly cutting the profitable positions that other participants could have continued to hold. Second, those who bear the loss are not a non-defaulting collective that agreed in advance to share it but those non-defaulting traders who happen to be on the profitable side; they have never signed any contract agreeing to bear another's default losses: their profitable positions are cut merely because, at that moment, they hold profitable positions and can therefore be forcibly deleveraged. Chapter 28 already made this distinction plain: what auto-deleveraging cuts is profitable positions, and it is not equivalent, in either the population that bears losses or the incentives, to the mutualization in a traditional default waterfall, which is prefunded and jointly shared by non-defaulting clearing members (Section 28.3.6). Prefunded mutualization is capital that a set of actors have agreed in advance to share, that is bounded, and that does not withdraw amid the crisis; auto-deleveraging is a loss allocation imposed ex post on specific non-defaulting parties. The two have only formal similarity; their economic meaning is not the same.

Placing these two gaps together, one can identify the true structure of the on-chain waterfall. It turns from a fee-supplied public pool directly to the ex post forced socialization of losses onto the profitable side, with the two middle layers (own-equity first loss and member prefunded mutualization) both absent. This layer gap is the fundamental reason the on-chain waterfall is shallower than the central counterparty's. It is shallow not in the number of layers; the four layers described in Section 29.1 are all present. It is shallow in this: when the insurance-fund public pool is exhausted, there exists, within the system's available range, no second layer of buffer composed of protocol equity or member prefunding to draw upon, so it can only immediately turn to auto-deleveraging, allocating tail losses to non-defaulting profitable parties more quickly and more directly (Section 29.1). A default waterfall with a skin-in-the-game layer and a member-mutualization layer still has, after public resources are exhausted, two layers of buffer, each independent and each with its own contributors, catching the loss in turn; whereas the on-chain waterfall presents as a structure lacking middle buffer layers, turning to non-defaulting parties to bear losses as soon as the public fund pool is exhausted, with no other buffer layer in between. The depth of a waterfall should be embodied in how many layers of buffer are still set before losses are allocated to non-defaulting parties, and it is at the point where buffers should most be set that the chain has two gaps. The remaining subsections of this section examine one by one the attempts made on-chain to fill these two gaps—whether by transferring the first loss to external capital providers, using a procyclical asset as a substitute for equity, or trying to migrate a mutualization mechanism on-chain, most of which have failed to operate sustainably—and identify why, to this day, no scheme has truly filled the gaps.

### 29.2.3 Liquidity providers as the counterparty: outsourcing the first loss

Since no actor is yet willing to place its own equity in the first-loss position, the chain has found a path that circumvents this constraint: outsourcing the first-loss position to capital outside the protocol. GMX and Gains are explicit liquidity-pool counterparty models, in which the trader's counterparty is not another trader but a capital pool funded by liquidity providers (LPs); profit and loss settle between the trader and the pool, and the pool is both the market-making liquidity and the first loss that absorbs shortfalls [20][21]. Synthetix's debt pool and Liquity's stability pool and redistribution mechanism are not the same kind of counterparty pool, but in economic meaning they likewise hand tail-bearing to stakers, stability-pool depositors, or other protocol participants, rather than to the protocol's own equity [22][23]. This design lineage does find several first-loss bearers for the chain, and formally it seems to fill the gap: after all, here is a body of preexisting capital that catches losses ahead of users. But the way it fills the gap exposes the meaning of the missing layer all the more clearly: the first loss is outsourced. The protocol itself still does not sit in the first-loss position; it merely places a class of capital providers—who enter voluntarily and can exit at any time—in the first-loss position.

GMX's experience displays the cost of this outsourcing plainly. Its GLP holders have directly borne losses twice, and on neither occasion was there any protocol-layer buffer ahead of them. The first was an oracle manipulation targeting AVAX in September 2022, which PeckShield estimated caused a loss of approximately $565,000 [24]. This figure is an estimate, and the attacker's identity remains unknown to this day: points that must be stated honestly, because this case differs from the clearly attributed manipulation cases discussed in Chapter 12 and must not be conflated with them; GLP holders received no compensation, and the loss was borne by them. The second was a reentrancy vulnerability in a GMX V1 contract in July 2025, which caused a loss of approximately $42 million [25]; only afterward did the protocol arrange compensation of approximately $44 million [26]. GMX has no insurance fund and no fee-supplied public pool, so the loss is simply GLP's loss, with no protocol-layer loss-absorption arrangement ahead of it [20]. The two events together constitute both the existence proof and the cost proof of the liquidity-provider-as-counterparty model: it does give the chain a first-loss layer that absorbs shortfalls, but this first-loss layer is a set of volunteers who can withdraw capital at any time, not an unconditional first loss borne by the protocol's own equity. Comparing the two events reveals another layer of meaning: compensation is ex post, discretionary, and event-dependent. The 2022 event compensated no one, while the 2025 event arranged excess compensation. Whether and how much compensation is paid depends on ex post decision rather than an ex ante contract, which shows that what GLP holders bear is not a first-loss obligation that is rule-bound and bounded but a risk of indeterminate exposure and uncertain compensation.

On the stablecoin side, crvUSD offers an isomorphic second example. It, too, has no dedicated insurance fund: once a shortfall appears on the minting side, it is borne passively by all crvUSD holders in the form of depeg risk; while bad debt in the isolated lending markets is borne by the lenders of each market individually [27]. Two empirical cases lay this bearing mechanism open. In June 2024, the Curve founder's own CRV-collateralized position was liquidated in a chain of liquidations across several lending protocols (including Curve's LlamaLend) as the CRV price fell by about 30%; he publicly acknowledged that this produced approximately $10 million in bad debt (most of which was later covered when a third party took it over at a discount) [28]. In the October 2025 crash, an isolated CRV-long LlamaLend market left approximately $700,000 in bad debt, borne by that market's lenders themselves [29]. Two easily confused things must be distinguished here: crvUSD's LLAMMA continuous soft liquidation and per-market debt ceilings are preventive designs that confine losses to a single market and keep them from spreading; they are not a loss-absorbing fund used to absorb losses after they occur. Prevention and loss absorption are two different things; isolating markets limits the range over which losses can spread, but it does not itself provide any capital to absorb losses; when bad debt truly occurs in an isolated market, it is ultimately still borne by that market's lenders themselves, with no layer of equity ahead of them bearing the loss. What isolation does is limit the range over which losses spread, not provide loss-absorbing capital for the market where the loss occurs.

Placing GMX and crvUSD side by side, the commonality of this class of design becomes clear: they do not lack first-loss bearers; on the contrary, they explicitly designate the bearers: GLP holders, stablecoin holders, isolated-market lenders. The problem is that these bearers are all outsourced volunteers, not the protocol's own equity. This is exactly the opposite of the skin-in-the-game layer discussed in the previous section: the entire point of the skin-in-the-game layer is to make the operator of risk control bear losses ahead of its clients, thereby correcting its incentives; whereas outsourcing the first loss does the reverse: it moves the loss-bearing position away from the operator and hands it to a class of capital providers who have no say over the risk-control parameters yet must bear their consequences. What the liquidity-provider-as-counterparty model finds for the chain is not the skin-in-the-game layer but its opposite: the protocol transfers the first-loss position to external capital providers and does not itself sit in the first-loss position. This does not fill the gap but temporarily covers it with the funds of another class of capital providers; and since this class of capital providers can withdraw funds at any time, even this temporary cover is not secure.

### 29.2.4 The procyclical failure of reflexive-token collateral

If the skin-in-the-game layer is missing, and outsourcing the first loss to liquidity providers merely covers that missing layer temporarily, then an idea closer to the protocol's own equity is to have the protocol's token perform that layer's function—that is, to have token holders stake the token as loss absorption, and to slash that stake before users suffer losses. This mechanistic path has already appeared on-chain, and there is a fairly clear existence proof: Aave's Safety Module. The stkAAVE staked into the Safety Module can be slashed when the protocol runs a shortfall, to make up the gap [30]; its successor, Umbrella, further turns this mechanism into an insurance layer that can be configured per market and underwritten in separate tranches [31]. As a primitive, its significance should not be underestimated: it does prove that a first-loss layer can be constructed on-chain that is prefunded, slashable, and bears losses ahead of users. Structurally, this is closer to the intent of skin in the game than a fee public pool, because what is slashed are holders of an asset directly bound to the protocol's interests: they hold and stake the governance token, which is itself a risk-sharing commitment to the protocol's future, and placing their stake in the first-loss position conveys a commitment to bear the economic consequences of the risk-control parameters. As far as existence goes, the chain is not unable to construct an equivalent of the skin-in-the-game layer; stkAAVE and Umbrella are real counterexamples.

But using a token for this layer has an unavoidable tension, and this tension appears precisely when it is most needed: the value of a token is procyclical. What a central counterparty places in the first-loss position is cash, whose face value does not change when a crisis arrives (a dollar is still a dollar) and whose loss-absorbing capacity is independent of market conditions. A protocol token is the opposite: in the very crisis in which the system truly needs it to absorb losses, the token's price often plunges in the same direction as the assets whose losses are being absorbed. The logic here is closed: the system is under stress, bad debt surfaces, the market panics: these are the moments when the token most ought to bear losses; and the token's price is itself the market's discount of the protocol's prospects, so when the protocol suffers a major risk event, the market's judgment of its prospects deteriorates at once, and the token falls sharply at the same moment. Thus loss-absorbing capacity, at the very instant it is most needed, instead declines: tokens of ostensibly ample value are staked, but by the time they must be realized to make up the shortfall, their own market value has already fallen; worse still, selling these tokens to make up the shortfall further depresses their price, forming a self-reinforcing price decline.

This is not an abstract worry; on-chain cases already show it. Synthetix long used SNX staking and a debt-pool mechanism to back sUSD, one of the most enduring and representative instances of reflexive-token backing [22]; but in April 2025, sUSD once depegged to about $0.68 [32], and by June 2026, SIP-423 had gone further and proposed freezing and retiring legacy sUSD, redeeming outstanding sUSD with newly minted SNX, and decoupling SNX staking from legacy sUSD obligations [33]. This means sUSD should no longer be described as a current success case still stably backed by SNX staking; more accurately, it has exposed the tail fragility of reflexive backing all the way into a governance exit phase. When the value of the backing asset and the stability of the backed asset affect each other, sUSD's stability was supposed to be supported by SNX's value, while SNX's value in turn hinges on whether the system runs well; once sUSD begins to depeg and the market loses confidence in the system, the two slide down together. Perpetual Protocol offers another, weaker piece of corroboration: its v2, through a matching structure based on Uniswap v3, reduced its reliance on the insurance fund itself [19]. Such design shifts show that a protocol token can be incorporated into a tail-tool portfolio but is hard to use as the principal stress-bearing capital in a default waterfall, because selling or issuing a token that is itself under stress to make up a shortfall amid a crisis often adds further selling pressure, weakening rather than strengthening solvency.

Reflexive-token loss absorption amplifies rather than absorbs shocks in the tail precisely because it builds the system's solvency on an asset highly positively correlated with the system. Cash-form own capital can serve as a buffer on the premise that its value is uncorrelated with the system's health; whereas the value of a protocol token is itself the market's discount of the protocol's future, highly positively correlated with the protocol's own fate. Building the first-loss layer on such an asset is tantamount to letting the buffer capital and the risk object being buffered fail together in the same stress scenario. This does not mean token slashing is worthless: stkAAVE and Umbrella prove it can structurally play the role of skin in the game, and under normal conditions and small-to-moderate shocks it does provide a real, slashable buffer, effective against local shortfalls that will not simultaneously crush the token's value. Its limitation is in the tail: in the extreme scenarios that would breach the entire waterfall and that most test depth, procyclicality weakens its absorbing capacity. In other words, the tokenized substitute the chain has found for the skin-in-the-game layer fails most easily where it least ought to fail, and the depth of a default waterfall measures exactly the loss-absorbing capacity in tail scenarios. A buffer effective only under normal conditions, but whose value falls markedly under stress scenarios, cannot yet be counted as the true depth of the waterfall.

### 29.2.5 Cross-protocol mutualization and the common-mode risk of restaking

While the skin-in-the-game layer is only outsourced or substituted, in limited fashion, by a procyclical asset, the member-mutualization layer's situation on-chain is even harder. Its on-chain candidate is cross-protocol mutual aid or a decentralized guarantee fund: letting multiple protocols share a backstop guarantee, structurally equivalent to the default fund in a traditional waterfall that is prefunded and jointly shared by members. This direction has been tried repeatedly, but the overall result is not encouraging; most attempts have failed to operate sustainably or to reach scale. To answer the first unresolved question, this history cannot be skipped.

The cross-protocol guarantee that has actually left a sustained payout record on-chain is, most typically, Nexus Mutual [34]. It is one of the few in this field that has indeed paid out to policyholders after events, and so it is often taken as an existence proof that on-chain member mutualization is feasible. But this single case itself illustrates the difficulty of the problem: around it, most other mutual-aid-type attempts have failed to operate sustainably. Mutual-aid-type insurers such as InsurAce and Unslashed often expose the pressure on reserves and governance discretion under correlated shocks. The UST depeg is one example: InsurAce's subsequently disclosed UST Depeg claims statistics show 234 covers corresponding to 173 claim filings, of which 155 were approved and 18 rejected, with net payouts of approximately $11.73 million after deductions, against related premium income of approximately $94,000 [35][36]. This set of facts cannot be simply written up as "claim denials" or "tightened payouts"; more accurately, it illustrates the capital pressure a mutual-aid guarantee faces in the face of systemic, co-triggered events: insured events often occur together, a systemic shock triggers claims on a large number of policies at once, and reserves accumulated in advance may be far smaller than the claim requests that arrive simultaneously. Per-market parametric insurance (such as Y2K, Cozy, and Risk Harbor) tries to underwrite with finer contracts triggered by specific risk events, avoiding the discretion problem of the mutual-aid type, but it in turn faces two other structural constraints. The first is basis risk: there is a gap between the payout trigger condition and the loss the policyholder actually suffers, so triggering a payout does not necessarily cover the actual loss, and an actual loss does not necessarily satisfy the trigger condition. The second is fragmentation of liquidity: the finer the slicing by event and by market, the more underwriting capacity is dispersed into isolated small pools, and the harder it is to form meaningful scale. Most of these protocols have already shut down or pivoted. Placing these successive attempts together, the chain's answer to the member-mutualization gap is: there have been repeated attempts, but most have failed to operate sustainably or reach scale, which shows this layer is not easy to construct.

The newly emerged restaking is the latest primitive in this direction and is often invested with high hopes. It directs the same stake toward multiple applications at once, using a single underlying economic security to provide guarantees for multiple protocols; EigenLayer and Symbiotic are its representatives [37][38]. Formally, this looks much like a cross-protocol shared backstop and seems just right to serve as on-chain member mutualization—one body of capital absorbing losses for many protocols at once. But it has two problems that cannot yet be avoided. The first is empirical: EigenLayer's actively validated service (AVS) slashing went live on mainnet on April 17, 2025, and its design allows AVSs to set custom slashing conditions, Operator Sets, and Unique Stake Allocation [39]; as of publicly available information on June 25, 2026, it has not yet experienced a real, large-scale loss event to test whether it can pay out as designed under stress. A buffer that has never actually been drawn upon remains reliable only at the design level; and the value of each layer of a default waterfall can ultimately be verified only at the moment it is truly breached and truly drawn upon. A guarantee that has not experienced such a moment cannot yet be counted as usable waterfall depth.

