Author: danny; Source: X, @agintender
What drives “fairness”-claiming protocols and exchanges to blow up the tables? When we talk about ADL, we can’t just focus on ADL alone. ADL is the final step in the entire liquidation mechanism. What we need to look at is the whole liquidation system, including margin liquidation prices, bankruptcy prices, order book liquidation, insurance funds, and other mechanisms—ADL is just the final “socialized” outcome. The core is actually the liquidation mechanism itself. It’s the desolation after the liquidation mechanism is exhausted that has brought us to this point. (You and I are both responsible~)
As for why ADL is part of a Greedy queue? If you are standing in a market with abundant liquidity, calm waters, you won’t understand. You need to place yourself in the context when ADL occurs to understand why CEXs design it this way—because it’s the least risky, lowest cost, and psychologically least burdensome solution.
1. ADL is a life-saving tool for exchanges, not a fairness weight
ADL (Auto-Deleveraging) is a systemic risk fallback mechanism in perpetual contract markets. When markets fluctuate violently, some accounts get liquidated, and the exchange’s insurance fund isn’t enough to cover these losses, the system activates ADL by forcibly closing some profitable traders’ positions to fill the gap, preventing the entire liquidation system from failing. It’s important to note that ADL is not part of normal operations; it’s an “ultimate measure” only used in extreme cases.
After ADL is triggered, the system proceeds with deleveraging according to a clear but not fully public priority rule. Generally, the higher the leverage and the larger the floating profit proportion of a position, the easier it is to be placed at the front of the ADL queue for “position optimization.”
Here is a direct excerpt from Binance’s explanation of ADL:
Key points:
- The current contract mechanism is prepared for “crossing the line”
- ADL is the last step in the forced liquidation process
- It occurs only when the risk reserve fund cannot absorb the losses
- The larger the risk reserve fund, the less frequent ADL is triggered
- Activating ADL negatively impacts the market, akin to using profits to subsidize losses (especially since profits usually belong to big players, reducing their gains offends major traders)
- We cannot prevent ADL but will try our best to minimize it.
For exchanges/protocols, if the purpose of liquidation mechanisms is to ensure fairness, then ADL is for survival.
2. Liquidation waterfall: From market trades to ADL trigger
Since ADL is part of the liquidation system, understanding its trigger details should start from the source.
Generally, exchanges follow a “waterfall” sequence for liquidation:
Stage 1: Order Book Liquidation (
When a user’s margin falls below maintenance margin, the liquidation engine first attempts to execute that position as a market order into the order book.
Ideally, with sufficient market depth, long liquidation orders are eaten by shorts, positions are closed, and remaining margin is refunded. But during crashes like 10.11, buy-side liquidity dries up, huge liquidation orders directly break through the order book, causing slippage to spiral out of control and leading to crossing the bankruptcy price, so we move to the next step.
Stage 2: Risk Reserve Fund takes over
When the order book cannot absorb the order or the user’s position is close to the bankruptcy line (Bankruptcy Price), to prevent further price collapse, the exchange’s insurance fund intervenes.
The risk reserve fund acts as “last buyer,” taking over the position at a price close to (or better than) the bankruptcy price. The fund then slowly unwinds this position in the market. At this point, the fund holds a large loss position (inventory risk). If prices continue to fall, the fund itself incurs losses.
Stage 3: ADL activation
This is the most critical step. When the risk reserve fund reaches zero or a threshold, or if risk control calculations determine that taking over the position would bankrupt the fund, the system refuses to take over and directly triggers ADL.
The system searches among counterparties (traders who are correctly positioned and are profitable) for “sacrificers,” forcibly closing their positions at the current mark price to offset the impending crossing of the losing position.
This highlights an important but rarely mentioned “function” of ADL—the market’s liquidity provider in times of shortage, using winners’ funds to stop the fall.
Think about it: without ADL, the insurance fund would keep executing orders at the order book, causing prices to trend upward/downward and triggering more cascades.
