Liquidation, Chaos, and Risk

Liquidation, chaos, and risk by Armani Ferrante of Backpack

With chaos in markets over the past week, our systems at Backpack are handling all time high workloads. We are putting in continuous effort to scale and meet the demands of the ever growing user base, and thankfully our risk engine has held up well thus far. As we continue to grow, it will continue to be trialed by market, and, although I can't guarantee we will be perfect, I know it will become one of the most critical parts of our system.

As FTX taught the world -- and some of us, leaving permanent scars risk engines are as important as custody itself. The great irony of the FTX fraud is all of the talk and marketing around its ostensibly incredible risk engine -- when it was risk engine itself tha et was a major factor allowing Alameda to drain out customer funds via non liquidating accounts and an infinite credit line. The other great irony of the FTX collapse is that, for any margin system, bankruptcy is a valid state transition -- there are no exceptions. This extremely subtle, extremely technical truth is not something that world has fully grokked as evidenced by the wave of startup exchanges claiming to have made FTX impossible. And before having gone through the exercise of building a margin system from scratch, I was also too naive to know any better.

Although "solving" the FTX problem, is not purely a technical challenge - and a comprehensive solution extends far beyond a single X post can articulate - transparency around risk is probably one of the most important parts of a solution. This is true if you are CEX, DEX, in crypto or out of crypto. So let me unpack how liquidations work on Backpack.

Firstly, we must acknowledge that it is industry standard to run your own market maker. For better or worse (in the context of FTX, clearly for better), at Backpack, we don't. There's good things about this. There's bad things about this. But there's two interesting second order effects in liquidations:

We don't have any incentive to liquidate our users (other than to stay solvent obviously)
We have no reason to keep the liquidation flow to ourself.

Our incentive is to save users as much as we can and to be as fair as possible throughout the process. To be clear, I don't think most exchanges are malicious, nor do I think most are "hunting stops" or anything like that. But I do think this marginal incentive matters and influences system design quite a bit.

In short, Backpack tries to be as friendly and as fair as possible during liquidations, where we try as much as we can to liquidate all positions directly on the order book for anyone to trade against. In fact, amidst, this week's historical volatility, 99.82% of all our liquidations have happened directly on the book - with only 0.18% happening on the backstop and 0% happening via the ADL. This is perhaps the best load test one can ask for and tells me that we can start responsibly increasing leverage even more. Honestly, 99.82% on the book is too much, as we are being too conservative with leverage - but this will naturally come down as open interest continues to climb and liquidation volume increases.

At high level, Backpack has a three part waterfall:

Liquidations on the Book
Liquidations on the backstop.
Liquidations via auto deleveraging.

This type of waterfall is standard in exchange today - both crypto and traditional finance. Every step of the waterfall is needed to ensure system solvency but the details in every step vary exchange by exchange.

On Backpack, the algorithm is roughly as follows:

When we detect your MMR hits 100%, we lock down your account, cancel all open orders, repay borrows immediately, and begin the liquidation protocol.
Starting on the order book, we liquidate part of your position at any given time, slowly but surely chipping away at it so as not to cause an inordinate amount of price impact - and so as to not fully take you out, if possible. We do this across all symbols for which you have open positions in parallel. Slowly, but surely bring down your account back to health.
When deciding how much we can liquidate on the exchange at any given point in time, we take a depth measurement directly from our order book, and only liquidate the available depth within some tolerable impact distance. This ensures we don't completely annihilate the outstanding liquidity on the book, we allow it to constantly refresh itself as we chip away your positions, and ensure we don't allow the liquidated user to get rekt by getting filled by stink orders.
Even if the above goes haywire, we have market protection price bands to protect orders. This includes price impact bands, a moving average on the mark price as a band. If the market suddenly goes haywire, instead of getting filled at horrible prices, the market will protect you by simply rejecting the really bad liquidation orders and you will just hold the position as the market moves. This is safe because we have backstop to fall back to it in the event the market keeps moving against you.
If we are unable to liquidate a user's position on the book, we skip the order book and go directly to the backstop, where we hand over positions directly to market makers that participate in the backstop liquidity program. This program is open for folks to participate. Ultimately the backstop is there to absorb cascades. Even if the market is getting decimated, the backstop catches the positions and absorbs the risks - and making a healthy profit that does not affect the rest of the market. This is a last ditch effort to liquidate the user in a way that does not affect the rest of the market. If we run out of room on the backstop, then the system gracefully falls back to auto deleveraging.
ADL is the base case, so to speak. And any perps exchange running without it is like driving without seat belt. If you crash, you are in trouble. We liquidate positions against any outstanding open positions on the other side. This experience SUCKS for users, but it is a necessary protection in the worst case scenario. Our algorithm for auto deleveraging diverges from other exchanges: We sort by margin fraction ascending, find all open accounts + positions, on the opposite side of you with an outstanding delta and bring their delta to zero. Most other exchanges do ADL position selection by sorting by margin fraction + unrealized profits, but we opted for this. Why? Well from, first principles, delta is the correct measurement of risk. So if you bring delta to zero, you bring system's risk to zero, which is our first goal in a volatile market. The beauty of auto deleveraging is that, even if all liquidity completely drops from the market, everything winds down in an orderly fashion -- and in most extreme possible case, bringing open interest back to 0.