The second problem, and the more crucial, is structural: a shared security layer re-concentrates some risk onto the same underlying stake. This point must be made clear, because it directly bears on the boundary of treating restaking as a mutualization primitive. Traditional member mutualization works on an implicit premise—that members' defaults are, to a large extent, mutually independent, so that when one member falls, the rest are healthy and able to share. The structure of restaking weakens this premise. Chapter 28 already issued a clear warning on this: restaking makes the same stake guarantee multiple applications at once, and the aggregate security is shared rather than simply summed, so slashings and operator failures across different applications become mutually correlated, which reintroduces exactly common-mode failure and correlation risk (Section 28.6.5). To be fair, EigenLayer's Unique Stake Allocation tries to confine a given AVS's slashing to the portion of stake the operator has allocated to that AVS, so as to isolate the slashing risk of unrelated tasks [39]; this reduces direct contagion between unrelated AVSs but does not eliminate the higher-level correlations of the underlying collateral asset's price, operator overlap, liquidity-withdrawal pressure, and simultaneous slashing requests. A body of economic security relied upon jointly by multiple protocols, once it shrinks in a systemic shock, correspondingly shrinks the guarantee it provides to all related protocols; if multiple protocols relying on it come under stress simultaneously, slashing or exit demands on the underlying stake arise simultaneously, and their scale may be insufficient to cover the multiple simultaneous requests. It is a new primitive but far from a verified solution: untested in the tail and still carrying the very correlation problem it was meant to ease.

### 29.2.6 The current absence of an equally deep waterfall on-chain

Taking the preceding five subsections together, Chapter 28's most direct question can, within the range of the main on-chain clearing, perpetual, and lending protocols examined here as of June 25, 2026, only reach one direct conclusion: a default waterfall as deep as that of a traditional central counterparty cannot yet be achieved on-chain (Figure 29-2).

![Figure 29-2](./images/fig-29-2-en.png)

**Figure 29-2.** A comparison of default-waterfall depth: the traditional central counterparty's five layers, the on-chain status quo's four layers, and the ideal architecture (restoring the skin-in-the-game own-equity layer and the prefunded mutualization layer)

The weight of this conclusion is accurately grasped only after *depth* has been reclarified. Depth is never the number of layers, nor size, but how many layers of preplaced capital can, before losses are allocated to non-defaulting parties, absorb losses first, in a set order and unconditionally. Figure 29-2 places the three side by side: the traditional central counterparty's five-layer waterfall sets, between the defaulter's margin and the non-defaulting parties, the two layers of skin-in-the-game own capital and member prefunded mutualization; the on-chain status quo's four-layer waterfall turns from a fee-supplied insurance fund directly to auto-deleveraging of the profitable side, with those two middle layers absent; and an ideal decentralized clearinghouse needs to restore these two layers. Table 29-1 then compares, item by item, the funding source and ultimate bearer of each layer, so that the position of those two gaps comes clearly into view: in the traditional waterfall, both the protocol-own-equity column and the member-prefunded-mutualization column have clear contributors and bearers, whereas the two corresponding on-chain columns either read as a fee public pool, which is not equity, or point to profitable parties requisitioned ex post. The two exhibits together illustrate the same thing: the on-chain waterfall is not at a disadvantage in the number of layers; what is truly lacking is the two layers of resources that are correctly positioned, clearly ordered, and unconditionally in place.

| Waterfall layer | Traditional central counterparty | On-chain status quo |
| :--- | :--- | :--- |
| First-loss position · the defaulter itself | Defaulting member's initial margin (approximately 77.9% for credit-derivatives CCPs) | Account margin |
| Own-equity first loss (skin in the game) | Central counterparty's own capital (approximately 2.0% for credit-derivatives CCPs, placed ahead of member mutualization) | Absent — the insurance fund is fee-supplied, not the protocol's own equity |
| Prefunded mutualization | Default fund prefunded and jointly shared by non-defaulting members | Absent — auto-deleveraging cuts profitable positions ex post, not prefunded mutualization |
| Backstop and socialization | Additional assessments and recovery tools | Liquidation vault (liquidity-provider capital) → auto-deleveraging (socialization onto the profitable side) |

**Table 29-1.** Funding sources and ultimate loss-bearers of each layer of the default waterfall: a comparison of the traditional central counterparty and the on-chain status quo (Data source: compiled by the author based on Paddrik & Zhang 2020 [13]; the approximately 77.9% and approximately 2.0% figures are empirical shares of prefunded resources, vary by cleared product, and should not be extrapolated as universal values for all CCPs)

The chain has sought substitutes for these two gaps, and this section has examined them one by one; none has yet formed a sustainably operating mechanism. For the skin-in-the-game layer there are two substitutes: outsourcing the first loss to liquidity providers, and using a slashable token as an equity substitute. The former merely transfers the loss-bearing position to external capital providers rather than the protocol itself, and moreover the party bearing that position is a class of voluntary capital providers who can withdraw capital at any time; the latter, though structurally closest to skin in the game, carries a congenital procyclical defect and fails most easily in the tail scenarios where it most needs to function. For the member-mutualization layer there are also several substitutes: cross-protocol mutual aid, parametric insurance, and restaking. The first two have been tried repeatedly and mostly failed to operate sustainably, while restaking, though a new primitive, runs counter to the intent of dispersion because of common-mode risk and is untested in the tail; and auto-deleveraging at the end of the waterfall, still more, imposes ex post on non-defaulting profitable parties the loss that prefunded mutualization ought to bear. Each substitute touches the correct structural position, but none has yet formed an arrangement of unconditionally committing equity to that layer; they either transfer that position to external capital, or occupy that layer's position with a mechanism that evaporates under stress scenarios, or allocate the loss to actors who ought not to bear it.

The final judgment is therefore clear, and its cause lies not at the technical level. What is lacking is not some complex mechanism, nor engineering feasibility; primitives such as a slashable safety module and a cross-protocol shared guarantee have already appeared, and this section has shown their existence. What is truly lacking is the two most basic and hardest-to-obtain layers of capital: one layer of some actor's own equity willing to bear losses ahead of everyone; and one set of actors willing to prefund jointly, and share by agreement, before a stress scenario arrives. The substitutes the chain has found for the former have still developed over only a short time and all carry the inherent defect of procyclicality or common mode; the substitutes found for the latter allocate losses ex post to actors who ought not to bear them. Filling these two layers is the precondition for a decentralized clearinghouse to move from *having a default waterfall* to *the default waterfall having sufficient depth*; and the difficulty of filling them was never, from the outset, technical but the basic political-economy question: what kind of capital is willing to bear the first loss. This is the direct answer, on the dimension of depth, to Chapter 28's first unresolved question. It also foreshadows the equally basic and intractable seam the next section will face: when losses ultimately exceed the limit any waterfall can absorb, how should a system without a lender of last resort fail in an orderly way.

## 29.3 Orderly degradation without a lender of last resort

The second question Chapter 28 left concerns how to balance risk control against user experience (Section 28.3.6). Pursued along this system, this question quickly converges on a harder seam: the seam between the liquidation shock the clearinghouse imposes on defaulting positions and the loss-absorbing capacity the market can provide at that moment (Section 29.1). Liquidation necessarily throws positions onto the market, and the market does not necessarily have sufficient capacity to absorb them; the portion that cannot be absorbed is what orderly degradation must handle. This section answers how a clearinghouse system, when it can neither assume external rescue nor avoid facing its own extreme stress scenario alone, can confine the unavoidable failure at this seam within a controlled range.

### 29.3.1 The absence of a lender of last resort and the shift in design goals

Traditional finance's extreme moments usually feature a set of external stabilization tools, of which the lender of last resort is only the most conspicuous. A decentralized clearinghouse has no such public credit supporter, a point this book has repeatedly confirmed (Chapter 11, Table 11-2). Its implication is not merely one fewer form of relief; the absence of a lender of last resort means the system cannot outsource its liquidity tail risk to the public sector's ad hoc funding and must face its own extreme stress scenario alone. A central bank can, amid panic, open a liquidity window to an institution facing liquidity-withdrawal pressure but still solvent; a regulator or trading venue can, amid disorder, trigger a halt mechanism; a market maker may, under certain market rules, bear a continuous-quoting obligation. These external supports have no equivalent in an on-chain clearinghouse where no single actor can issue commands.

To show the weight of this absence, one must first list the several tools traditional finance uses to dampen shocks, then confirm one by one which equivalent the chain lacks. The first is the central bank's lender-of-last-resort function, which, through the discount window, injects funds amid panic into institutions that lack liquidity yet remain solvent, cutting off a liquidity crisis before it escalates into a solvency crisis that would otherwise have turned into liquidity-withdrawal pressure (Chapter 11, Table 11-2); the chain has no actor commanding such a public liquidity-supply mechanism that can create public credit out of nothing, and the balances of the insurance fund and the liquidation vault are both finite and prefunded, and each use depletes them. The second is the exchange's power to trigger circuit breakers and halts; traditional markets can, when prices fall through a preset threshold within a short time, forcibly suspend trading for a few to a dozen or more minutes, providing a time window for margin calls, digesting information, and repricing risk, cutting a stretch out of the positive feedback between panic selling and mechanical liquidation (Chapter 11); on-chain perpetual markets typically run around the clock, and although some protocols have admin pauses, parameter adjustments, or governance emergency channels, these are intra-protocol discretion, not external public authority. The third is market makers' obligation, mandated or institutionally incentivized, to quote continuously; traditional markets, under certain rules, still retain minimal quoting and market-maintenance arrangements; on-chain market making is mostly voluntary capital, which is all the more inclined to pull quotes the more a crisis deepens, so that loss-absorbing capacity evaporates at the very instant it is most needed. The fourth is the margin period of risk buffer; a traditional central counterparty calculates margin over a close-out risk horizon measured in days, leaving a buffer for margin calls, negotiation, and orderly close-out, whereas the chain compresses this time scale to real-time, trade-by-trade, with almost no room to maneuver between discovering insufficiency and executing liquidation (Chapter 11). These tools do not exist at the same intensity in all traditional markets, nor is the chain wholly without internal substitutes; the key difference is that the chain has no external backstop fully equivalent to the institutionalized shock absorbers of public credit, external halt powers, and mandated quoting obligations [3].

Therefore, a clearinghouse system without a lender of last resort must rewrite its design goal from *avoiding failure* to *failing in a controlled way in the worst case*. This adjustment is not an abandonment of risk governance but an acknowledgment of the resource constraint. Chapter 12 has argued that when losses exceed all of the defaulter's own resources and the system lacks sufficient external capital, full loss coverage can no longer be guaranteed by the mechanism itself; Chitra's model of auto-deleveraging likewise gives a formal constraint in the same direction, from the angle that solvency, revenue, and fairness cannot be had together [12]. The question thus shifts from "can no one lose anything" to "who bears the loss, how much, and at what tempo." A system that sets its goal at zero loss is promising a state that cannot be guaranteed by existing internal resources; only a system that sets its goal at controlled failure truly faces its own situation. What "controlled" means can be unpacked into three more concrete engineering goals: predictable (the path and upper bound of losses are written into the rules in advance, rather than adjudicated ad hoc amid the crisis); containable (losses are confined to the range that ought to bear them and do not spill over to unrelated participants); and absorbable (the layer that bears the loss actually has the corresponding resources on hand to absorb it when the event occurs). The conclusion that full loss coverage cannot be unconditionally guaranteed by internal mechanisms does not, in engineering terms, mean the system is doomed to collapse; it means the system must abandon the illusion of leaving no loss and instead shape the unavoidable loss into a predictable, containable, and absorbable form. Acknowledging this is the starting point of orderly degradation: the system no longer pursues the zero loss that its own resources cannot absorb but instead pursues confining the unavoidable loss within a predictable, containable, and absorbable range.

This is precisely one of the structural deficiencies the Bank for International Settlements pointed out in assessing decentralized finance: on-chain systems generally lack the shock absorbers on which traditional finance relies to dampen shocks: no central-bank liquidity window, no external halt power that a trading venue or regulator can exercise, and no market makers institutionally constrained to quote continuously amid a crisis [3]. A line of research isomorphic to this section's argument likewise notes that, absent such absorbers, the robustness of a decentralized clearing design must be constructed from within the mechanism rather than hoped for from external intervention [40]. The absence of shock absorbers is not the oversight of some protocol but an inherent property of the permissionless architecture; since one cannot seek help outside, the only handling path is to build the capacity to absorb shocks into the clearinghouse's own structure. This sharpens the section's question: to handle that seam between the liquidation shock and the market's loss-absorbing capacity, the chain's most direct and most engineerable internal means are two—confining the shock to as small a range as possible, and turning the shock itself into a design variable that can be actively adjusted. On the shock side, the system cannot conjure thicker market loss-absorbing capacity out of nothing, but it can decide at what scale and at what tempo the shock is thrown onto the market; on the loss-absorbing-capacity side, the system cannot attract external rescue funds, but it can decide which pool is responsible for absorbing, thereby framing the reach of the shock. The former manages the shock as a design variable; the latter delimits the scope of absorption through isolation (one acting on the shape of the shock, the other on the boundary of absorption), and together they constitute the principal internal intervention directions of a clearinghouse system without external aid at this seam. The rest of this section develops these two means in turn, then points out their shared cost.

### 29.3.2 Risk-pool isolation

The first means is to confine a single market's bad debt within that market's own risk pool, so that it cannot infect elsewhere. Its cautionary counterexample was already dissected in Chapter 12: in the JELLY incident of March 2025, Hyperliquid's liquidity vault HLP was forced to take over a single altcoin's defaulting position, and a risk that should have been confined to a niche market nearly imperiled the entire vault's solvency (Section 12.6) [41]. The problem lay not in the size of the vault but in the commingling of the vault: all markets' risk shared the same loss-bearing pool, so that any one market's tail event could infect participants of all other markets. One pool's capital simultaneously absorbing losses for all markets ostensibly raises loss-absorbing capacity, but in reality it forms a high risk correlation among all markets: once the most fragile market has a tail event, the other markets are affected as well.

The positive design therefore points to a single principle: let each market's risk be borne, as much as possible, by that market's own participants and not spill outward. This principle already has several mature implementations on-chain, each setting its isolation boundary at a different location, and each mechanism is worth identifying. Aave V3's isolation mode carves out a separate set of constraints for higher-risk collateral: for collateral listed as an isolated asset, the debt borrowed against it is capped by a debt ceiling denominated in a stablecoin, and only governance-approved stablecoins, not arbitrary assets, may be borrowed [42]. These two constraints together lock the bad debt that a high-risk asset may occasion, in advance, within a bounded range measured in the most easily liquidated stablecoin, so that it cannot penetrate the entire lending pool. Euler v2, launched in September 2024, pushed isolation to a fuller position, organizing lending in units of independent vaults, each carrying its own set of risk parameters, so that the risk boundary is defined by the vault boundary and a vault's internal bad debt is held within the vault by that boundary [43]. Compound III organizes the entire protocol into several markets centered on a single base asset, each market having only one borrowable base asset, around which several collateral types are configured; whichever market a lender puts funds into is the only market whose risk it bears, and markets are not interconnected [44]. Morpho Blue goes further, splitting lending into a large number of mutually immutable, mutually isolated markets, each of which, at creation, fixes once and for all its collateral, borrowable asset, liquidation loan-to-value (LTV) ratio, and other parameters, unchangeable thereafter; a lender therefore faces an isolated risk exposure whose boundary and parameters are determined in advance and that no one can adjust after the fact [45]. Hyperliquid itself, in HIP-3, introduced isolated markets in which the deployer bears the risk: whoever launches a new market must post a stake, bringing that market's possible risk, together with its bad debt, into the range borne by the launcher's stake, rather than letting it flow back to the shared vault [46]. There is no basis for saying HIP-3 was directly spawned by JELLY; but as a conceptual point of comparison, the commingling problem JELLY exposed is exactly the kind of problem isolated markets are meant to solve.