3. Two liquidation modes and their propagation effects on ADL
Many are familiar with ADL but may not understand the liquidation modes prior to ADL. Generally, there are two main modes—some innovative approaches are based on improvements over these.
Liquidation is the prelude to ADL. Different liquidation handling methods directly determine the frequency, depth, and market impact of ADL triggers. Talking about ADL without discussing liquidation modes is like playing with fire.
) 3.1 Mode A: Order Book Dumping ###
Mechanism: When a user hits the liquidation threshold, the engine immediately executes the position as a market order into the order book.
Insurance fund role: Only used to cover crossing losses—if the market order pushes the price below the bankruptcy price, the gap is paid by the insurance fund.
ADL trigger logic: Only when the insurance fund is depleted or the order book is fully exhausted (no more bids) does ADL activate.
Market impact:
Advantages: Respects market pricing, minimally disturbs profitable traders.
Disadvantages: In extreme conditions like 10.11, huge liquidation orders instantly break liquidity, causing chain liquidations. Prices crash due to liquidation impact, leading to more margin calls and rapid depletion of the insurance fund.
( 3.2 Mode B: Takeover/Absorption )
Mechanism: When a user hits the liquidation threshold, the system does not sell into the order book. Instead, liquidity providers/insurance funds directly take over the position.
Risk reserve fund role: It “buys” the defaulted liquidation at the bankruptcy price (or slightly better, e.g., $1,990). After absorption, it may sell the position at a better price in the market; profit is credited to the insurance fund, losses are borne by it.
ADL trigger logic: This is the key difference between modes.
In Mode A, ADL is triggered when the order book liquidity and insurance fund are exhausted—“no money left to pay.”
In Mode B, ADL is triggered based on risk control thresholds of the risk reserve fund.
4. Deep validation and calculations of the two modes
To answer “how do different liquidation mechanisms affect ADL,” we first build a mathematical model simulating the performance of Mode A and Mode B under extreme market conditions.
4.1 Scenario assumptions
Market environment: ETH price crashes instantaneously. Market depth is extremely thin, buy orders are scarce.
Defaulted position (Alice):
Position: Long 10,000 ETH
Liquidation Price: $2,000
Bankruptcy Price: $1,980
Current order book:
Bid 1: $1,990 (only 100 ETH)
Bid 2: $1,900 (only 5,000 ETH)—sharp depth drop
Bid 3: $1,800 (10,000 ETH)
( 4.2 Mode A: Order Book Dumping
Mechanism: The liquidation engine directly sells Alice’s 10,000 ETH as a market order into the order book without buffering.
Calculation (rough):
Trades:
100 ETH @ $1,990
5,000 ETH @ $1,900
4,900 ETH @ $1,800
Weighted average price )VWAP###:
[(100×1990) + (5000×1900) + (4900×1800)] / 10,000 ≈ ###
Crossing the bankruptcy price:
Alice’s bankruptcy price is $1,980.
Per ETH loss: $1,980 - average execution price (say, approx $1,852) = (
Total crossing loss: $1,852 - $1,980 = (positive or negative? need to check) — but the key is the total loss:
Total loss = (Bankruptcy Price - actual execution price) × position size.
If insurance fund < $1.28 million, system must trigger ADL immediately.
The system finds profitable traders like Bob, who hold shorts, and forcibly closes his position at $1,980, even if the market has already fallen to $1,800.
Mode A causes prices to instantly crash to $1,800, creating huge slippage and breaching the insurance fund, triggering large-scale ADL.
) 4.3 Mode B: Takeover/Absorption
Mechanism: No sell order into the order book. The insurance fund (or HLP) directly takes over Alice’s position at the bankruptcy price ($2,000) or slightly better ($1,990).
Calculation (rough):
Takeover: The risk reserve fund immediately holds a 10,000 ETH long position, entered at ~$1,990.
- Market response: Price remains around $1,990 initially (no selling pressure).
