Auto-Deleveraging (ADL)

• Auto-deleveraging (ADL) is a loss socialization mechanism that reallocates residual deficits when liquidation and insurance funds are insufficient.
• ADL is modeled through online learning, risk-based optimization, and mechanism-design frameworks to balance priorities like solvency, fairness, and revenue.
• Empirical studies demonstrate that various ADL implementations, from queue policies to mirror descent methods, significantly impact risk allocation and market stability.

Auto-deleveraging (ADL) is a last-resort loss socialization mechanism used by perpetual futures venues when liquidation and insurance buffers are insufficient to restore solvency. In formal models of recent work, ADL is the rule by which an exchange chooses both the amount of residual loss to socialize and the solvent accounts from which positions or unrealized profits are forcibly reduced. Three complementary research directions now frame the subject: ADL as an online learning problem on a PNL-haircut domain, where haircuts apply to positive PNL rather than posted collateral principal (Chitra et al., 16 Feb 2026); ADL as a risk-based optimization problem whose benchmark solution minimizes future expected shortfall by deleveraging the most highly levered accounts first (Campbell et al., 16 Mar 2026); and ADL as a mechanism-design problem constrained by an impossibility trilemma between solvency, revenue, and fairness (Chitra, 30 Nov 2025).

1. Operational setting and trigger conditions

In the formal perpetual-futures model, a venue maintains open positions

$$\mathcal P_n=\{\mathfrak p_i=(q_i,c_i,t_i,b_i):i=1,\dots,n\},$$

where $q_i\ge 0$ is notional size, $c_i\ge 0$ is posted collateral, $t_i$ is entry time, and $b_i\in\{+1,-1\}$ is side. The venue quotes a mark price $p_t$, observes a spot-oracle price $\hat p_t$, and typically uses funding-rate transfers to keep $p_t\approx \hat p_t$. One discrete funding rule given in the literature is

$$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$

with cumulative funding

$\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$

Equity at terminal time is then written

$q_i\ge 0$0

where $q_i\ge 0$1 and $q_i\ge 0$2 is the first time maintenance margin is breached (Chitra, 30 Nov 2025).

Liquidation is triggered when

$q_i\ge 0$3

A liquidation slice $q_i\ge 0$4 realizes an execution price $q_i\ge 0$5 and may generate bad debt

$q_i\ge 0$6

Insurance absorbs shortfall when possible. With insurance-fund balance $q_i\ge 0$7, realized shortfall $q_i\ge 0$8, and residual shortfall

$q_i\ge 0$9

ADL is invoked precisely when $c_i\ge 0$0 (Chitra, 30 Nov 2025).

In this setting, an ADL policy returns two objects: a severity $c_i\ge 0$1, interpreted as the fraction of $c_i\ge 0$2 to socialize, and a haircut vector $c_i\ge 0$3 over the surviving winner set $c_i\ge 0$4. Feasibility requires

$c_i\ge 0$5

so that no account loses more equity than it has. After the haircut, survivor equities become $c_i\ge 0$6 (Chitra, 30 Nov 2025).

2. ADL as sequential control and online learning

A distinct formalization treats each ADL episode as an online learning problem. In that model, an ADL round $c_i\ge 0$7 occurs whenever a residual deficit

$c_i\ge 0$8

is encountered after liquidation and insurance. The public-data state is

$c_i\ge 0$9

where $t_i$0 is the set of active positions, $t_i$1 is the winner set, $t_i$2 is winner $t_i$3's positive-PNL capacity, and $t_i$4 denotes auxiliary market signals such as mark price and depth summaries. The venue chooses an action

$t_i$5

with $t_i$6, $t_i$7, $t_i$8, $t_i$9, and $b_i\in\{+1,-1\}$0. Equivalently, the action is parameterized by a severity fraction $b_i\in\{+1,-1\}$1 and haircut fractions $b_i\in\{+1,-1\}$2 (Chitra et al., 16 Feb 2026).