The insurance layer is also evolving in the same direction, and this evolutionary thread relates directly to the skin-in-the-game issue discussed in Section 29.2. Aave's Safety Module, already discussed in Section 29.2, whose staked tokens can be slashed in a shortfall event, is a shared first-loss pool—all markets' bad debt can draw on the same stake [30]; its successor design, Umbrella, splits this originally shared, slashable pool into isolated insurance by market, letting stakers choose to provide first-loss guarantees for only one or a few markets, thereby confining the question of *who absorbs this market's bad-debt loss* to those willing to absorb it for that market [31]. From a Safety Module in which one pool is shared and treats all shortfalls alike, to insurance tranched and underwritten per market, the path runs in the same direction, from commingling to isolation; it combines the first-loss guarantee discussed in Section 29.2 with the isolation principle discussed in this section within a single design.

The cost of isolation severing contagion is that it simultaneously causes liquidity fragmentation, and this is the first cost this section must point out. An isolated market cannot call on other markets' depth to absorb its own shock; when it truly has a tail event, the loss-absorbing capacity it can draw upon is limited to the existing resources in its own pool. A commingled pool, though it spreads contagion, also means any one market can borrow the whole pool's depth to absorb a shock; isolation severs this layer of mutual aid. This cost appears in the same form in each of the primitives above: the debt ceiling Aave V3 sets for an isolated asset, while blocking bad-debt spillover, also limits the absorbing depth such an asset can obtain; the finer Morpho Blue splits markets and the more tightly it locks parameters, the thinner the liquidity a single market can mobilize in a crisis; Umbrella's tranching of shared insurance by market, while making underwriters each responsible for their own, also deprives each market of the possibility of calling on the full thickness of a shared insurance pool. This leads to an unavoidable frontier tension: the finer the pool is split, the more fully contagion is severed, yet the thinner the depth a single market can mobilize in a crisis, and the more easily it is breached by even a modest liquidation; the larger the pool is aggregated, the thicker the loss-absorbing capacity a single market can borrow, yet once one market has a tail event, the risk spreads across the entire network. Depth and contagion are therefore two directions of the same trade-off: isolation trades liquidity fragmentation for contagion blockage (the more strictly the risk boundary is drawn, the fewer the resources available to absorb risk), and there is no optimal solution that simultaneously attains both thicker absorbing depth and contagion blockage.

### 29.3.3 Active shock management

The second means is to rewrite the price impact that liquidation imposes on the market, from a passively suffered consequence into an actively designed variable. Chapter 11 analyzed the liquidation shock as a passive consequence of cascade dynamics: a price decline triggers liquidations, whose selling in turn depresses the price, and the shock amplifies itself in a feedback loop (Sections 11.3 and 11.5). The idea of active shock management is to move this shock from the end of the causal chain forward to the starting point of design: since liquidation necessarily throws positions onto the market, at what price, at what tempo, and to whom they are thrown are no longer wholly exogenous, uncontrollable variables but parameters that can be designed in advance.

The clearest empirical contrast of this idea comes from two versions of MakerDAO's liquidation system, which happen to sit before and after this means was discovered [47]. Black Thursday, March 12, 2020, was a full exposure of the old system. That day Ethereum fell about 43% in a single day, and on-chain congestion meant that only a very few liquidators could submit bids in the liquidation auctions; the fixed-duration English auction the old system used therefore produced zero-bid outcomes, with approximately $8.32 million in collateral cleared at a price of 0 DAI, and the system was forced to mint more than 20,000 MKR to make up the resulting bad debt [48]. Here two figures must be kept apart: the approximately $8.32 million cleared at zero price is the scale of collateral auctioned off at zero, while the bad debt that ultimately fell within the system's range to bear was approximately $4.5 million to $5.3 million; the two are not the same problem. The root of the failure lay not in the magnitude of the market decline but in the auction mechanism itself compressing the range of loss-absorbing capacity too narrowly. To show this, one must first identify the mechanics of the English auction: an English auction bids upward within a fixed time window, and the highest bidder wins the item; but once the chain is congested and bid transactions cannot make it into blocks, the number of effective buyers able to squeeze into the window drops markedly, the execution boundary closes at the time limit, and the collateral is then cleared at zero price in a situation where, in effect, no one is effectively bidding [47]. The fixed-duration design limited the entry condition for loss-absorbing capacity to *must submit, amid congestion, a bid that successfully lands on-chain first*, and this entry condition is most restricted when the system most needs buyer participation.

Liquidations 2.0, launched in April 2021, responded one by one to the mechanism failures that day exposed, and its way of responding was to remake every dimension of the auction into an adjustable parameter [47]. It changed the English auction into a Dutch descending-price auction, and the mechanics of a Dutch auction happen to ease the exclusivity that congestion brings: the starting price is set at a multiple above the market price, and the price thereafter decreases over time along a preset curve, so that a liquidator need not bid first amid congestion, contesting scarce block space, but need only wait for the price to fall to a level favorable to it before participating in the transaction to conclude a fill, and the execution boundary of loss-absorbing capacity therefore no longer closes with time in a fixed manner [47]. This descending-price curve is itself a set of adjustable parameters, and this set of parameters happens to correspond to the several dimensions on which the old system failed. The multiple of the starting price relative to the market price determines how high the auction starts, setting an initial price above market for the collateral and then letting the market discover its true absorbing price. The auction duration has a cap; if the price descends through this duration and still no one takes it, the auction is deemed to have reached the cap and must be reset—this duration cap ensures that an auction does not indefinitely keep an unhandled risk position outstanding. The maximum decline the price is allowed to fall along the curve sets a floor, specifying the lowest proportion of the market price to which the price may fall in a single auction; crossing this floor triggers a reset rather than continued low-price disposal, avoiding the collateral being auctioned off at zero in a runaway price decline. This is the execution boundary that directly responds to Black Thursday's zero bids. And the step size of the curve determines whether the price falls smoothly and continuously or jumps down in discrete steps; the finer the step, the closer the price at which loss-absorbing capacity is attracted to the collateral's true liquidation price. Adjusting these several parameters amounts to adjusting the tempo and cost of the whole auction's attraction of loss-absorbers. It also settles fills atomically and in real time, and allows flash loans to participate in bidding: a bidder can, within a single transaction, borrow funds, buy the collateral, and then sell it to repay, with no need to hold cash in advance, so that potential buyers are expanded from the few liquidators holding cash at the time to anyone able, within one transaction, to borrow, buy, and resell, and the range of bidders is therefore greatly widened. It supports partial fills in batches, splitting the collateral in an auction into small portions that can be absorbed in tranches, not requiring a single buyer to absorb all the collateral at once, so that a large liquidation can be jointly digested in tranches by multiple small buyers, and the single-transaction capital required to absorb a large liquidation is broken down, further loosening the demand on a single buyer's financial strength. It is also equipped with a ClipperMom circuit breaker, which can be authorized to trigger a reset or even a suspension of the auction parameters when the oracle price deviates abnormally or the auction exhibits unexpected behavior, serving as a mechanism-level safeguard. Placing these two versions side by side (Figure 29-4 contrasts the price–time curves of the English and Dutch auctions: the English auction waits for bids within a fixed duration and terminates when the execution boundary expires, while the Dutch auction lets the price descend continuously along a curve, absorbable atomically at any time) reveals the entire point of active shock management: it does not make the liquidation shock disappear entirely but turns the price and tempo of liquidation into mechanism parameters the designer can configure in advance. Every design of the old system that excluded loss-absorbing capacity from the execution range was changed into an adjustable parameter open to more absorbers. Its official design document does not name Black Thursday, but every item of this mechanism corresponds to some failure of that day.

![Figure 29-4](./images/fig-29-4-en.png)

**Figure 29-4.** A comparison of the price–time curves of the English auction and the Dutch auction (qualitative axes; conceptual illustration, not empirical data)

### 29.3.4 Other degradation mechanisms

The Dutch auction is only one kind of active shock-management tool; the chain has also evolved several degradation primitives that differ in approach yet all refuse to treat the liquidation shock as an exogenous variable. Liquity adopts an absorption mechanism rather than an auction mechanism: it sets up a stability pool, letting stablecoin holders deposit funds into it in advance; when a vault is liquidated, the stability pool immediately burns the corresponding amount of stablecoin in exchange for the liquidated collateral, and the pool's depositors absorb this collateral in proportion to their shares and share in its profit and loss [23]. Because liquidation is triggered only when a position's collateralization ratio falls below a threshold, that is, when the collateral value is still slightly above the debt, the collateral the stability-pool depositors receive is, under normal circumstances, slightly more valuable than the stablecoin they burn, and this difference is their compensation for bearing loss risk; absorption is therefore not uncompensated bearing but a transaction with consideration. This mechanistic path is also equipped with a supplementary mechanism for the case where the stability pool is exhausted: when the stablecoin in the stability pool is insufficient to offset a liquidation, the debt and collateral of that liquidated vault are proportionally redistributed to the remaining still-active vaults, jointly borne by the owners of those vaults [23]. The value of the two mechanisms together is that they are immediate and do not sell to the open market, thereby wholly avoiding the loss-absorbing-capacity problem an auction must face; the cost is that they socialize the loss onto the stability pool's depositors and even the remaining borrowers, and the absorbing capacity of the stability-pool main path is limited by the stability pool's balance at the time—once the stability pool is exhausted, the system can only fall back on the more dilutive and more contagious backup path of redistribution.

Euler's soft liquidation designs the liquidation discount as a continuous curve that rises as account health declines, so that liquidation is triggered when a position has just crossed the boundary and the discount is still small [43]. To show its mechanistic advantage, take as a contrast Compound III, which uses a fixed-discount liquidation model: whether a liquidator steps in when a position has just crossed the boundary or when it is already deeply insolvent, the discount obtained is the same predetermined fixed value [44]. The problem with a fixed discount is that, when a position has just crossed the boundary and the discount appears too thick relative to the risk, it incites liquidators to engage in front-running and gas-fee bidding to seize this certain profit. Euler's continuous discount curve is a response to this problem, designing the reward to liquidators to grow continuously as health worsens: roughly, the reward is proportional to the degree of health's deviation from a sound level, with the discount higher the closer the position is to insolvency [43]. The effect of this continuous incentive curve is to attract liquidation the moment it becomes marginally favorable: the discount is no longer a fixed value paid out in one lump after a threshold is crossed but rises continuously from a low level, so liquidation becomes earlier, smaller, and more dispersed, the upper bound of profit a single liquidation can seize is lowered, and the front-running and gas-fee bidding among liquidators to seize a large liquidation are correspondingly weakened. crvUSD's LLAMMA rewrites liquidation as a process occurring continuously along a price range: it distributes collateral over a price band and makes markets there, automatically converting collateral grid by grid into stablecoin along the band as the price falls, and back again as the price rises, so that a position is gradually and smoothly soft-liquidated during a decline rather than being hard-liquidated all at once at some threshold [27]. This mechanism in essence distributes the liquidation shock across a continuous market-making process over an entire price range, converting out only a small portion of collateral for each grid of decline, so the price impact is sliced into multiple smaller increments rather than a one-time large sell-off at some threshold; only in the extreme case where the price falls deep out of this soft-liquidation band and stays there for a long time does it fall into hard liquidation. It essentially converts liquidation from a discrete and irreversible event into a continuous transformation process that is reversible when the price recovers. Ajna takes another simplifying path: it removes reliance on an oracle and instead lets lenders each specify, when depositing funds, the collateral valuation they are willing to accept, so the market's liquidation threshold is determined endogenously by lenders' quotes rather than given by an external oracle that may be manipulated or may fail in a crisis [49]. When a borrowing position is undercollateralized by lenders' endogenous pricing, anyone may initiate a liquidation, launching a Dutch auction on that position and letting a descending-price auction find the absorber [49]; it therefore combines Section 29.3.3's Dutch auction with a set of liquidation trigger conditions that do not rely on an oracle into the same mechanism combination, separating the liquidation-trigger determination from external oracle dependence. What these designs have in common is that they all refuse to accept the premise that the liquidation shock is an exogenous variable that can only be passively suffered; each starts from a different link, yet all convert the shock that Chapter 11 treated as a passive consequence into a parameter the designer can configure. The relationship of this set of examples to perpetual clearinghouses should be stated: they mostly come from lending and overcollateralized-stablecoin systems and cannot directly prove that perpetual clearinghouses already possess equivalent mechanisms; what they prove is that the price, timing, trigger, and absorber of forced disposal can be engineered and reshaped. Migrating them to a perpetual clearinghouse would still require handling compatibility among position transferability, order-book continuity, isolated/cross margin, market-maker inventory, and predefined loss layers. These paths are not mutually exclusive but decompose the same passive shock into several intervenable links (the destination of the selling, the shape of the incentive, the temporal distribution of liquidation, the source of the trigger determination), each of which was once an exogenous, uncontrollable condition and is now rewritten by some primitive into a designable endogenous variable. The chain's active management of the liquidation shock is therefore not the isolated design of some protocol but an engineering line advancing across multiple protocols from multiple angles at once. Together with Section 29.3.3's Dutch auction, they constitute the existing on-chain toolkit for orderly degradation (Figure 29-3 juxtaposes the effect of these two means on the cascade path: risk-pool isolation severs the lateral contagion, and active shock management slows the vertical escalation).

![Figure 29-3](./images/fig-29-3-en.png)

**Figure 29-3.** Risk-pool isolation and active shock management: from passive cascade to orderly degradation (conceptual illustration)

### 29.3.5 The three costs of orderly degradation

Every orderly-degradation mechanism has a cost that must be borne. Each means only transfers the loss from one position to another and cannot eliminate the loss itself: this is the architecture-level reappearance of Chapter 12's impossibility theorem (Section 12.2.3). That theorem shows that full loss coverage is no longer attainable; at the architecture level, this means any degradation mechanism can only choose among who bears, when they bear, and in what form they bear, and cannot make the bearing itself disappear.

The first cost is the dilemma between slowing the auction and deepening bad debt. A Dutch auction slows the tempo to weaken a single shock, but the slower it goes, the greater the risk that the collateral's value continues to fall during the auction, and the deeper the bad debt ultimately left may be. MakerDAO's own design document acknowledges this dilemma almost verbatim, and points in two directions at once: too fast a decline (the price curve falling faster than loss-absorbing capacity enters) means bidders pay a price far below what they would have been willing to pay, producing avoidable permanent bad debt; too slow a decline means the auction price may keep failing to catch up with a still-falling market price, and the collateral keeps depreciating in the slow descent, likewise leaving bad debt; the document even concedes that the choice of price curve remains an active research area, with no single curve optimal in both directions at once [47]. This dilemma cannot be resolved once and for all by tuning parameters: its two ends each point to opposite failures, and it is not a problem with a single optimal solution but a double-bind whose two ends both lead to loss, so the most a designer can do is choose the relatively more bearable of the two losses. A study that quantifies, by simulation, the trade-off between liquidation speed and incentive cost provides a quantitative characterization of this dilemma, confirming that the relationship whereby slower liquidation requires higher incentive cost to attract loss-absorbers is not a qualitative intuition but measurable—each notch of slowing in liquidation requires, to still attract buyer participation at that moment, a higher discount or incentive, and this extra incentive is itself a cost the system bears [50]. The significance of this quantification is that it converts the ostensibly experience-judgeable trade-off of fast versus slow into a cost curve that can be measured yet cannot be eliminated: what faster buys is a smaller risk of market-price decline, and what it pays is a higher immediate incentive cost, and the two can only trade off against each other. Orderly degradation has no uniform standard solution for precisely this reason: the fast-or-slow of the auction sits between two kinds of bad-debt risk, and extremizing the choice in either direction produces loss.