- After 1 minute, external market drops to $1,850. The risk reserve fund’s position incurs floating losses:
($1,990 - $1,850) × 10,000 ETH = $1.4 million loss.
- ADL judgment:
The system does not trigger ADL because there’s still “funds to cover.” But it does risk analysis:
- If total HLP funds are $100M, a $1.4M loss is acceptable → no ADL.
- If total HLP funds are only $5M, the loss is too large → system triggers ADL to cut losses quickly.
Mode B, in the initial moments of collapse, preserves order book prices, preventing cascade failures. But it concentrates risk inside the insurance fund. If the market continues to decline, the fund’s losses grow, possibly leading to more aggressive ADL or systemic failure.
In fact, Hyperliquid’s massive ADL on 10.11 wasn’t because the system lacked funds per se but because the HLP Vault chose to transfer risk proactively to profitable traders to prevent a larger collapse (similar to the “Whale Slap” incident).
While Mode B protects the market price from instant piercing, it accumulates inventory risk in HLP. If HLP hits risk thresholds, it will aggressively kill profitable traders’ positions via ADL to survive. Imagine a scenario where HLP experiences a 30% drawdown in a day—most users would withdraw and exit, leading to a bank run.
A final note: I’ve long warned that mimicking CEX liquidation mechanisms in Perp DEXes will eventually cause big problems. Now you see why.
5. Hyperliquid’s unique architecture: HLP and ADL sensitivity
Hyperliquid differs fundamentally from Binance or OKX, which rely on the exchange’s accumulated profits or opaque insurance funds. Its insurance is held by the HLP Vault.
$1852
5.1 HLP: Both market maker and insurance fund
HLP is a community-deposited USDC pool with dual roles:
Market Maker: Provides liquidity on the order book, earns spreads.
Liquidator: When “Stage 2” occurs, it takes over liquidated positions.
This structure makes Hyperliquid’s ADL trigger different from centralized exchanges:
Binance Mode: Insurance fund is “private money,” often billions of dollars (just a hypothesis). It allows Binance to tolerate larger drawdowns and avoid ADL to preserve big trader experience.
Hyperliquid Mode: HLP is user money. If it incurs large losses by taking over toxic positions, LPs may panic and withdraw, causing a “bank run” and collapse. (The Jelly event already showed how vulnerable HLP can be).
Thus, Hyperliquid’s risk engine is extremely sensitive. When the system detects high risk of HLP taking over a position, it skips Stage 2 and directly triggers ADL. That’s why on October 11, Hyperliquid triggered massive ADL (over 40 times in 10 minutes), while some CEXs, even if they had internal cross-positions, chose to endure with their own funds.
$128
5.2 Deep dive: Liquidator Vault mechanism
The Liquidator Vault is a sub-strategy within HLP. It’s not an independent pool but a “liquidation” logic layer.
![QgCnUpOA3omPnxPyd7Ws7bonDqmSbJxRfTWF2VMU.png]$128 https://img-cdn.gateio.im/webp-social/moments-f935c9681a2ba943563e0a8f0611c42c.webp “7421393”###
When a trader is liquidated and the market cannot absorb the order (Stage 1 fails), the Liquidator Vault “buys” the defaulted position.
Example: A trader short 1000 SOL. Price drops to $90 (liquidation price). Order book bids are thin. The vault takes over this short position.
Immediate PnL: The user’s remaining margin is seized. If the margin covers the difference between entry and current mark price, HLP records a “liquidation fee” profit.
Inventory unwinding: HLP now holds a 1000 SOL long position in a crashing market. It must sell these SOLs to neutralize risk. But if these positions cannot be cleared promptly and reach certain thresholds, ADL may be triggered.
6. Review of the 10.11 event: the game of algorithms
Now let’s return to the core controversy: On October 11, 2025, Hyperliquid handled over 10 billion USD in liquidations; over 40 ADL events occurred within 10 minutes. Some say this was exaggerated—was it really?
