For the complete documentation index, see llms.txt. This page is also available as Markdown.

Circuit Breakers

Circuit breakers restrict protocol actions when leverage, solvency, hedge execution, infrastructure, price, or liquidity conditions move outside configured limits.

Every breaker defines:

  • A trigger

  • A response mode

  • The actions allowed while active

  • A manual or automatic resume condition

Breaker state is evaluated on every state-changing call and keeper heartbeat. A quote issued before a breaker trips can still be rejected during acceptance.

Response Modes

Restricted

Only actions that are safe under the specific condition or improve the affected metric are allowed.

Freeze

New quotes, settlement, claims, early closes, LP withdrawals, fee collection, and other outflows stop. LP deposits and mark-worker publications remain available because they add capital or preserve settlement evidence.

Breaker Matrix

#
Breaker
Trigger
Mode
Primary permitted actions
Resume

1

Hedge leverage

Book leverage exceeds max_book_leverage

Restricted

Opens and buybacks that reduce net exposure

Automatic below configured resume level

2

Solvency floor

book_assets falls below solvency_multiplier * marked_liability

Restricted

Buybacks only

Automatic above configured resume level

3

Hedge staleness

Target and actual hedge remain outside the deviation band longer than the persistence window

Restricted

Actions that move the target toward the actual hedge

Automatic when deviation returns inside the band

4

Precompile unavailable

HyperCore precompile cannot be read

Restricted

Claims only

Automatic after the required clean checks

5

Mark shock

Mark change exceeds the configured threshold within its window

Freeze

LP deposits and mark-worker publications

Automatic after the required clean checks

6

Buffer drawdown

NAV per share falls beyond the drawdown limit within its window

Restricted

Actions that do not consume the outflow allowance

Automatic as the trailing window recovers

7

Admin pause

Authorized manual action

Freeze

LP deposits and mark-worker publications

Authorized manual action

8

Mark-worker staleness

No stored reading within the allowed publish intervals

Restricted

Claims only

Automatic after the required clean checks

Breaker 1: Hedge Leverage

hedge_notional is the sum of the absolute notional of the contract's per-underlying net hedge positions. core_equity is the HyperCore account equity, including posted collateral and unrealized hedge profit or loss.

Only actions that reduce net exposure are accepted while the breaker is active.

Breaker 2: Solvency Floor

The multiplier covers residual risk not captured by the position-marking model, including gaps between checks, marking error, and hedge variance.

Only buybacks are allowed because they retire a position below its marked liability and improve coverage. New opens are refused even when they would reduce net exposure.

If Buybacks Do Not Restore Solvency

Breaker 2 detects and contains the condition, but it does not by itself eliminate an unrecoverable shortfall. Claims remain blocked while the book cannot meet its liabilities.

If buybacks and additional capital do not restore coverage, the contract applies the socialized-loss procedure. The positive shortfall is allocated across affected positions according to their share of total position value, reducing claims and buybacks consistently. This prevents claim ordering from determining which users absorb the loss.

Normal processing resumes only after the allocation is finalized and the book satisfies the applicable recovery conditions.

Breaker 3: Hedge Staleness

The breaker trips when D remains above deviation band B for longer than persistence window N. Returning inside the band clears the timer.

An action qualifies only if it moves the target toward the actual hedge. Merely reducing net exposure is not sufficient if it increases the target-to-actual deviation.

Breaker 4: Precompile Unavailable

If the contract cannot read the HyperCore precompile, it cannot safely quote, open, settle, value the book, or adjust its hedge. Claims remain available because a resolved payout is fixed and does not require market data.

During this condition, outflow capacity is measured against USDC held directly by the contract because HyperCore-side assets cannot be read.

Breaker 5: Mark Shock

The contract compares stored mark checkpoints and trips if the move exceeds mark_jump_threshold within mark_jump_window.

This is a Freeze condition because a shock can invalidate normal pricing, marking, and hedge assumptions.

Breaker 6: Buffer Drawdown

The protocol tracks NAV per share between stored checkpoints. Under ordinary hedged movement, hedge profit and loss should offset changes in marked liabilities. A large NAV decline can indicate hedge failure, extreme costs, or an unrecognized liability.

While this breaker is active, claims, buyback quotes, LP withdrawals, and fee sweeps are blocked because they consume outflow capacity. Quoting and opening can continue when otherwise safe.

Breaker 7: Admin Pause

An authorized administrator may place the book into Freeze. Resumption also requires an authorized call.

Breaker 8: Mark-Worker Staleness

The contract measures the time since the most recent stored mark reading. If the mark worker misses X consecutive publish intervals, quoting, opening, and settlement stop.

An in-call reading alone cannot safely establish first-touch order when the historical observation record has a gap. Claims remain available because they relate to positions already resolved.

Combined Breakers

When multiple breakers are active, the strictest response applies. An action must satisfy every active restriction.

For example, if the solvency-floor and buffer-drawdown breakers are active together, the combined restrictions can produce a temporary standstill in which only settlement, LP deposits, and mark-worker publications remain available.

LP and Settlement Rules

  • LP withdrawals are blocked while any breaker is active.

  • LP deposits remain available in every mode.

  • Mark-worker publications remain available in every mode.

  • Settlement is allowed under Restricted modes except mark-worker staleness.

  • Claims are allowed under Restricted modes except buffer drawdown.

  • Settlement and claims both halt during Freeze.

  • Automatic resume thresholds sit beyond the trip boundary to prevent rapid cycling.

Last updated