The second cost is that absorption-type mechanisms socialize the loss. What Liquity's stability pool and redistribution trade for immediate absorption is the transfer of the loss from the liquidated party onto the stability pool's depositors [23]; these depositors are not the defaulting party of any position, yet, because they put funds into the stability pool in advance, they share the loss when liquidation occurs. Two different senses of socialization are worth distinguishing here. Under normal circumstances, the collateral depositors receive is slightly more valuable than the stablecoin they burn, and what they take on is less a loss than a transaction with a discounted compensation; only when the market falls deep enough that the collateral, once received, keeps depreciating to less than that stablecoin do depositors truly bear a net loss. The redistribution path goes a step further, allocating a defaulting vault's shortfall to a set of other borrowers who have nothing to do with that default, so the scope of socialization spreads from voluntarily pooled depositors to bystanders who never chose to take on anyone's risk. Socialization is not a defect of this mechanistic path but its mode of operation; it is precisely by spreading the loss thinly onto a set of bearers who are preplaced and largely voluntary that it trades for immediacy and no selling pressure. That is, absorption-type mechanisms do not eliminate that loss; they merely transfer it from a defaulter forced to bear it onto a set of depositors who agreed in advance to bear it and take collateral at a discount as compensation, or, in the extreme case, onto a set of other borrowers who passively bear the loss; the loss changes bearers, but its total does not diminish.

The third cost is that isolation trades for liquidity fragmentation, a point Section 29.3.2 already made: what isolation trades for by blocking contagion is that each pool can only rely on the depth of its own existing resources to absorb a shock. Placing the three costs side by side reveals that they are, in substance, three facets of the same structural fact: loss can only be redistributed along different dimensions and cannot be eliminated. The fast-or-slow of the auction redistributes the loss along the time dimension: cash it out now at a discount, or drag it into the future and suffer deeper depreciation. Absorption-type mechanisms redistribute the loss along the participant dimension: from the defaulter onto preplaced bearers. Isolation redistributes the loss along the market dimension: deciding whether it is borne by this market alone or spills over to the whole pool. The three together point to the same fact: the core design task of orderly degradation lies not in eliminating these costs but in choosing, under a given market structure, a combination of costs that lets the system survive. They are all projections, on different facets, of Chapter 12's impossibility theorem; since loss cannot vanish into thin air, all engineering effort can only be engineering about how loss is allocated.

### 29.3.6 The incentive failure of liquidation execution

There is one further cost, more hidden and deeper than the three above, because it leads the discussion into the next section's theme. All these active shock-management mechanisms—auction, soft liquidation, or stability pool—presuppose one premise: that at the moment liquidation needs to occur, there will always be participants willing to execute it. The chain has no liquidators compelled by regulation to perform; liquidation relies on market incentives, and who liquidates depends on whether liquidation is profitable at that moment. To show how fragile this premise is, one must first identify the cost-benefit relationship of on-chain liquidators. A liquidator's decision to execute turns on a cost-benefit difference: the discount or reward obtainable from liquidating this position, minus the gas cost of sending this liquidation transaction on-chain, is worth doing only if the difference is positive. In calm times this difference is large: gas is cheap, discounts are considerable, and liquidators participate actively; whereas it is at the extreme moment when liquidation is most needed that this difference is squeezed from both ends at once. On one end is the gas cost: amid a crisis, on-chain transactions surge, competition for block space intensifies, and to get its transaction on-chain in time a liquidator must keep raising its bid in the priority-fee auction, so gas cost soars and may even exceed the profit of the liquidation itself. On the other end is loss-absorbing capacity: the liquidated collateral must be sellable to realize the discount, and in a crisis market depth precisely evaporates, so a liquidator, even given the chance to dispose of a position, may still show a negative return after selling. With both ends contracting at once, the difference that should have been positive turns negative, so liquidators rationally choose not to participate, and liquidation, at the moment it is most needed, sees its executors exit.

This cost-benefit relationship has a sharper dynamic, manifesting as a dynamic change on the gas-cost side. The allocation of on-chain block space is itself an auction ordered by priority-fee bids: whoever is willing to pay a higher priority fee for its transaction gets packed first. In calm times this auction is lightly congested, and a liquidator can get on-chain by paying a negligible priority fee; but once a crisis descends and a mass of transactions contests the same batch of scarce block space, priority fees are bid up in competition, and a liquidator, to complete liquidation before the collateral depreciates further, often has to join this bidding up. So the gas cost of a liquidation is not an exogenous constant but a variable that rises endogenously with the degree of congestion: the heavier the congestion, the higher the cost of sending liquidation on-chain, and this occurs at the moment when liquidation most needs to complete quickly. When the priority fee is bid above the height of the liquidation discount, a rational liquidator stops participating—not because it cannot find positions to liquidate but because, on the calculation, it is unprofitable. Congestion and unprofitability here stack into a positive feedback: the deeper the crisis, the more expensive gas and the thinner loss-absorbing capacity, the more unprofitable liquidation, the fewer liquidators willing to execute it, the more unhandled bad positions accumulate, further intensifying the crisis. Liquidators' collective cessation of participation is, in essence, an executor exit that is unorganized yet triggered simultaneously by the same economic calculus.

This is not a theoretical worry but a repeatedly observed fact. In the sharp decline of May 2021, on-chain congestion and soaring gas costs caused some liquidations to fail to execute in time; the liquidation itself was profitable, but the on-chain transaction required to execute it either could not squeeze into a block amid congestion or had its gas cost offset the liquidation profit [51]. In November 2022, a CRV lending position on Aave could not be effectively disposed of by liquidators for a long time amid a targeted market manipulation, ultimately leaving bad debt in that market [52]; liquidators did not fail to exist: rather, when liquidation was unprofitable under such price and liquidity conditions, or when on-chain congestion made it impossible to fill, they rationally chose not to participate. Qin et al. give a systematic empirical characterization of the phenomenon of congestion causing liquidation failures, elevating the fragility whereby liquidation's execution depends on a market condition that may fail precisely in a crisis from an individual case to a measurable general regularity [51]. These two cases sit at the two ends of a spectrum (at one end, gas congestion making a profitable liquidation unexecutable; at the other, market conditions making an executable liquidation unprofitable), and both point to the same structural weakness: the occurrence of liquidation hinges on a condition that is least reliable in a crisis.

This is the structural gap of market incentives substituting for regulatory compulsion. Regulation can command a clearing member to perform, whether or not performance is favorable to it at that moment; whereas a market can attract liquidators only when it is profitable and finds no response when it is not. The divide between mandated performance and incentive-based performance lies here: the former treats executing liquidation as a non-refusable obligation, so a member must perform even at a loss, growing more rigid in a crisis; the latter sets it as an activity one may freely choose whether to join, so a liquidator may exit when it is unprofitable, and the execution constraint tends to weaken in a crisis, exactly when it most needs to remain rigid. This gap is not the misconfiguration of some incentive parameter but an intrinsic property of the very choice to substitute incentives for compulsion: so long as the occurrence of liquidation depends on whether it pays at that moment, there is always an extreme moment of negative return that makes all carefully designed degradation mechanisms collectively lose their executors. A clearinghouse system that substitutes incentives for commands finds all its capacity for orderly degradation (isolation, auction, or soft liquidation alike) ultimately constrained by the same condition: whether its incentives still hold at the worst moment. And this assumption, whose core is *executors willing to participate at that moment*, is least reliable precisely when it most needs to hold. Orderly degradation thereby reveals its own boundary; this boundary can no longer be resolved by improving degradation mechanisms but must be answered head-on: when the system's stability depends on market incentives, and market incentives reverse in a crisis, what mechanism can this clearinghouse system still rely on? This is precisely the question the next section answers.

## 29.4 The boundary of market incentives and the constraint of residual discretion

The previous section ended on a gap. At the extreme moment when liquidation is most needed, liquidators may be collectively absent because it is unprofitable, and a clearinghouse system that substitutes incentives for commands finds its capacity for orderly degradation ultimately constrained by whether its incentives still hold at the worst moment. This gap is not an engineering defect that can be resolved by improving code but a boundary problem about what code can and cannot do. It leads to the last seam of this chapter: in a clearinghouse system that runs on deterministic code, there is a seam between the deterministic code and the human discretion that can never be replaced by code no matter what. What this section does is define the exact location of this seam: how far market incentives can reach, from where discretion becomes ineliminable, and how the ineliminable portion of discretion should be constrained to the minimum.

This seam is the hardest of the chapter because it cannot, like the first two, be narrowed by adding a layer of equity buffer or switching to a different auction mechanism. It asks not how to improve the system itself but who fills, and in what way, the remainder once the system's capacity ends. To answer it, one must first understand the first mechanistic premise on which a decentralized clearinghouse operates, then identify the boundary of this mechanistic premise, and finally explain how the scope borne by human discretion beyond that boundary should be compressed and constrained.

### 29.4.1 Market incentives as a substitute for regulatory compulsion

The first mechanistic premise on which a decentralized clearinghouse operates is the substitution of market incentives for regulatory compulsion. This mechanistic premise is the root-level divide between it and a traditional central counterparty, and to understand it one must start from two utterly different logics of mobilization.

In a traditional central-counterparty system, what makes clearing members fund the default fund and serve as loss-absorbing capacity in a crisis is, in the end, an obligation-based logic. For an institution to obtain clearing membership, it must, according to the rules, contribute its share of the default fund, must satisfy continuous capital and margin requirements, and must take on disposed positions in default-management auctions; these are not choices of whether it is willing but compulsory obligations attached to membership itself, backed by the clearinghouse's membership rules and the regulator's prudential requirements applying pressure jointly (Section 5.3.4) [2]. In comparing the two kinds of default waterfall, this book has already pointed out the strictest facet of this compulsory force: a traditional clearinghouse not only prefunds the default fund but also holds the power to levy statutory additional assessments on members, whereas on-chain protocols' insurance funds generally lack such a compulsory replenishment mechanism (Section 5.4.5, Table 5-2). A central counterparty can therefore, at the moment it most needs resources, conscript directly from a body of rule-bound members; it is this conscriptability that constitutes the reliability source of the mutualized capital in the waterfall's upper layers. That the negative externality of externalizing losses onto the system can be internalized also relies not entirely on participants' goodwill but first on this compulsory institutional arrangement operating as a constraint in the background (Section 12.1.3).

A decentralized clearinghouse has no membership rules that can issue compulsory directives, nor a regulator that can compel performance. What it can rely on is only another logic—mobilization based on self-interest. Liquidity providers voluntarily deposit funds into the liquidation vault because the returns from market making and absorbing liquidations are enough to compensate the risk they bear; liquidators voluntarily execute liquidations because the liquidation discount is profitable to them; arbitrageurs voluntarily close the divergence between the mark price and the spot price because the spread is itself a profit. No link is commanded; the operation of the entire system is built on a complex assumption: that each rational, self-interested participant, in pursuing its own return, happens to take exactly the action the system's stability requires. The clearinghouse commands no one but instead designs a set of payoffs so that dispersed, mutually distrusting participants, who bear no institutional obligation to the system, keep the system running out of self-interest alone. This book's default-waterfall comparison table compresses this divide into the two columns of ultimate loss absorption and liquidation execution: the ultimate backstop in the traditional system is the settlement member bound by statutory obligation, whereas the backstop in the on-chain system is external arbitrageurs and protocol liquidators, relying on the market force of the liquidation discount rather than any directive (Section 5.4.5, Table 5-2).

This substitution has a clear institutional appeal. It requires no trust in any specific actor—no single member constitutes an indispensable pillar of the system's stability, and if any one liquidator exits, another is attracted by the same discount; it also requires no one to obtain permission—becoming a liquidator or liquidity provider needs no qualification review, only an address and a sum of capital. In the language of mechanism design, this system pursues incentive compatibility: designing the rules so that a participant's dominant strategy happens to equal the behavior the system desires, so that the compatibility of incentives itself becomes the enforcement mechanism, with no need to layer compulsion on top of incentives (Section 12.5.1) [53]. What Chapter 12 pointed out in evaluating Hyperliquid's liquidation vault is the full embodiment of this logic: liquidation profits accrue to liquidity providers, the vault's annualized return becomes directly the market's dynamic pricing of liquidation risk, and risk management thereby turns from the platform's burden into the community's opportunity (Section 12.6.1) [8]. This is also a mirror image of the governance that incomplete-contract theory reveals: since one cannot rely on a complete contract to exhaust and compel all due obligations, one settles for the next best and hands the remaining coordination to appropriately designed property rights and payoffs, letting the parties spontaneously execute, for their own interest, the behavior conforming to the system's goals (Section 12.4.4) [54]. In this sense, a decentralized clearinghouse system is less a law-enforcement system than an incentive structure: it does not stipulate what participants must do; it only ensures that when participants act in their own interest, what they do happens to be what the system needs.

The difference between these two logics is deeper than the literal opposition of compulsion and voluntariness. The obligation-based logic is, in essence, a governance relying on supervision and punishment; it presupposes an authority able to observe whether members perform and to impose sanctions when they default, and the very existence of this authority is an expensive apparatus that must be continuously sustained by capital, law, and institutions. The self-interest-based logic tries to move governance's cost forward to the design stage of the mechanism: once the payoff structure is tuned so that self-interest coincides with the system's goals, there is no longer any need, in real time, for a supervisor watching every participant at every moment, because no one has an incentive to do what the system does not want. This is precisely the ambition of the discipline of mechanism design: to induce, with rules designed ex ante, the behavior that would otherwise require ex post compulsion (Section 12.5.1) [53]. A decentralized clearinghouse pushes this ambition to an extreme that traditional institutions dare not reach: it simply abolishes the supervisory authority and stakes its entire mechanistic premise on the proposition that payoffs alone suffice to substitute for supervision. When the payoffs are sufficient, this is an institutional substitution attractive on a cost-benefit basis, replacing an entire regulatory system requiring trust and continuous maintenance with a payoff rule anyone can recompute. But this institutional substitution harbors an unavoidable point of fragility: the value of a supervisory authority lies in its not depending on whether the supervised still deems performance favorable at this moment; whereas pure payoff incentives stake the system's reliability on whether participants still find it worthwhile at this moment: a condition that varies with market state.

Replacing the obligation-based logic with the self-interest-based logic is a genuine transfer of institutional burden; it removes the entire membership-and-regulation framework on which a central counterparty relies to operate, in exchange for permissionlessness and trustlessness. But this replacement is not without cost. Encapsulated in the removed framework was a compulsory force still effective at the moment of crisis; once it is replaced by voluntary incentives, a hidden problem is inherited along with it: does that coincidence of self-interest and stability hold at all moments?

### 29.4.2 Procyclicality and predictability attacks

The boundary of market incentives shows itself most clearly precisely at the moment the system most needs them. The first proposition this section advances is: the coincidence of self-interest and stability is a procyclical assumption, holding in calm times and reversing in a crisis.

The fragility of this assumption was seen from one side in the previous section: liquidators rationally exit at the moment liquidation is most needed, because it is unprofitable or the chain is congested (Section 29.3) [51]. But it is not only liquidators who exit. Applying the same logic to the liquidity providers of the liquidation vault yields a stricter conclusion. A liquidity provider keeps funds in the vault to absorb liquidations because, under normal conditions, market-making returns compensate the tail risk it bears; but when volatility suddenly widens, when the mark price begins to jump violently, when successive liquidations are queued waiting to be absorbed, it faces not a business with a fitting risk premium but an exposure that may cause principal loss. A rational liquidity provider withdraws capital at this moment, which is precisely the moment the system most needs loss-absorbing capacity. The incentive has not failed here; it operates fully according to the logic of rational self-interest: it is the correct operation of the incentive that makes the capital meant to serve as a buffer withdraw liquidity at the moment the buffer is most needed. The preceding text already characterized this procyclical resonance of confidence and liquidity: from no one caring to everyone panicking, with almost no smooth transition zone in between (Section 12.3). The first cost of substituting market incentives for regulatory compulsion manifests here: it exchanges a resource that could be conscripted in a crisis for a resource that tends to exit in a crisis. The deeper meaning of the missing shock absorbers the Bank for International Settlements pointed out in assessing decentralized finance lies here: on-chain systems not only lack the central bank's liquidity window but also lack even those private actors that regulation requires to quote and absorb continuously in a crisis, leaving only voluntary capital that can exit as market conditions change (Section 29.3) [3].