( 6.1 Core dispute: Greedy Queue vs. Pro-Rata
Tarun Chitra, CEO of Gauntlet, pointed out that Hyperliquid’s ADL algorithm caused about $653 million in “unnecessary losses” (opportunity costs).
The debate centers on the ADL sorting algorithm.
Hyperliquid’s algorithm: Greedy Queue )The Greedy Queue###
This is a classic algorithm inherited from the BitMEX era. The system sorts all profitable traders based on:
Score = Profit / Principal × Leverage
Execution:
Starting from the top-ranked trader, close their position completely until the loss gap is filled.
Result: The “best-performing traders” at the top are “killed.” Their positions are gone, losing potential future gains from market declines, but preserving current profits.
Gauntlet’s algorithm: Risk-aware proportional (Risk-Aware Pro-Rata)
Execution: Instead of killing the top traders outright, it reduces each of the top 20% profitable traders’ positions proportionally (e.g., 10% haircut per trader).
Advantages:
Preserves some of their positions, allowing continued participation in subsequent price movements.
Backtests show this approach retains more open interest and reduces harm to users.
( 6.2 Why does Hyperliquid insist on “Greedy Queue”?
Although Gauntlet’s method is theoretically fairer, Hyperliquid founder Jeff Yan’s rebuttal reveals practical constraints:
Speed and certainty: On L1 chains, computation resources are costly. Calculating proportional reductions for thousands of users requires significant computation and state updates, risking block delays. The “Greedy Queue” only needs sorting and trimming, with very low complexity—and speed is critical during market crashes.
HLP vulnerability: As mentioned, HLP has limited funds. Proportional ADL means HLP must hold some toxic positions longer, waiting for the system to slowly compute and execute reductions. For Hyperliquid, quickly cutting risk (by fully closing big traders) outweighs “fairness.”
7. What is the truth about Greedy Queue?
As you read through, you will realize that the 40+ ADL events in 10 minutes reflect the core mechanism of HLP. In front of large traders, HLP’s contributors are the backbone of Hyperliquid.
The Greedy Queue is not a novel algorithm invented by Hyperliquid; it has been around for years and is still used by many CEXs. Did they not consider the safety of their liquidity pools when using it? The computational simplicity and speed are advantages. But given the repeated ADL events and affected big traders, have they not sought rights protection or protested? Clearly not.
The real reason: For centralized exchanges, the Greedy Queue is a practical, relatively fair, and cost-controllable solution compatible with existing mechanisms.
Referring back to the earlier liquidation modes, ADL triggers when:
- Extreme market volatility
- Market liquidity is essentially “vacuum”
- The risk reserve fund is severely depleted
For large traders affected by ADL, they also understand that during such times, the market cannot absorb their profitable positions. Due to technical reasons, even exchange accounts might be inaccessible during sharp moves. Therefore, ADL acts as a way for the exchange to “help” traders take profits, especially when orders cannot be executed.
Furthermore, losing less psychologically is easier to accept than losing more, especially after the exchange itself suffers losses. The sense of “win-win” feels better.
Why is it necessarily a Greedy Queue? Besides the naive logic that “more profit = more responsibility,” the main reason is that it affects fewer people.
What do CEXs fear most? Not crossing the line? Not losses? Public opinion. They prefer that only a small portion of traders suffer, so they can communicate privately one-on-one or in small groups. Remember, market disputes don’t end after liquidation or ADL; disputes, complaints, threats, and legal issues often happen behind the scenes.
8. Is there a better algorithm?
Yes, but not necessarily a better ADL algorithm. Currently, the focus should be on preventing ADL from happening in the first place.
Since this is not the main topic, I’ll just briefly present a table; for practitioners, the hints in it should be enough.
![GfrR3Sf94zmx3pLVReQD1vjZzquuAMufPaLBcnVp.png])https://img-cdn.gateio.im/webp-social/moments-5b95f33b181dc7381d905c3e4726c546.webp “7421394”###
Of course, if any exchange dares to implement a circuit breaker system, that could really prevent many unnecessary issues.