The per-round surrogate loss combines tracking error against the ex post benchmark severity with a penalty for burden concentration. Standard static regret,

$b_i\in\{+1,-1\}$3

dynamic regret,

$b_i\in\{+1,-1\}$4

and policy-class regret are then defined over comparator classes (Chitra et al., 16 Feb 2026).

For the one-dimensional severity control problem, the loss reduces to

$b_i\in\{+1,-1\}$5

If the comparator path variation is

$b_i\in\{+1,-1\}$6

then projected OGD with step size $b_i\in\{+1,-1\}$7 satisfies

$b_i\in\{+1,-1\}$8

and choosing

$b_i\in\{+1,-1\}$9

yields

$p_t$0

The robustness statement is explicit: adversarial deficits $p_t$1 and adversarial price moves enter only through $p_t$2 and $p_t$3, so worst-case regret scales with episode severity and variability (Chitra et al., 16 Feb 2026).

This framework also formalizes a limitation of queue-based ADL. Queue policies correspond to extreme-point selections on the feasible polytope and are therefore discontinuous and non-Lipschitz in their scores; fixed queues can incur $p_t$4 regret or $p_t$5 variation in effective execution slope even under smooth underlying changes. A common misconception is that ADL queues merely encode operational priority. In this formulation, they are specific control laws with unfavorable worst-case sequential behavior (Chitra et al., 16 Feb 2026).

3. Risk-based optimization and the water-filling benchmark

A separate line of work casts ADL as an expected-loss minimization problem. In the single-asset isolated-margin case, the exchange must re-absorb an aggregate short exposure $p_t$6. The remaining short accounts $p_t$7 have position $p_t$8, entry price $p_t$9, and posted margin $\hat p_t$0. At reference price $\hat p_t$1, an ADL allocation is $\hat p_t$2 satisfying $\hat p_t$3 and $\hat p_t$4, where $\hat p_t$5 is the quantity forcibly bought back from account $\hat p_t$6. Post-ADL equity at a future close-out price $\hat p_t$7 is

$\hat p_t$8

The exchange’s loss at terminal price $\hat p_t$9 is

$p_t\approx \hat p_t$0

Under risk neutrality, the optimization problem is

$p_t\approx \hat p_t$1

(Campbell et al., 16 Mar 2026)

The key state variable is post-ADL leverage,

$p_t\approx \hat p_t$2

The paper proves that, under a risk-neutral expected-loss objective, the unique optimal allocation is the unique solution of

$p_t\approx \hat p_t$3

Hence the policy minimizing expected exchange loss is exactly the policy minimizing the maximum leverage among participants. The closed-form solution is the water-filling, or leverage-draining, rule

$p_t\approx \hat p_t$4

where the leverage threshold $p_t\approx \hat p_t$5 is the unique root of

$p_t\approx \hat p_t$6

Operationally, positions are reduced first for the most highly levered accounts, and leverage is progressively equalized (Campbell et al., 16 Mar 2026).

The benchmark has several structural properties. It is distribution-free in the sense that $p_t\approx \hat p_t$7 depends only on $p_t\approx \hat p_t$8 through the root equation. It is wash-trade resistant because round trips at prices $p_t\approx \hat p_t$9 preserve $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$0. It is Sybil resistant because splitting an account into subaccounts never reduces the total buyback it must absorb. It is path-independent, formally $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$1. The paper further states an axiomatic uniqueness result: leverage priority together with path independence uniquely characterize the water-filling rule among monotone ADL maps (Campbell et al., 16 Mar 2026).