The second proposition this section advances is more subtle: the very determinism of a purely algorithmic clearinghouse constitutes an attack surface. A central counterparty's default management is hard to exploit precisely because its critical moments contain discretionary factors; a regulator and market makers can, with unpredictable on-the-spot judgment, add a layer of uncertainty for anyone seeking to profit by exploiting the system's rules. A decentralized clearinghouse adopts the opposite design: all its rules are transparently encoded on-chain, and its reaction to every state is wholly determined and wholly deducible. This determinism is its institutional advantage: anyone can verify in advance how the system will treat them. But the same determinism is also its weakness: anyone can also compute in advance how much it costs to force the system into a particular state, and how much value can be extracted from the system's deterministic reaction in that state (Section 12.4.1). When a system's output for every input can be precisely predicted, it can not only be used but also strategically exploited. An attacker can pre-position ahead of a liquidation or auto-deleveraging that can be algorithmically triggered, letting the system's deterministic action, when pushed into that state, transfer value into the attacker's control. Many of the liquidation cascades and oracle manipulations dissected in Chapters 11 and 14 bear this structure of exploiting predictability: the attacker need not breach any defensive rule; it need only know where and in what manner the defensive rule will trigger, and then exploit the subsequent state transition. The 2022 manipulation of a CRV lending position on Aave is an empirical instance of this structure: the attacker calculated exactly how the system's liquidation rules would react and turned the predictable liquidation logic into an attack parameter (Section 29.3) [52].

This reverse-exploited predictability has a name more general than *attack surface*; Goodhart's law, the Lucas critique, and protective opacity, all introduced next, are different facets of this same phenomenon of determinism being reverse-exploited. When a defensive rule is transparently made public, it turns from a mere rule into the objective function of the attacker's optimization, and the attacker adjusts its strategy precisely against the letter of this rule, making the rule fail exactly where it should most take effect. In analyzing why Hyperliquid's successive ex post patches were always circumvented, Chapter 12 used Goodhart's law and the Lucas critique to make just this point: once a metric is treated as a control target and made public, it ceases to be a reliable metric; defenses formulated on the basis of historical attack patterns fail because of attackers' expectations of those defenses (Section 12.6) [41][55][56]. This explains why a purely algorithmic clearinghouse sits in a loop it can hardly break by itself: its legitimacy requires transparent rules, and the transparency of the rules in turn turns every rule into a target that can be attacked; the more it explains itself clearly, the more fully it exposes its own reaction function. A central counterparty is not as deeply caught in this loop because it retains opacity at the critical points: what regulators and market makers can and cannot do at the moment of crisis is itself a variable the attacker cannot solve in advance. A decentralized clearinghouse, exchanging transparency for verifiability, also gives up this layer of protective opacity: not the oversight of some protocol but the necessary result of the fundamental promise that rules are executed as code and verifiable by all.

These two propositions point to the same deeper judgment: predictability is both the institutional foundation of a decentralized clearinghouse and its fundamental weakness, and this dilemma cannot be escaped by further refining the rules. Writing the rules in finer detail only describes the exploitable states more clearly; raising the incentives higher only briefly delays failure in the face of procyclical capital withdrawal. Market incentives are therefore not a force that can be relied upon unconditionally; they are powerful when marginally favorable but may fail collectively in a systemic crisis, and may even be reverse-exploited because of their own transparency and determinism. Frontier protocols already have direct experience of this: every round of ex post patching against a known attack vector is circumvented by adaptive attackers onto a new attack surface, and this cycle of attack, patch, and new attack is the manifestation of transparently published defensive rules failing in the game (Section 12.6) [41]. Acknowledging this boundary is not to concede the failure of a decentralized clearinghouse but to confirm that its range of capability has a clear boundary. Beyond that boundary lies a class of situations more fundamental than either procyclicality or predictability.

### 29.4.3 Incomplete contracts and the guarantor of last resort

Beyond the range market incentives can reach lies a most fundamental class of moments: states for which the contract has simply provided no rule. The previous two sections discussed incentives being at some moments not strong enough, or being reverse-exploited; this section discusses another class of problem—that at some moments there is simply no rule to follow.

Economics settled this long ago: contracts are incomplete. Because of bounded rationality and the unpredictability of the future, contracting parties cannot foresee and write down ex ante every future state; there are always situations the rule-drafter never envisioned and therefore never provided for (Section 12.4.4) [54]. Smart contracts push this theorem to the extreme. Called a contract, it is in fact a piece of code deployed on-chain; developers can set parameters only on the basis of their cognizance of the past and their anticipation of a limited set of scenarios, and cannot enumerate every manipulation technique, attack vector, and extreme tail event. When a situation never covered by the code truly descends, the code has no capacity for autonomous judgment: it either executes mechanically by the letter, yielding a result inappropriate or even destructive in that situation, or simply has no corresponding branch to run. The key concept incomplete-contract theory provides for this predicament is residual control rights: the power to decide in situations the contract has not provided for, which must fall to some person or institution (Section 12.4.4) [54][57]. The question is never whether states the contract has not provided for exist, for that is inevitable; the question is who exercises this residual control right when such a state arises.

The bearer a decentralized clearinghouse assigns this residual control right, Chapter 12 calls the guarantor of last resort. It is the role authorized to suspend, change parameters, or even roll back when the system falls into a state the code cannot handle; in a central counterparty this role is played by the clearinghouse operator and the regulator, while in a decentralized system it may fall to a core team holding multisignature authority or to a group of validators (Section 12.4.2). The very existence of this role is a sharp paradox: a system premised on trustlessness and rule-as-code execution must, at the most critical juncture, once again rely on a set of actors' on-the-spot discretion, and once discretion is introduced, the removed trust assumption is reintroduced in implicit form. But precisely because the incompleteness of contracts is structural and ineliminable, this paradox cannot be avoided by further raising mechanism strictness: any system claiming to need no guarantor of last resort at all does not truly not need one but converts that moment with no rule to follow into a systemic failure in the absence of a rule.

This is why the seam of incentives is the hardest of the chapter's four seams. The first two seams, the depth of the waterfall and the tempo of degradation, hard as they are, are after all engineering problems: they can be narrowed by adding a layer of equity buffer or switching to a different auction. This one is not an engineering problem but a problem about power, and it therefore leads a decentralized clearinghouse into its most intractable dilemma. On one hand, if the guarantor of last resort's discretion is too weak, too late, the system will be dismantled in an orderly way by attackers at that moment with no rule to follow, and the insistence on full automation may lead to systemic failure; on the other hand, if this discretion is too strong, too frequent, it will gradually turn into the very center it was meant to replace, and more dangerously, it will, in the name of protecting the system, carry out selective bailouts. Chapter 12 has explained this layer of danger: when the blow-up of some large account may trigger a chain of liquidations, the guarantor of last resort's participation in trade intervention to protect the insurance fund is, for that large account, a de facto bailout, and for the other participants who acted by the rules, markedly unfair; the too-big-to-fail problem of traditional finance thus reappears on-chain through the emergency-discretion mechanism (Section 12.4.2). A discretion that must be both strong enough to complete crisis handling in extreme stress scenarios and weak enough not to be used for self-dealing or favoritism cannot be obtained by writing the code better; it can only be obtained by designing the shape of this discretion, ex ante, into a particular form. This turns the problem from *whether there should be a guarantor of last resort* into *within what institutional framework of constraint this indispensable and high-risk role should be placed*.

The JELLY incident is an empirical marker of exactly such a moment. When a manipulation of a low-liquidity token pushed the system into a state for which its code had no ready rule to follow, the code could give no answer. In that state, the liquidation vault was forced to catch a position it should not have borne; the oracle faithfully reported the very real market price that had been contaminated by manipulation; and the auto-deleveraging mechanism, which should have absorbed the tail loss, was not triggered, because the liquidation vault had not yet been isolated from the main vault and the denominator of its trigger threshold was computed as the vault's entire enormous assets (Section 12.6). Hyperliquid's ultimate handling was therefore not the execution of any prewritten rule but a discretion unconstrained by preset rules: the validators voted collectively, disregarded the real price the oracle reported, overwrote the market's settlement price to the level before the manipulation, and forcibly closed all related positions on that basis (Section 12.6) [41]. The several mechanisms necessary to hand loss absorption back to the market (asset isolation between the liquidation vault and the main vault, an independent deleveraging trigger threshold, dynamic position caps that adjust with market cap and depth, and the validators' power to delist anomalous assets by on-chain vote) were all filled in only after JELLY (Section 12.6). This ex post filling is itself the most direct acknowledgment that, at the moment of the event, the contract was incomplete: every rule filled in afterward is a retroactive recognition that at the time there was no rule to follow. What it simultaneously exposes is the limit of such ex post rule revision: the later POPCAT incident proved that targeted revision against the previous attack vector cannot prevent an adaptive attacker from finding the next gap (Section 12.6) [41]. This corroborates, from the reverse, the ineliminability of incomplete contracts: the system can make rules for accidents that have already occurred but can never make rules for accidents not yet conceived.

This is the boundary spoken of in the opening, and it can now be stated more precisely: no matter how complex the market incentives are designed, no matter how meticulously the code is written, they cannot cross the boundary of states the contract has not provided for; beyond that threshold, some residual control right must be exercised by a human. Acknowledging this, the ideal architecture no longer faces the question of *whether discretion can be eliminated* (a foregone absence) but a truly engineerable question: since discretion cannot be eliminated, how can it be constrained to the minimum?

### 29.4.4 The three constraints on residual discretion

The ideal architecture's handling of this boundary is not to eliminate discretion but to constrain the ineliminable discretion to the minimum. The first proposition this section advances is: acknowledging that discretion cannot be eliminated is by no means the same as providing justification for arbitrary human intervention.

The distance between these two is precisely where the entire value of a decentralized clearinghouse lies. If, on the grounds that discretion cannot be eliminated, broad on-the-spot disposal power were routinely handed back to a center, then this system would regress into the very opaque centralized mechanism it was meant to replace; since the critical moments would still be adjudicated by human actors, the determinism recomputable by any node and the commitment requiring trust in no specific actor would both have only formal significance (Section 29.1). Therefore, acknowledging the ineliminability of discretion must immediately be caught by a constraint in the opposite direction: first, bisect the system's state space. In the large class of states the contract can provide for in advance (normal-condition clearing and settlement, liquidations with clear health, default handling with clear parameters), discretion is not only superfluous but harmful; these states should rely wholly on deterministic code, leaving no room whatsoever for human intervention, because any flexibility here only weakens determinism. Only in the small class of states the contract truly cannot provide for in advance is discretion permitted to intervene. This is the spirit of the two-layer architecture Chapter 12 derived from incomplete contracts: strictly adhere to code day to day, and authorize intervention only in a crisis (Section 12.4.4); and this section, on the basis of this principle, further asks what shape the permitted discretion itself should be given.

The second proposition this section advances is this structure's three constraints: for that portion of residual discretion, the design goal is to make it simultaneously narrow, slow, and visible. First, narrow means that the authorization of discretion is strictly confined within a specific scope and situation; the power the intervenor may exercise is only enough to handle that concrete, contract-unaddressed state, and cannot, under the name of one emergency authorization, do anything outside the authorized scope. An authorization to force settlement of an affected market when the oracle is manipulated is by no means the same as an authorization to rewrite any price at any moment one deems an emergency; the difference between the two is the difference between constrained discretion and unconstrained power. Second, slow means that, except for explicitly defined emergency situations, the exercise of discretion must pass through a timelock constraint that makes it impossible to execute instantaneously and unilaterally: after a decision is made and before it takes effect, a compulsory waiting period is left, giving dissenting participants time to exercise the exit option and withdraw funds, and giving a decision made in haste or under coercion a window to be corrected; and the emergency channel reserved for speed must itself have clear boundaries and an obligation of ex post ratification, and cannot become an unconstrained path that bypasses all constraints (Section 12.4.6). Third, visible means that every exercise of discretion occurs on-chain and can be audited by any node—that is, who did what, when, under what authorization, and on what basis, all leave an undeniable record. Visibility is the natural extension, at the governance level, of the *verification by all* stated in Section 29.1: the discretion over adjudication may be concentrated in a few, but the verification of those few's discretion must be open to all (Section 29.1). The single point of adjudicative authority and the verification by all constrain, under normal conditions, the execution of code; in extreme states they should constrain human discretion.

What each of these three constraints prevents is a different path of discretion running out of control, and none can be omitted. What narrow prevents is the spread of authorization; history repeatedly shows that a power set up to address a particular crisis is all too easily invoked next time to handle situations it should not touch, until that emergency power set up as an exception becomes a routine instrument of rule; slicing the authorization narrow amounts to bounding, ex ante, the upper limit of harm in the worst case, so that even if the intervenor tries to overstep, the range of harm it can cause is limited. What slow prevents is haste and coercion; decisions in a crisis are often made in the few minutes when information is least sufficient and pressure greatest, and a compulsory waiting period gives the market both a right of exit to exercise the exit option and gives the decision itself a chance to be reviewed and overturned, turning an unreviewable unilateral decision into a correctable process. What visible prevents is ex post denial and non-transparent decision-making; if the basis and process of a discretionary act are not fully recorded on-chain, then whether it was to save the system or to shield some private interest can never be distinguished from outside; visibility constrains discretion from being explained however one likes ex post to leaving an immediate trace, so that every intervention must be prepared to accept everyone's review. There is an ordering of priority among the three: narrow constrains the scope of authorization, while slow and visible constrain the procedure of exercising power; an authorization that is sufficiently narrow, even if slow and visible are as yet imperfect, has already had the maximum harm it can cause bounded, whereas an authorization that is too broad, however strict the procedure, merely equips a power that should never have been granted with a set of procedural constraints.

Placing these three constraints on the governance spectrum Chapter 12 sketched, one can identify what exactly the ideal architecture fills. Chapter 12 arranged governance from the wholly opaque G0 to the fully-on-chain-governance-plus-timelock-constraint G3, of which the most mature, G3, with on-chain voting and timelocks, happens to cover the slow and visible spoken of here—it makes discretion slow down and be publicly disclosed (Section 12.4.6). But that spectrum measures transparency, degree of decentralization, and procedural constraint on the exercise of discretion; it answers how slow and how public discretion should be but does not answer how narrow discretion should be. A system reaching G3 may well be procedurally impeccable (every intervention voted on, passed through the timelock, recorded on-chain), yet the scope of authorization broad enough to let the intervenor do almost anything at that moment. Slow and visible constrain the procedure of exercising discretion; narrow constrains the scope of authorization discretion can reach. Narrow is therefore a dimension the ideal architecture needs to fill beyond G3; it is not the procedural packaging of a broad power but a limitation of the scope of the power itself at the source. A narrow authorization, even with crude procedure, is closer to the ideal than a broad authorization equipped with ever-more-complete voting and timelocks, because the former bounds, at the source, the maximum harm the worst case may cause.

