What Are Safety Mechanisms?
Safety mechanisms are the checks and protocols that sit between your capital and everything that can go wrong. Delta-neutral funding sounds simple: you’re hedged, you collect funding. In practice, things break. We assume the worst and build layers that guard at every phase. We’d rather skip a trade or exit early than hope and hold. What we have: pre-entry gates that all must pass (funding profitability, spread, OI, volatility, insurance fund, ADL level, oracle freshness, order book depth, and more), plus a stress simulation before every entry. Entry safety: atomic execution for same-chain pairs, auto-rollback for cross-venue when one leg fails, fill verification so we catch partials. Four-tier margin defense so we act before the edge. Venue outage protocol for when exchanges go down. A kill switch that runs separately so it can halt everything even if the engine hangs. Exchange-side stops that fire even if our system is offline. Several of these are designed and backtested; implementation is rolling out. The auto-close pipeline (cascade velocity, liquidation proximity, delta/ADL, funding inversion, close execution) is live. For the full roadmap, see Auto-close: What We’re Building. We’ve stress-tested every guard against 7 historical crashes. We don’t ship hope. We ship what survives. For the exit side, see Auto-close. Below we spell out each risk we guard against and how we handle it.The Problems We Guard Against (and How)
Bad Entry: Taking a Trade That Doesn’t Pay
The problem. You open a position when funding looks good, but it flips negative an hour later. Or the spread is too tight and fees eat your edge. Or the trade is so crowded that ADL risk is sky-high. You’re in before you know it’s a bad idea. How we protect. We run pre-entry gates before opening any position. If any gate fails, we skip. Missing a trade is better than entering a bad one.| Gate | What It Checks | Pass Condition |
|---|---|---|
| Funding profitability | Is the funding diff worth it? | Current diff > 80th percentile of 30-day history; funding positive ≥3 intervals in a row |
| Trade profitability | Does the spread allow profit after costs? | Net entry cost under max acceptable (e.g. 0.05%); break-even under 48h |
| Cross-market spread (S5) | Is spread wide enough for execution? | Current spread above rolling 20-period mean |
| Open interest crowding | Is the trade too crowded? | OI percentile under 95 |
| Volatility circuit breaker | Has price moved too much lately? | Recent move under 2× historical vol and under 5% absolute |
| Basis Z-score | Is perp premium overstretched? | Z-score under +2 |
| Liquidation buffer | Enough margin cushion after entry? | Initial buffer > max(15%, 2× 30d realized vol) |
| Insurance fund | Is the exchange’s safety net healthy? | Insurance balance > 50% of 30d average |
| ADL level | How close are we to ADL risk? | ADL indicator ≤ 3 (out of 5) |
| Oracle freshness | Is the price feed up to date? | Within threshold (e.g. Pyth 60s, HL 30s, Stork 120s) |
| Order book depth | Can we exit if we need to? | Depth within 50 bps > 2× position size on both venues |
| Leverage | Hard cap on leverage | ≤ 3x (max 5x only for BTC/ETH) |
Half-Open Positions: One Leg Fills, the Other Fails
The problem. You’re running two legs, long on one venue and short on another. Leg 1 fills. Leg 2 fails (timeout, rejection, partial fill). You’re now directional and exposed. One bad move and you’re liquidated. How we protect. For same-chain pairs (e.g. Drift and Drift), both legs are bundled in a single atomic transaction. Both open or neither opens. No in-between. For cross-venue pairs, legs execute sequentially. If leg 2 fails, we immediately close leg 1. That’s our auto-rollback. If the rollback succeeds, no positions are opened and we notify you. If the rollback fails, we flag the position for manual intervention and alert you right away. You’re never left with an unhedged position without explicit notification. We also verify every fill. After every open or close order, we check the actual filled size against what we requested. If the fill is under 95% of requested, we retry the remainder or close the partial. If cross-leg fill mismatch is over 5%, we rebalance or close both. IOC orders during extreme volatility can partially fill; undetected partial fills break delta neutrality. So we catch them.Margin Creep: Drifting Toward Liquidation Without Warning
The problem. Margin drops slowly, then suddenly. By the time you notice, you’re one move from liquidation. Level-based checks can miss the drift until it’s too late. How we protect. We don’t wait until we’re at the edge. We act in tiers so we have time to react.| Tier | Margin Ratio | What We Do |
|---|---|---|
| 1 – Healthy | > 300% | Poll every 10s; monitor only; no action |
| 2 – Warning | 200–300% | Alert; stop new entries; tighten take-profit; poll every 5s |
| 3 – Danger | 150–200% | Reduce position 25–50%; add collateral if needed; cancel all orders; poll every 2s |
| 4 – Emergency | under 150% | Close everything. See Auto-close for how and when. |