In the multi-asset cross-margin case, the problem becomes genuinely multi-dimensional. Introducing asset-level shadow prices $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$2 yields a separable dual decomposition: $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$3 and the exchange chooses $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$4 by maximizing

$$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$5

This decouples an $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$6 decision problem into $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$7 low-dimensional subproblems plus a $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$8-dimensional outer search. Under a one-factor price model, the rule again becomes a clipped water-filling policy, now in factor-adjusted leverage rather than naive gross leverage. The explicit observation is that naive gross leverage can be misleading because it ignores hedging within portfolios (Campbell et al., 16 Mar 2026).

4. Impossibility results and mechanism classes

The mechanism-design treatment begins from three asymptotic desiderata for a family of policies $$\gamma_t=\kappa\Bigl(\frac{L_t}{S_t}-\frac{p_t}{\hat p_t}\Bigr),\qquad L_t=\sum_{b_i=+1}n_{i,t},\;S_t=\sum_{b_i=-1}n_{i,t},$$9: solvency, fairness, and revenue. Solvency is encoded by $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$0 and $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$1. Fairness is expressed through bounded moral hazard using the metrics

$\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$2

where $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$3, $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$4, and $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$5. Revenue is written as

$\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$6

with $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$7 total fee revenue and $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$8 diversion to insurance. Under heavy-tail and LLN/EVT assumptions, no static policy can satisfy solvency, fairness, and revenue simultaneously (Chitra, 30 Nov 2025).

The trilemma is proved by showing that each pair of desiderata asymptotically excludes the third. From fairness, total haircut must be $\Gamma_i=\sum_{s=t_i+1}^{T}(b_i q_i)\gamma_s p_s.$9, so severity vanishes. From solvency plus fairness, fee diversion must increase until net venue revenue becomes negative. From solvency plus revenue, severity must remain order one, forcing moral-hazard ratios to collapse. From fairness plus revenue, residual shortfall remains order $q_i\ge 0$00, violating solvency. This suggests that ADL mechanism design is not a search for a universally “correct” policy, but a choice of which objective is relaxed and by how much (Chitra, 30 Nov 2025).

Constructively, the literature decomposes ADL into “how much?” and “who pays?” For severity, the mechanism classes include a static cap $q_i\ge 0$01, exponential back-off $q_i\ge 0$02, and Online Mirror Descent with convex loss

$q_i\ge 0$03

For allocation, the classes include queue policies based on a PNL$q_i\ge 0$04leverage ranking score, pro-rata haircuts proportional to equity, Risk-Aware Pro-Rata (RAP) with weights $q_i\ge 0$05, and joint vector mirror-descent policies over $q_i\ge 0$06 (Chitra, 30 Nov 2025).

These classes admit sharp distributional comparisons. Pro-rata is described as the unique minimizer of any convex aggregate disutility under Schur-convex or submajorization criteria, whereas queue allocation is the unique maximizer of moral-hazard concentration. In this sense, queue-based and pro-rata mechanisms are not merely different operational conventions; they occupy opposite ends of the concentration spectrum (Chitra, 30 Nov 2025).

5. Empirical evidence from the October 10, 2025 Hyperliquid stress episode

One empirical study reconstructs the Hyperliquid event from 21:16 to 21:27 UTC using public fills. In that replay there are $q_i\ge 0$07 ADL rounds and total liquidation of approximately $q_i\ge 0$08 billion. Holding fixed $q_i\ge 0$09, $q_i\ge 0$10, $q_i\ge 0$11, $q_i\ge 0$12, and the market path, and allowing only severity and allocation to vary, the realized comparator variation is $q_i\ge 0$13, which yields an instance-calibrated upper envelope

$q_i\ge 0$14

Under this calibration, Hyperliquid’s production queue attains total objective $q_i\ge 0$15–$q_i\ge 0$16 million, or $q_i\ge 0$17 of the same bound, with overshoot approximately $q_i\ge 0$18 million, or $q_i\ge 0$19; and the min-max ILP oracle reaches $q_i\ge 0$20 million, well below $q_i\ge 0$21 (Chitra et al., 16 Feb 2026).