The three constraints of narrow, slow, and visible together give an evaluation standard by which any residual discretion can be measured. What they constrain is not whether a particular intervention is right or wrong but the boundary and exercise conditions of the very power the intervenor holds; a power whose scope is sufficiently limited, whose execution is sufficiently delayed, and whose disclosure is sufficiently full, even if occasionally misused, has its destructiveness bounded by a structural upper limit. This evaluation standard simultaneously redefines what a qualified decentralized clearinghouse means: the mark of qualification is not that it never needs humans but that, when it cannot but need a human, the harm that actor may cause has already been bounded, ex ante, to something sufficiently small.

### 29.4.5 The JELLY incident and the boundary of the purely algorithmic clearinghouse

Taking the above standard as the analytical baseline and returning to the JELLY incident, its significance divides into two levels. As an event, it is a failure—a failure in which the system was pushed into a state with no rule to follow and had to rely on a group of actors' on-the-spot vote to rescue itself. But as a marker, it indicates where the boundary of the purely algorithmic clearinghouse lies, and this is the last and most important proposition of this section: the boundary lies not in whether discretion is needed but in whether the discretion is constrained narrowly, slowly, and visibly enough.

Measuring JELLY's handling at the time against these three constraints reveals shortfalls in several places. It was not narrow enough: what the validators exercised was a power broad enough to overturn the oracle price and forcibly rewrite the settlement price, not an authorization only enough to handle that specific manipulation state. It was not slow enough: the resolution was reached in an extremely short time with zero opposition (Section 12.6), leaving no time window for dissenters to exit or for a hasty decision to be corrected, and the fast track that should apply only to genuine emergencies was here almost the only track (Section 12.6). Its visibility, too, held only in part: the execution result and on-chain state transition can be tracked, but the decision rationale, the boundary of authorization, the assessment of alternatives, and ex post accountability records were not made public ex ante in an equally full way, and *act first, explain later* replaced *disclose the basis first, then act* (Section 12.6). Add to this that outside auditable information on validator independence and the distribution of governance power was limited, so that a so-called unanimous vote is not by itself sufficient to equate automatically with a sufficiently decentralized governance consensus (Section 12.6) [41], and this discretion fell far short on all three constraints of narrow, slow, and governance visibility. Placing JELLY on the evaluation standard, what it shows is not that the chain should have no discretion but that this discretion was constrained too loosely.

This is precisely the value of JELLY as a boundary marker: it does not prove that a decentralized clearinghouse is unworkable but marks the conditions under which it works. A misreading would say JELLY proves a purely algorithmic system ultimately needs centralized governance; the reading this section gives is the opposite: JELLY proves that the existence of residual discretion is unavoidable, but the degree to which it is constrained can range from loose to strict, and the quality of a clearinghouse system depends on this degree of constraint. Following this reading, the ideal decentralized clearinghouse should not be imagined as a system that never needs human discretion (a fantasy even incomplete contracts cannot honor); it should be imagined as another institutional arrangement: needing no one most of the time, because the states the contract can provide for are all handed to deterministic code; and in the very few moments when a human is indispensable, that human actor's power is sliced narrow enough, executed with delay enough, and disclosed fully enough that, even given private motives, it can cause only limited harm. The former constitutes the mode of normal operation, the latter the governance arrangement in the boundary state; normal conditions rely on code, boundary states on the constraint of discretion.

Thus the ideal decentralized clearinghouse sits between two attractive but untenable idealized models, negating both. It negates the idealized model of the opaque centralized mechanism, the basis of trust that there is always a sufficiently capable and trustworthy operator to make the right decision for participants at the critical moment, which the earlier parts of this book have repeatedly proved costly through successive failures (Chapter 12). It also negates the idealized model of the purely algorithmic, the full automation that supposes no human need ever intervene so long as the code is written completely enough, which is negated by the law of incomplete contracts: the blank of a contract is not a temporary gap left by insufficiently good current technology but the eternal predicament of any written rule facing an unknown future. The normative goal lies at neither end but in a constrained middle state: hand the states that code can handle to code as much as possible, shrink as much as possible the range of states that code cannot handle and that human actors must take over, and strictly constrain this minimized range with the three constraints of narrow, slow, and visible. This ideal promises neither an omniscient governance actor nor an omnipotent automation system; it requires only that, where reliance on human actors is unavoidable, the harm human discretion may cause be limited to the minimum. It does not pretend the boundary does not exist but places the entire center of gravity of governance on how to govern that boundary.

From this, JELLY also provides a standard for evaluating any real system. Facing a clearinghouse system that calls itself decentralized, the question to raise is no longer the binary one of whether human actors are still needed to intervene, for the answer to that is already fixed as yes; what should be attended to are three questions that can be answered by degree: how many states has it truly handed to code rather than left to discretion? How narrowly is its discretion sliced, how slowly released, how fully disclosed? When it cannot but invoke this residual discretion, where is the worst case bounded ex ante? Standardizing these three questions and using them to evaluate item by item the most frontier systems today, identifying the precise gap between ideal and reality, is exactly what the next section does.

By this point, the chapter's four seams have each been made clear. The seam of depth is concerned with whose equity bears shortfall losses first; the seam of degradation is concerned with how extreme shocks are isolated and slowed; and the seam of incentives asks how small the scope of that residual power is bounded, and how strong the constraint, when incentives reach their boundary and discretion is unavoidable. Combining this fourth standard—that residual discretion must be narrow, slow, and visible—with the other standards distilled in the preceding three sections, we form a checklist that can be used to measure any real system. The value of a checklist lies not in stating an ideal but in using it to evaluate real systems and identify gaps. This is precisely the task of the final section.

## 29.5 The ideal-architecture checklist and the Hyperliquid gap audit

Folding the previous section's closing standard on the boundary of discretion into the checklist completes the distillation of the first four sections. Along the four seams, this chapter has each derived a normative principle that an ideal decentralized clearinghouse should satisfy. What remains is to organize these four principles into a reusable evaluation standard and then use it to measure how far the most frontier systems today are from the ideal. This section is therefore both the conclusion of the whole chapter and the transition to the next. It fixes the proposition "what the ideal architecture should look like," unfolded in the preceding text through continuous argument, into a checklist that can be verified item by item, and uses this checklist to conduct an honest and restrained gap audit.

### 29.5.1 Four normative principles

To distill the first four sections into a checklist, one must first recognize that these four sections are in substance answering four progressively deepening questions, not four mutually isolated ones. They arrange themselves along the same system from external structure to internal incentive: first asking whether this system has been correctly integrated into a whole, then asking whether its depth is sufficient once it begins to absorb losses, then asking whether it can degrade in an orderly way when losses grow too large for the depth to fully absorb, and finally asking where the incentives driving the whole system fail and who takes over after they fail. The four principles are the passing lines of these four questions respectively. The reason for establishing them as principles rather than preferences is exactly this: what each guards is the critical point past which the system, once it fails, degrades along a certain determinate path, so they are necessary conditions, not optional optimizations.

The integrity of the overall architecture is the foundation of all this. The criterion Section 29.1 established is that a decentralized clearinghouse system must be a single, deterministic state machine: clearing, settlement, and the default branch are not three subsystems that can each go their own way but different stages on the same uninterruptible chain of state transitions, where the output of any stage is the determinate input of the next. The key significance of this principle lies not in determinism itself (a traditional central counterparty's clearing module is likewise deterministic) but in the requirement, unique to decentralization, layered on top of determinism: the discretion over adjudication may be concentrated in a single module, but the verification of every step of this computation module's output must be open to all, so that any node can independently recompute the same books and obtain a bit-for-bit identical result (Sections 28.4.3 and 28.6.2). Once this boundary is breached, the path of degradation is determinate. If adjudication is no longer single-point but split into several separately settling subsystems, the same default may be recorded as inconsistent books on different branches, and default handling degrades from an executable state transition into a set of ex post disputes hard to resolve consistently. If verification is no longer possible for all, external participants can only trust the operator's self-reported results, and the system regresses into an opaque centralized mechanism that happens to be deployed on-chain, losing not performance but the sole credential by which it is called decentralized. The passing line of overall architectural integrity therefore has two halves: one half is the single-point determinism of adjudication, the other the verification-by-all of that determinism; lacking either half, the system no longer has identity. This principle also contains an often-overlooked sub-item, namely whether the system has identified and reinforced its own most fragile seam (Sections 29.1.6 and 28.8.1). Its missing state is likewise determinate: so long as one seam remains unreinforced, what the attacker must do is not to breach the sturdiest module but to head straight for that seam and let the entire system fail as a whole at a link for which no one is clearly responsible.

On this foundation, depth measures how many layers of buffer the default waterfall still sets before losses are allocated to non-defaulting parties. Section 29.2 decomposed the depth of the traditional waterfall into two layers generally absent on-chain. One is a first-loss tranche composed of some party's own equity and positioned ahead of any member or user (skin in the game), whose significance lies not in size but in position; the other is prefunded mutualization in place before the crisis, jointly funded by the parties and dedicated to absorbing the spillover of a single member's default. These two layers are precisely the source of a traditional central counterparty waterfall's depth: the classic hierarchy arranges the defaulter's margin, the central counterparty's own capital, and the members' joint default fund in order ([2]), and empirically the defaulter's own resources make up the overwhelming share, while the own-capital tranche, though small, occupies the key position ahead of member mutualization (Section 5.2.3, [13]). The missing state of each of these two layers exposes why they are necessary conditions rather than decorations. Once the first-loss layer is absent, the designer is no longer bound to the system's safety: the designer can raise leverage and relax listing standards, because the cost of these aggressive parameter choices is borne mainly by users rather than by the designer, so risk appetite shifts systematically in a direction favorable to the designer and unfavorable to users: what the first-loss layer truly constrains is the designer's own risk appetite. Once prefunded mutualization is absent, the system, facing the spillover of a single member's default, has only two equally unfavorable handling paths left: either draw on the profitable positions that ought not to bear loss to make up the shortfall, forcibly spreading an individual default onto the non-defaulting majority; or let the bad debt sit on the books, with the protocol itself continuously bearing the loss. The former harms fairness, the latter harms solvency, and the significance of prefunded mutualization is precisely to form this common fund in advance, before the crisis, so that the system need not, at that moment, choose between these two unfavorable handling paths. The passing line of this principle is that, before reaching the last resort of forced socialization onto the profitable side, the waterfall must first pass through these two layers, rather than turning directly from a public pool passively accumulated from fees to auto-deleveraging. The conclusion Section 29.2 reached is that, as of the main on-chain systems examined here on June 25, 2026, these two layers have not yet been truly filled; what is lacking is not imagination in mechanism but the political-economy willingness of *what kind of actor's equity is willing to bear the first loss*; whether this willingness can be institutionally induced has spilled beyond the boundary of risk engineering and points to the rule governance of Chapter 30.

Beyond depth, orderly degradation handles the disposal problem after depth is breached. Section 29.3's premise is a fact repeatedly established throughout the book: on-chain systems have no lender of last resort and therefore cannot assume any external liquidity rescue. Layered on the structural constraint that full loss coverage is no longer attainable (Section 12.2.3, [12]), the system's design goal must be rewritten from *avoiding failure* to *failing in a controlled way in the worst case*. The passing line of this principle is composed of two mutually independent yet complementary means: risk-pool isolation, confining a single market's bad debt within that market's pool and severing inter-market contagion; and active shock management, remaking the price impact liquidation imposes on the market from a passively suffered consequence into an actively adjustable design variable (Dutch descending-price auction, continuous soft liquidation, or partial liquidation), replacing the kind of concentrated sell-off, critical-point liquidation that easily invites zero bids. The missing state of each of these two means likewise points to a determinate form of disaster. If isolation is absent, a single edge market's bad debt spreads along the shared capital layer to all markets, amplifying an event that could have been locally absorbed into a system-wide solvency crisis. If active shock management is absent, liquidation regresses into a critical-point one-time sell-off: large collateral is concentrated-sold when buyer liquidity is insufficient, the price is broken further by the liquidation behavior itself, inviting zero bids, and liquidation, far from recovering value, further widens the shortfall and transmits it out through chain liquidations. The qualification of orderly degradation is not that the system never loses but that the system has prepared in advance for the worst case and clearly knows what each preparation must cost.

The boundary of incentives and discretion asks inward after the incentive mechanism that drives the whole system. Section 29.4 pointed out that a decentralized clearinghouse's first mechanistic premise is to substitute the "willing" market incentives for the "must" regulatory compulsion, but this force has a procyclical boundary: it is powerful when marginally favorable but may fail collectively in a systemic crisis, and the full predictability of the system's reactions itself becomes an attack surface. More fundamentally, contracts are incomplete—there are always states the drafter never envisioned and therefore lacking established rules, and in such states, someone must decide. The passing line of this principle is therefore not to eliminate all discretion (forcing this unattainable goal only regresses the system into an opaque centralized mechanism) but to bisect the state space: hand the overwhelming majority of states the contract can provide for wholly to code, leaving no room for human intervention, and permit discretion only in the minority of states the contract truly cannot provide for, constraining this residual discretion to be simultaneously narrow, slow, and visible: strictly limited in authorization scope, delayed through a timelock in its exercise, and every exercise occurring on-chain and auditable by any node (Section 12.4.6). If any of the three constraints of narrow, slow, and visible is missing, the direction of degradation also differs. Lacking narrow authorization, an intervention that should be confined to an extreme state can seize the occasion to rewrite any parameter, and the emergency power continuously erodes outward into the territory that should have been left to code. Lacking time delay, rules can be rewritten in the instant before users have time to exit, the exit window the timelock was meant to protect disappears, and only a fait accompli remains. Lacking public auditability, discretion turns into a non-public state, and external participants can neither judge whether it has been abused nor hold it to account, so it no longer differs substantively from the unauditable discretion in an opaque centralized mechanism. The dimension of visibility is precisely the natural extension, at the governance level, of the verification-by-all that overall architectural integrity requires.

### 29.5.2 The Hyperliquid gap audit

Based on the four principles above, one can use them to measure a concrete system. The object of the audit is Hyperliquid, for a fairly clear reason: it is today the on-chain system closest to a complete decentralized clearinghouse with its own on-chain clearing and settlement module, and calibrating with it yields a distance most representative of the frontier level of the entire field. The facts on which the audit relies are all taken from what the preceding text has already treated in full (its consensus and state-machine architecture in Chapter 28, its waterfall layers and the exercise of discretion in the JELLY incident in Chapter 12), so this section does not restate how these mechanisms operate but only places them item by item on the checklist for assessment (Table 29-2).

| Checklist item | Ideal standard | Hyperliquid's current status | Assessment |
| :--- | :--- | :--- | :--- |
| Overall architectural integrity | A single deterministic state machine; single-point adjudication with verification open to all; verification and governance paths do not re-concentrate | HyperBFT consensus and the Hypercore on-chain state machine make state transitions independently recomputable; but validator independence, the bounds of governance discretion, and the disclosure of decision rationales still constitute residual trust assumptions (Sections 28.6.2 and 12.6) | Partially met (state recomputability met) |
| Waterfall depth | Includes an own-equity first-loss layer (skin in the game) and prefunded mutualization | Margin → insurance fund → HLP vault → auto-deleveraging; the insurance fund is fee-supplied rather than own equity, so there is no skin-in-the-game layer; auto-deleveraging cuts profitable positions rather than providing prefunded mutualization | Partially met |
| Orderly degradation | Risk-pool isolation and active shock management | JELLY exposed risk-pool commingling; afterward the liquidation vault was isolated from HLP, and dynamic position caps and HIP-3 isolated markets were introduced; auto-deleveraging and partial liquidation exist, but auction-style ex ante shock management is absent | Partially met |
| The boundary of incentives and discretion | Market incentives; residual discretion that is narrow, slow, and visible | HLP is a permissionless, market-based vault; during JELLY, validators unanimously overrode the oracle price and forced settlement—execution traces are visible, but the decision process and rationale are insufficiently visible, and it was fast (an emergency, no timelock) and broad in scope | Partially met |

**Table 29-2.** The ideal decentralized clearinghouse checklist and the audit of Hyperliquid's compliance (Data source: compiled by the author)

Of the four items, what Hyperliquid comes closest to meeting is the state-recomputability sub-item of the first, and this is the hardest and most fundamental of the four principles. It is called most fundamental because it is the premise on which the other three stand: the waterfall, degradation, and incentives are all built on the foundation of the ledger being publicly acknowledged by all; if verification is impossible, the latter three, however complexly designed, lose the fulcrum by which external participants can test them, and in a system where no one can independently audit the books, it is meaningless to discuss whether the waterfall is deep enough or degradation orderly. It is called most difficult because it must satisfy two demands pointing in opposite directions at once: adjudication must be sufficiently concentrated to complete that uninterruptible chain of states in milliseconds; and verification must be sufficiently open to let any bystander recompute this high-speed chain bit for bit. Achieving both concentrated execution and open verification in the same system is the hardest tension to reconcile in all of decentralized finance, and it is precisely here that most systems retreat, either sacrificing execution speed for openness or drawing verification into a few actors' authority for speed. Hyperliquid has not retreated on state-machine recomputability: its consensus is produced by HyperBFT, its state maintained by the Hypercore on-chain state machine, the rules of clearing and settlement hard-coded into the protocol and executed identically for all positions, and anyone can pull the on-chain state, independently recompute the books with the same rules, and verify an identical result (Section 28.6.2, [8]). This means it does give, on the point of clearing output being recomputable, the strongest engineering proof. But that state transitions are recomputable does not mean the entire validator organization, governance authorization, and emergency discretion are already trustless; what JELLY exposed is this difference. Therefore the first item cannot be simply judged as met overall but only as met at the state-machine level and partially met at the overall-architecture level. The clearest affirmation in this audit should go to the sub-proposition that "high-speed adjudication and open recomputation can be reconciled by engineering," not to the stronger proposition that "governance and verification power are already fully decentralized."

The other three items are only partially met, and the location of the gap falls, with high consistency, on exactly the absences the earlier sections of this chapter already identified. This consistency shows that these three gaps are not implementation oversights but the appearance, in a real system, of the several structural voids the preceding text predicted from principle. On waterfall depth, it does have four layers (margin, insurance fund, HLP liquidation vault, auto-deleveraging), but measured against Section 29.2's two-layer criterion, both front-placed buffer layers are not in place. Its insurance fund is passively supplied by trading fees, a collected public pool rather than a skin-in-the-game first-loss tranche in which the protocol bears risk with its own equity, which is the concrete landing point of the previous section's *once the first-loss layer is absent, the designer is no longer bound to the system's safety*: a fee pool, however large, does not constitute the designer's commitment to write its own equity ahead of users. Its auto-deleveraging cuts profitable positions, in essence forcibly socializing tail losses onto non-defaulting counterparties rather than a true mutualization funded in place before the crisis (Section 28.3.6): the previous section's *once prefunded mutualization is absent, the former unfavorable handling path chosen between harming fairness and harming solvency*. In other words, its waterfall skips the two layers the ideal standard requires, turning directly from a public pool to loss socialization. Judging it partially met rather than unmet is because it has indeed built a multi-layer waterfall that can operate in most situations, only with insufficient depth: what is lacking is not the number of layers but the nature of exactly the two most critical layers.

On orderly degradation, its score was driven largely by a single failure. The JELLY incident is exactly the kind of risk-pool commingling Section 29.3 used as a cautionary counterexample: the HLP vault was forced to take over a single altcoin's position and thereby imperiled the whole vault (Section 12.6, [41]). This is the previous section's *once isolation is absent, a single edge market's bad debt spreads along the shared capital layer*, a complete manifestation, with the contagion channel then open by default. After the event, it made a series of reinforcements that all converged toward risk-pool isolation: isolating the liquidation vault from HLP, introducing dynamic position caps, and opening isolated deployer markets through HIP-3 ([46]). But measured against Section 29.3's two means, what it has filled is mainly the isolation means, and it filled it rather passively, as a remedial adjustment after the fact rather than an architecture designed for the worst case in advance, its boundary set according to the type of event that has already occurred and not necessarily equally effective against the next, unforeseen kind of commingling. As for the means of active shock management, it remains incomplete: it has auto-deleveraging, partial liquidation, and a time-weighted mechanism for triggering liquidation, but not a mechanism like the Dutch descending-price auction that actively lowers the price impact by treating it as an adjustable design variable; it has the means to spread losses out but still lacks the mechanism to compress the shock itself before spreading it, and the latter is the core of the lending-side exemplars Section 29.3 showed in MakerDAO [47], Liquity [23], and Euler [43]. Isolation established, active shock management still lacking: hence partially met.

On the boundary of incentives and discretion, the assessment is most complex. Its core capital layer, HLP, is a permissionless, market-based vault into which anyone can deposit funds to serve as counterparty; this side is driven wholly by market incentives, meeting the first half of this principle concerning market incentives. The problem lies on the residual-discretion side. During JELLY it fell into a state with no rule to follow and exercised discretion, the validators voting unanimously to overturn the oracle price and force settlement at the level before the manipulation (the handling is described in Section 29.4.5, [41]). Measuring this discretion against the three constraints of narrow, slow, and visible, the conclusion splits cleanly: the execution traces and final state transition are trackable on-chain, but the decision basis, authorization boundary, assessment of alternatives, and ex post accountability were not disclosed in an equally full way; this is insufficient governance visibility, not unverifiable state execution. It was neither slow nor narrow: this was an emergency intervention made in an extremely short time, with no timelock delay whatsoever, making the previous section's *once time delay is absent, users have no time to exit and only a fait accompli remains* a real-world event; and overturning the oracle pricing and forcibly settling the entire market is far from a strictly limited narrow authorization. State visible, governance insufficiently visible, and both slow and narrow lacking: hence likewise partially met; the slow, narrow, and governance disclosure it lacks all belong to ex ante institutional constraints and could have been filled with a preset timelock, a limited authorization scope, and a complete on-chain decision record, so the gap in this item belongs especially to the kind that can be converged by engineering.

### 29.5.3 Unmet items and the frontier of the field

In reading this audit, a common misreading is to read the several *partially met* results as an indictment of Hyperliquid. More accurately, the gaps the audit points out are, none of them, Hyperliquid's own oversight; they are boundaries the entire field has yet to resolve in common. The skin-in-the-game own-equity first-loss layer, true prefunded mutualization, the active shock management not yet mature on the perpetual-clearinghouse side, and discretion not yet constrained narrowly and slowly enough: applying this checklist to measure any other on-chain system yields gaps only more numerous, not fewer. Section 29.2 examined them one by one: as of publicly available information on June 25, 2026, from the fee-supplied-insurance-fund dYdX [18] and the first-loss-outsourced-to-liquidity-providers GMX [20], to the reflexive-token-backed Synthetix now entering the sUSD retirement process [33], and even the crvUSD without a dedicated insurance fund, no perpetual or lending protocol within the range examined here has truly filled those two buffer layers. Section 29.3 also showed that the mature exemplars of active shock management still come mainly from lending-side protocols like MakerDAO [47], Liquity [23], and Euler [43], and remain scarce on the perpetual-clearinghouse side. At the same time, these gaps belong to three different kinds of difficulty (the first loss and mutualization are constrained by political-economy willingness, active shock management by the migration of an engineering paradigm, and constrained discretion by the absence of ex ante institutional design), yet they exist, without exception, before all systems. That Hyperliquid is at the frontier level on state-machine recomputability yet constrained by the same boundary on the other dimensions itself shows that these gaps are structural, not individual: the places where it has not yet met the standard are not where its technology falls short of others' but the common baseline of the entire field.

These several structural gaps are, in substance, the concretization of a single higher-level judgment. Section 29.3 quoted the Bank for International Settlements' assessment of decentralized finance: on-chain systems generally lack the shock absorbers on which traditional finance relies to dampen shocks [3]. This is a highly general diagnosis that does not itself indicate where to improve in a concrete clearinghouse system, and the value of the four-item audit lies in landing this abstract *shock-absorber gap* at the clearinghouse level, translating it into four concrete coordinates that can be tested and improved item by item. Lacking the skin-in-the-game first-loss layer is lacking an endogenous equity absorber that bears losses ahead of users and non-defaulting parties; it differs from a central-bank liquidity window in that it absorbs the designer's own equity loss rather than liquidity temporarily provided by the public sector. Lacking prefunded mutualization is lacking a common fund already formed in advance and reserved for default spillover, for which the chain has yet to form a corresponding mechanism. Lacking constrained active shock management is lacking an absorber that lowers the shock itself and thereby reduces the amount that needs absorbing; its function is akin to market-making arrangements that maintain loss-absorbing capacity amid turbulence and halt mechanisms in disorder, but it must be rewritten into an intra-protocol, verifiable mechanism. And still-too-fast, still-too-broad discretion is the last absorber, which must be borne by a human actor when all built-in absorbers are breached, not yet engineered and constrained; traditional finance hands this role to a resolution authority with rules to follow, and the chain has yet to form corresponding governance rules for it. The Bank for International Settlements offers a general judgment; this checklist decomposes it into four structural positions that can be filled item by item, and marks for each the absorber it roughly corresponds to in the old world, so the void is no longer a general judgment but four engineering goals with clear specifications.

For this very reason, the true use of this audit is not to judge but to define: it rewrites the question of *how far the frontier system is from the ideal architecture* into a set of engineering goals that can each be separately proposed, separately solved, and separately accepted: which four conditions are still lacking, what structure each condition should have, and by what kind of actor it should be borne. Its clear affirmation of Hyperliquid on the state-recomputability sub-item is the most valuable part of this definition: it proves that the hardest piece of a decentralized clearinghouse, concentrating the discretion over adjudication while opening the state output to recomputation by all, is indeed feasible in engineering and has already been realized by a real running system. Once this foundation is proved buildable, the remaining gaps are no longer questions of *whether possible* but questions to be resolved of *when they are filled, by what kind of actor's equity, and constrained by what governance rules*.

### 29.5.4 The interdependence of the four principles

One more point must be added, or this checklist is easily misread as four independent items that can each be satisfied separately and are unrelated to one another. They are not. These four principles constitute a progressive dependence within the same system, where the effectiveness of the latter level hinges on whether the former is in place. This means the total quality of the four items is not the simple sum of each item's score but closer to their product along the dependence chain: a shortfall at any link is transmitted and amplified along the dependence relationship.

Depth provides degradation with a buffer space that can be released layer by layer. If the waterfall is itself shallow and both front-placed buffer layers are absent, then the losses that need orderly handling arrive earlier and larger in scale, and the room left for the degradation mechanism to adjust is smaller; the shallower the waterfall, the heavier the execution burden on degradation. Conversely, no matter how complex degradation is, it cannot make up for a deficiency of depth: it can change the way losses are released but not the total amount of loss that needs releasing. So the quality of orderly degradation depends in part on the degree to which depth is filled, which is the deeper reason why, in the previous section, Hyperliquid's waterfall skipping two layers and its degradation mechanism still lacking ex ante shock management simultaneously remain at partially met: the shallow waterfall transfers too heavy an execution burden onto an already incomplete degradation, and the two gaps aggravate each other along the dependence chain.

Degradation in turn depends on incentives to execute. No matter how cleanly risk-pool isolation is designed or how complexly the Dutch auction's descending-price curve is tuned, these mechanisms need execution actors driven by market incentives to be realized. The liquidator-exit gap at the end of Section 29.3 already showed that once incentives reverse in a crisis and executors exit in sync, even the most orderly degradation design is only an unexecuted design: on-chain congestion pushes up fees, liquidation is unprofitable, and liquidation is delayed or even fails, a point with both empirical cases (such as the CRV position on Aave in November 2022, [52]) and systematic academic characterization ([51]). This layer of dependence also contains a feedback: the shallower the waterfall and the larger the loss pushed to the degradation link, the higher the position risk liquidators must take on and the higher the risk compensation they demand: the same depth gap both aggravates the execution burden of degradation and raises the compensation required for executors to participate.

And incentives themselves are in turn constrained by the boundary of discretion. Market incentives are reliable on the premise that the rules are determinate, predictable to all, and modifiable by no one on the spot. But once discretion is too broad, too fast, too arbitrary, for instance if a position's settlement price can be overturned ex post by an emergency vote, then the very promise that *acting by the rules is profitable*, on which incentives stand, is itself shaken, and rational participants begin to price the risk that *the rules may be changed at any time*, thereby exiting earlier at the moment the system most needs them. Its reflexive feature is especially pronounced: discretion is often exercised in a crisis, at the moment the system most depends on executors' participation in handling, and that one act of overstepping weakens, at the worst point, the determinacy on which executors rely to participate: discretion used for emergency handling instead dissolves the incentives that could have supported emergency handling. Discretion constrained to be narrow, slow, and visible is therefore not only to prevent abuse of power but the foundation of credibility on which market incentives rely to be sustained. Incentives and the boundary of discretion are not two things but two sides of one thing: the more clearly the boundary of discretion is drawn, the more credible the promise of incentives.

Taking this layer of dependence together, what this checklist conveys is not that the four items being individually met suffices but that meeting them must accumulate progressively from the foundation layer up: without the integrity of the overall architecture, it is hard to form a credible default waterfall; without sufficient depth, degradation is hard to keep orderly; without incentives that can keep functioning, no one executes degradation; without constrained discretion, incentives themselves are not credible. The two ends of the dependence relationship are thereby connected into a feedback relationship (the terminal constraint of visible discretion, as the preceding text noted, is itself the extension, at the governance level, of the initial verification-by-all), so this progressive dependence is not a mutually severed linear relationship but a dependence with a self-reinforcing character. An ideal decentralized clearinghouse system is therefore not the simple juxtaposition of a combination of four mechanisms but a structure that can hold only by being joined layer by layer from the foundation up, which also explains why Hyperliquid can hold the state-recomputability foundation sub-item fairly firmly yet simultaneously halt on the overall architecture and the other three items: part of the foundation is already built, but every layer above still depends on whether questions harder than engineering implementation can be answered.

### 29.5.5 From risk governance to rule governance

By this point, the chapter has completed two tasks. Integration: assembling, for the first time, the components dispersed throughout the book into a complete decentralized clearinghouse system, and pointing out that the true fragility lies not in the components but in the seams. Answering the questions: along this system's four seams, answering one by one the three questions Chapter 28 left, and fixing the answers into a four-item checklist that can measure any real system. The conclusion this checklist gives corroborates the chapter's main line: even the most frontier Hyperliquid today has only pushed the sub-item of *a recomputable single state machine* to the position closest to met; once validator independence, governance discretion, waterfall depth, and the degradation mechanism are all brought in, the complete architecture still has a distance that can be identified item by item, and behind those distances lie, almost all, not technical problems but the political-economy questions of what kind of actor's equity is willing to bear losses first and what kind of actor exercises discretion in states the code does not cover.

But this points precisely to a proposition the chapter cannot resolve on its own. This chapter has analyzed the clearinghouse as a risk-governance architecture; what it must solve is how losses are absorbed, how shocks are degraded, and how incentives are aligned. Yet none of those three hardest-to-fill gaps can be filled by a more complex contract alone: the skin-in-the-game first-loss layer concerns what kind of actor is willing to bring its own equity under the rules and accept the rules compelling it to lose first; prefunded mutualization concerns what institutional arrangement makes unfamiliar participants jointly inject funds into a pool before a crisis and trust that this fund will be mobilized fairly; constrained discretion concerns how, when code must allow an authorized governance actor to intervene, that actor's power is framed by rules in advance. All these questions have spilled beyond the boundary of risk engineering and turned into another domain—how the rules themselves are written, executed, and governed. That is, to complete this risk-governance architecture, there must first be a governance system that can credibly formulate and execute rules.