A second empirical study analyzes the “Black Monday” cascade on Hyperliquid from 21:16 to 21:28 UTC. It reports 161 assets, roughly $q_i\ge 0$22 million, while the server-reported ADL queue applied a budget of $q_i\ge 0$23 million, approximately $q_i\ge 0$24 the real shortfall. Winners lost $q_i\ge 0$25 million net, and the reported moral-hazard metrics are $q_i\ge 0$26 and $q_i\ge 0$27 (Chitra, 30 Nov 2025).

The same study evaluates counterfactual mechanisms. A smart queue capped at $q_i\ge 0$28 million. Exponential back-off with $q_i\ge 0$29 holds overshoot below $q_i\ge 0$30 million, achieves $q_i\ge 0$31, and retains approximately $q_i\ge 0$32 of winner PNL. Mirror-descent severity yields $q_i\ge 0$33 million and winners keep approximately $q_i\ge 0$34 of PNL. Joint vector MD yields overshoot approximately zero, $q_i\ge 0$35 million, winners keep approximately $q_i\ge 0$36 of PNL, and best long-term revenue retention (Chitra, 30 Nov 2025).

Because these studies use different replay assumptions, objectives, and calibrations, their quantitative outputs should be read as model-specific evaluations rather than interchangeable measurements. What is common across them is the direction of the comparison: production queue mechanisms overutilize ADL relative to optimized severity-and-allocation rules (Chitra et al., 16 Feb 2026).

6. Implementation, trade-offs, and open directions

The implementable controllers proposed in the literature are lightweight. Severity can be controlled by vector mirror descent or by simple adaptive step-size OGD on $q_i\ge 0$37; allocation can be continuous pro-rata in $q_i\ge 0$38 time or an integer-lot ILP solved in milliseconds; and the required inputs $q_i\ge 0$39, $q_i\ge 0$40, and prices are observable in real time on most venues. These constructions are explicitly described as not relying on discretionary overlays or external capital injections (Chitra et al., 16 Feb 2026).

The main trade-offs are also explicit. Execution-price estimation remains a driver of ex post severity failure: under a linear impact model $q_i\ge 0$41, estimation error in $q_i\ge 0$42 produces an ex post severity shortfall

$q_i\ge 0$43

and OGD on $q_i\ge 0$44 controls this only up to an order bound $q_i\ge 0$45. At the policy level, $q_i\ge 0$46 tunes the fairness-versus-solvency-tracking tension. Convex allocation rules such as pro-rata sacrifice some queue seniority incentives, while queue policies preserve a strong priority structure at the cost of concentration and discontinuity. Replay-based evidence also assumes a fixed market path, whereas full equilibrium feedback through market-maker response and order-book resiliency remains to be integrated (Chitra et al., 16 Feb 2026).

Risk-based ADL generalizes naturally to cross-margin and multi-asset portfolios, where exposure reduction must be allocated across correlated books using shadow prices and, in one-factor settings, factor-adjusted leverage (Campbell et al., 16 Mar 2026). Mechanism-design work adds further operational recommendations: monitor heavy-tail scale $q_i\ge 0$47 and average deficit $q_i\ge 0$48; size buffers using the newsvendor rule $q_i\ge 0$49; decouple scalar severity control from allocation; publish code or cryptographic commitments of the policy; monitor PTSR and PMR as real-time indicators; and consider extensions such as confidential ADL, joint clearing and ADL, and adversarial multi-round threat models (Chitra, 30 Nov 2025).

A persistent misconception is that ADL is simply an exchange-specific liquidation queue. The current literature treats it more narrowly and more rigorously: as a constrained control problem over residual losses, as a risk-allocation problem over levered survivors, and as a mechanism whose desirable properties are mutually incompatible in the large. Within that framework, the central technical questions are no longer whether ADL can be avoided once residual shortfall exists, but how severity is chosen, how burden is allocated, and which objective—solvency, trader fairness, or venue revenue—is allowed to degrade.