The next chapter turns from this to the problem of rule governance. When compliance and governance are no longer constraints imposed on the system from outside but engineered directly into the protocol itself, and when the formulation, alteration, and enforcement of rules all become on-chain verifiable processes, how will this system operate? From a risk-governance architecture to a rule-governance system, the subsequent analysis thereby turns from *how to absorb losses* to *how to govern rules*. What Chapter 30 will analyze is precisely this rule-governance system: embedded compliance and automated governance.

## Chapter summary

This chapter completed two pieces of work: integrating the various components dispersed across the book's first 28 chapters into a complete decentralized clearinghouse system, and, along this system's four seams, answering one by one the three questions Chapter 28 left at its close. The first piece of work is an engineering-level response to the preceding mechanism analysis: the earlier text explained how each component fails, and this chapter answers how, absent a central institution, these components can be reintegrated into a system that can be trusted; the second is a direct answer to three constructive questions, not a restatement of existing mechanisms.

The first conclusion integration yields is that the strength of a clearinghouse system lies not in a single component but in the seams between them. The book's earlier text has analyzed every component to the level of formulas: novation, multilateral netting, marking to market, margin, the reflexivity of liquidation, the default waterfall, the insurance fund, and auto-deleveraging. But what breaks a clearinghouse system is usually not the failure of some one component but the transmission between components: an oracle failure triggers erroneous liquidations, erroneous liquidations exhaust the insurance fund, the exhaustion of the insurance fund triggers auto-deleveraging, and auto-deleveraging in turn weakens the market's loss-absorbing capacity. After expressing this system as a chain of state transitions, the parts truly needing reinforcement become clear: not any single link but the connections between links.

Answering the three questions along these four seams yields four normative principles, which are also four structural positions not yet filled to date. The depth of the waterfall requires setting, before losses are allocated to non-defaulting parties, at least a skin-in-the-game own-equity first-loss layer and a prefunded mutualization layer, and the chain is absent at these two points, able only to turn from a fee public pool directly to forced socialization onto the profitable side. Orderly degradation requires designing for the worst case absent a lender of last resort, severing contagion with risk-pool isolation and confining the liquidation shock within an absorbable range with active shock management, while isolation and auction each carry unavoidable costs. The boundary of incentives and discretion requires handing the overwhelming majority of states to deterministic code and permitting discretion only in the minority of states the contract cannot provide for in advance, constraining residual discretion to be narrow, slow, and visible. Using these four principles as an evaluation standard to measure the most frontier Hyperliquid today, one finds it closest to met on the sub-item of *a single state machine recomputable and verifiable by anyone*, but still with distances identifiable item by item on the overall architecture, waterfall depth, orderly degradation, and the constraint of discretion.

Running through all three answers is the same fact: the hardest parts of a decentralized clearinghouse are mostly not technical problems. Making the loss waterfall deep is hard because of the lack of own equity willing to bear losses first; keeping the degradation mechanism orderly is hard because every cost must ultimately be borne by someone; constraining discretion to the minimum is hard because there will always be a moment when the code must allow an authorized governance actor to intervene. None of these is a problem a more complex contract can solve on its own; they point to how rules are written, executed, and governed. The four-item checklist this chapter gives is precisely the tool for measuring, item by item, the degree to which any real system meets the standard on these four dimensions. When compliance and governance are no longer externally imposed constraints but engineered directly into the protocol itself, in what way this risk-governance architecture will operate is exactly the domain Chapter 30 (embedded compliance and automated governance) will enter.

## References

[1] CoinDesk Research. (2025, October 17). *Market spotlight: Inside crypto's $19 billion liquidation event*. CoinDesk. https://www.coindesk.com/research/market-spotlight-the-19-billion-liquidation-that-shook-crypto

[2] Committee on Payment and Settlement Systems, & Technical Committee of the International Organization of Securities Commissions. (2012). *Principles for financial market infrastructures*. Bank for International Settlements & IOSCO. https://www.bis.org/cpmi/publ/d101a.pdf

[3] Aramonte, S., Huang, W., & Schrimpf, A. (2021). DeFi risks and the decentralisation illusion. *BIS Quarterly Review*, December 2021, 21–36. Bank for International Settlements. https://www.bis.org/publ/qtrpdf/r_qt2112b.htm

[4] Lamport, L. (1998). The part-time parliament. *ACM Transactions on Computer Systems, 16*(2), 133–169. https://doi.org/10.1145/279227.279229

[5] Castro, M., & Liskov, B. (1999). Practical Byzantine fault tolerance. In *Proceedings of the Third USENIX Symposium on Operating Systems Design and Implementation (OSDI '99)* (pp. 173–186). USENIX Association. https://www.usenix.org/conference/osdi-99/practical-byzantine-fault-tolerance

[6] Pirrong, C. (2011). *The economics of central clearing: Theory and practice* (ISDA Discussion Papers Series No. 1). International Swaps and Derivatives Association. https://www.isda.org/a/yiEDE/isdadiscussion-ccp-pirrong.pdf

[7] Cont, R. (2017). Central clearing and risk transformation. *Financial Stability Review, 21*, 127–138. Banque de France. https://publications.banque-france.fr/sites/default/files/medias/documents/fsr21_web.pdf https://doi.org/10.2139/ssrn.2955647

[8] Hyperliquid. (n.d.). *Hyperliquid documentation*. Retrieved June 25, 2026, from https://hyperliquid.gitbook.io/hyperliquid-docs

[9] European Parliament, & Council of the European Union. (1998). Directive 98/26/EC of 19 May 1998 on settlement finality in payment and securities settlement systems. *Official Journal of the European Communities, L 166*, 45–50. https://eur-lex.europa.eu/eli/dir/1998/26/oj/eng

[10] Garay, J., Kiayias, A., & Leonardos, N. (2015). The bitcoin backbone protocol: Analysis and applications. In *Advances in Cryptology – EUROCRYPT 2015* (pp. 281–310). Springer. https://doi.org/10.1007/978-3-662-46803-6_10

[11] Duffie, D., & Zhu, H. (2011). Does a central clearing counterparty reduce counterparty risk? *The Review of Asset Pricing Studies, 1*(1), 74–95. https://doi.org/10.1093/rapstu/rar001

[12] Chitra, T. (2025). *Autodeleveraging: Impossibilities and optimization* (arXiv:2512.01112, v3 revised 2026) [Preprint, not peer-reviewed]. arXiv. https://doi.org/10.48550/arXiv.2512.01112

[13] Paddrik, M., & Zhang, S. (2020). *Central counterparty default waterfalls and systemic loss* (OFR Working Paper No. 20-04). Office of Financial Research. https://www.financialresearch.gov/working-papers/files/OFRwp-20-04_central-counterparty-default-waterfalls-and-systemic-loss.pdf

[14] Merkle, R. C. (1988). A digital signature based on a conventional encryption function. In *Advances in Cryptology – CRYPTO '87* (pp. 369–378). Springer. https://doi.org/10.1007/3-540-48184-2_32

[15] Acemoglu, D., Ozdaglar, A., & Tahbaz-Salehi, A. (2015). Systemic risk and stability in financial networks. *American Economic Review, 105*(2), 564–608. https://doi.org/10.1257/aer.20130456

[16] Committee on Payments and Market Infrastructures, & Board of the International Organization of Securities Commissions. (2017, July 5). *Recovery of financial market infrastructures: Revised report*. Bank for International Settlements. https://www.bis.org/cpmi/publ/d162.htm

[17] Financial Stability Board. (2017, July 5). *Guidance on central counterparty resolution and resolution planning*. https://www.fsb.org/2017/07/guidance-on-central-counterparty-resolution-and-resolution-planning-2/

[18] dYdX Foundation. (2023, November 1). *v4 technical architecture overview*. https://www.dydx.xyz/blog/v4-technical-architecture-overview

[19] Perpetual Protocol. (n.d.). *Perpetual Protocol v2 documentation*. Retrieved June 25, 2026, from https://docs.perp.com/

[20] GMX. (n.d.). *GMX documentation*. Retrieved June 25, 2026, from https://docs.gmx.io/

[21] Gains Network. (n.d.). *Gains Network documentation*. Retrieved June 25, 2026, from https://docs.gains.trade/

[22] Synthetix. (n.d.). *Synthetix documentation*. Retrieved June 25, 2026, from https://docs.synthetix.io/

[23] Liquity. (n.d.). *Liquity v1 documentation*. Retrieved June 25, 2026, from https://docs.liquity.org/liquity-v1

[24] Malwa, S. (2022, September 19). *DeFi trader nets over $500K by using DEX GMX to manipulate Avalanche token*. CoinDesk. https://www.coindesk.com/markets/2022/09/19/defi-trader-nets-over-500k-by-using-dex-gmx-to-manipulate-avalanche-token

[25] Behnke, R. (2025, July 15). *Explained: The GMX hack (July 2025)*. Halborn. https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025

[26] Okwatch, L. (2025, August 14). *GMX finalizes $44M payout to GLP holders affected by V1 exploit*. crypto.news. https://crypto.news/gmx-44m-payout-glp-holders-v1-exploit-2025/

[27] Egorov, M. (2022). *Curve stablecoin design* [Whitepaper]. Curve Finance. https://docs.curve.finance/developer/resources/whitepaper

[28] Malwa, S. (2024, June 13). *DeFi giant Curve roiled as founder's loans get liquidated; CRV slides 30%*. CoinDesk. https://www.coindesk.com/markets/2024/06/13/crv-slides-30-as-loans-tied-to-curves-founder-face-liquidation-risk

[29] Rodrigues, F. (2026, April 27). *Curve founder pitches market-based fix for $700K bad debt in contrast to Aave bailout*. CoinDesk. https://www.coindesk.com/markets/2026/04/27/curve-founder-pitches-market-based-fix-for-usd700k-bad-debt-in-contrast-to-aave-bailout

[30] Aave. (n.d.). *AAVE token and the Safety Module* [Documentation]. Retrieved June 25, 2026, from https://aave.com/docs/ecosystem/aave

[31] Aave. (n.d.). *Umbrella* [Documentation]. Retrieved June 25, 2026, from https://aave.com/docs/aave-v3/umbrella

[32] Cointelegraph. (2025, April 28). *What happened to sUSD? How a crypto-collateralized stablecoin depegged*. Cointelegraph. https://cointelegraph.com/explained/what-happened-to-susd-how-a-crypto-collateralized-stablecoin-depegged

[33] Synthetix. (2026, June 12). *SIP-423: sUSD retirement & staking reform*. Synthetix Improvement Proposals. https://sips.synthetix.io/sips/sip-423/

[34] Nexus Mutual. (n.d.). *Nexus Mutual documentation*. Retrieved June 25, 2026, from https://docs.nexusmutual.io/

[35] InsurAce. (n.d.). *InsurAce protocol whitepaper*. https://files.insurace.io/public/InsurAceWhitepaper.pdf

[36] Benzinga. (2022, August 23). *InsurAce announces $12 million insurance payouts to 155 victims of Terra $UST crash*. Investing.com. https://m.uk.investing.com/news/cryptocurrency-news/insurace-announces-12-million-insurance-payouts-to-155-victims-of-terra-ust-crash-2730016?ampMode=1

[37] EigenLayer Team. (2023). *EigenLayer: The restaking collective* (Whitepaper v1.0). https://docs.eigencloud.xyz/assets/files/EigenLayer_WhitePaper-88c47923ca0319870c611decd6e562ad.pdf

[38] Symbiotic. (n.d.). *Symbiotic documentation*. Retrieved June 25, 2026, from https://docs.symbiotic.fi/

[39] EigenCloud. (2025, April 2). *Intro to slashing on EigenLayer: AVS edition*. https://blog.eigencloud.xyz/intro-to-slashing-on-eigenlayer-avs-edition/

[40] Heimbach, L., Schertenleib, E. G., & Wattenhofer, R. (2023). Short squeeze in DeFi lending market: Decentralization in jeopardy? In *Financial Cryptography and Data Security. FC 2023 International Workshops* (pp. 316–331). Springer. https://doi.org/10.1007/978-3-031-48806-1_22

[41] Knight, O. (2025, March 26). *Hyperliquid delists JELLYJELLY after vault squeezed in $13M tussle*. CoinDesk. https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle

[42] Aave. (n.d.). *Aave V3 technical overview* [Documentation]. Retrieved June 25, 2026, from https://aave.com/docs/aave-v3/overview

[43] Euler Labs. (n.d.). *Euler v2 lite paper: The modular lending platform*. Retrieved June 25, 2026, from https://docs.euler.finance/euler-v2-lite-paper/

[44] Compound. (n.d.). *Compound III documentation*. Retrieved June 25, 2026, from https://docs.compound.finance/

[45] Morpho Association. (2023). *Morpho Blue whitepaper*. https://github.com/morpho-org/morpho-blue/blob/main/morpho-blue-whitepaper.pdf

[46] Hyperliquid. (n.d.). *HIP-3: Builder-deployed perpetuals* [Documentation]. Retrieved June 25, 2026, from https://hyperliquid.gitbook.io/hyperliquid-docs/hyperliquid-improvement-proposals-hips/hip-3-builder-deployed-perpetuals

[47] MakerDAO. (2021). *MIP45: Liquidations 2.0 — Liquidation system redesign* [Maker Improvement Proposal]. GitHub. https://github.com/makerdao/mips/blob/master/MIP45/mip45.md

[48] Eichholz, L. (2020, March 17). *What really happened to MakerDAO?* Glassnode Insights. https://research.glassnode.com/what-really-happened-to-makerdao/

[49] Ajna Labs. (2024). *Ajna protocol whitepaper*. https://www.ajna.finance/pdf/Ajna_Protocol_Whitepaper_01-11-2024.pdf

[50] Kirillov, A., & Chung, S. (2022). *StableSims: Optimizing MakerDAO Liquidations 2.0 incentives via agent-based modeling* (arXiv:2201.03519). arXiv. https://arxiv.org/abs/2201.03519 https://doi.org/10.48550/arXiv.2201.03519

[51] Qin, K., Zhou, L., Gamito, P., Jovanovic, P., & Gervais, A. (2021). An empirical study of DeFi liquidations: Incentives, risks, and instabilities. In *Proceedings of the ACM Internet Measurement Conference* (pp. 336–350). ACM. https://doi.org/10.1145/3487552.3487811

[52] Sandor, K. (2022, November 22). *Mango exploiter's funds get liquidated after roiling Aave using $20M of borrowed Curve tokens*. CoinDesk. https://www.coindesk.com/markets/2022/11/22/mango-exploiter-gets-liquidated-after-roiling-aave-using-20m-of-borrowed-curve-tokens

[53] Maskin, E. S. (2008). Mechanism design: How to implement social goals. *American Economic Review, 98*(3), 567–576. https://doi.org/10.1257/aer.98.3.567

[54] Hart, O., & Moore, J. (1990). Property rights and the nature of the firm. *Journal of Political Economy, 98*(6), 1119–1158. https://doi.org/10.1086/261729

[55] Goodhart, C. A. E. (1984). Problems of monetary management: The U.K. experience. In *Monetary Theory and Practice* (pp. 91–121). Palgrave Macmillan. https://doi.org/10.1007/978-1-349-17295-5_4

[56] Lucas, R. E., Jr. (1976). Econometric policy evaluation: A critique. *Carnegie-Rochester Conference Series on Public Policy, 1*, 19–46. https://doi.org/10.1016/S0167-2231(76)80003-6

[57] Grossman, S. J., & Hart, O. D. (1986). The costs and benefits of ownership: A theory of vertical and lateral integration. *Journal of Political Economy, 94*(4), 691–719. https://doi.org/10.1086/261404