risk limits
the program checks every limit on this page. a UI cannot be the gate, because requests are permissionless. each limit has a launch value and a compiled bound. an authority can move a value inside its bound and never past it.
leverage
| product | leverage | rule |
|---|---|---|
| Core | 1× to 1000× | at most the instrument's max_leverage, which is capped at 1000 |
| DUST MODE | 5000× or 10000× | a fixed set |
| AI agent key | 1× to 10000× | the cap the owner registers |
a Core leverage is refused if its bust distance would not be positive, which is 1/leverage − bust buffer ≤ 0. the bust buffer is below 10 bp, so every leverage up to 1000× has room.
bet size
| limit | launch value | bound | who sets it |
|---|---|---|---|
| minimum margin | $5 | $1 to $100 | owner or risk keeper |
| max notional of one Core bet | $1,000,000 | up to $10,000,000 | owner or risk keeper |
| max margin of one DUST MODE round | $500 | up to $10,000 | owner or risk keeper |
the launch values are set in initialize. notional is margin times leverage. a bet above the max is refused with NotionalTooLarge, one below the minimum with MarginTooSmall.
the setters keep the numbers in order: the per bet limits stay inside the per wallet limits, and the minimum margin stays under the DUST MODE caps. raise the wallet caps first, then the per bet limits.
open interest caps
each instrument tracks the open size on each side. a bet that would push a side past its cap is refused with OiCap.
- launch default.
max(10 × D0, $100,000)per side. - override. each side of each instrument can carry its own cap. 0 means use the default.
- bound. the risk keeper may set a cap up to
max(20 × D0, $100,000). - timing. open interest is reserved at the request and released at a cancel, a close or a liquidation. a limit order reserves it at the fill.
DUST MODE has its own exposure cap, the sum of margins of live rounds on a side. the default is D0 / 4. the risk keeper may raise it up to 2 × D0. a round over it is refused with OiCap as well.
DUST MODE: switch, cells and rate windows
DUST MODE has three gates, all checked on the request.
- the global switch. off until the owner turns it on. the risk keeper may only turn it off.
- the cell mask. each instrument enables or disables its six cells, one for each leverage and horizon pair. every cell starts off.
- the wallet limits, below.
the cell mask has six bits. the bit number is leverage index × 3 + horizon index, with leverage index 0 for 5000× and 1 for 10000×, and horizon index 0, 1, 2 for 5 s, 15 s, 60 s.
| bit | cell |
|---|---|
| 0 | 5000×, 5 s |
| 1 | 5000×, 15 s |
| 2 | 5000×, 60 s |
| 3 | 10000×, 5 s |
| 4 | 10000×, 15 s |
| 5 | 10000×, 60 s |
setting a bit is owner only. clearing bits is owner or risk keeper. a cell that is switched off after a request still settles. the mask only gates new requests. a refused request fails with DmCellDisabled.
on devnet the masks are BTC 52, ETH 54 and SOL 62. that is bits 2, 4, 5 for BTC. bits 1, 2, 4, 5 for ETH. bits 1 to 5 for SOL. mainnet masks: set at launch.
the rate window
a wallet can send only so many DUST MODE requests in a fixed window:
- the window is 60,000 ms and starts at the wallet's first request after the last window ended
- the default is 12 requests per window. the bound is 1 to 600
- the rate check comes first, so a wallet that breaks both limits sees
DmRateLimit
per wallet limits
one wallet has one UserAccount, so these bind the owner, a session key and an agent key alike. they bound a single wallet. they do not bound many wallets. that is the job of the open interest caps.
| limit | what it caps | launch value | bound |
|---|---|---|---|
| live DUST MODE margin | the sum of margin of one wallet's live rounds | 4 × max DUST MODE margin = $2,000 | from the minimum margin up to $100,000 |
| DUST MODE rate | rounds per 60 s window | 12 | 1 to 600 |
| concurrent Core notional | open, pending and pending close notional of one wallet | 3 × max notional = $3,000,000 | from the max notional up to $100,000,000 |
refusals: DmWalletMargin, DmRateLimit, WalletNotional.
- the owner may set any value inside the bound. the risk keeper may only lower.
- lowering a limit below what a wallet already holds does not touch its open bets. it only refuses new ones.
- a resting limit order holds no open interest and no wallet notional until it fills.
- the counters are released wherever the bet's open interest is released, and the release can never fail.
haircuts
the trim on a Core win is the haircut. it has a ceiling b of 10%, bounded at 20%, and a 0.2 bp deadband bounded at 2 bp. the full curve is in impact PnL.
DUST MODE has its own haircut per cell. the compiled bounds are the same for each of the six cells:
| per cell value | bound |
|---|---|
| deadband | 0 to 1 bp |
b | up to 2000 bps |
c | up to 50,000,000 of FP, which is 0.5 bp |
a DUST MODE round can win or lose at most its margin, so the house has no gap risk on it.
the execution lookback
a take profit, a stop loss or a limit fill is a tick presented after the fact. the program bounds how old that tick can be.
tick time + lookback ≥ max(hwm, clock_ms) else TickNotRecent- the bound is 200 to 3000 ms. the program default is 500 ms. the devnet listing is 1000 ms.
- a fill or an execution at an exact price is an option in the trader's favour. so it is time limited. the lookback bounds how long the option lives.
- the owner sets it with the other timing values. the mainnet value comes from the measured landing time of the order keepers, rounded up to 100 ms, plus 100 ms. mainnet value: set at launch.
timing bounds
| value | bound |
|---|---|
delay D | 1000 to 5000 ms. the risk keeper or the owner can set it |
guard G | 0 to 3000 ms |
G + D | at least 2000 ms, always |
| tick grid | 50, 100, 200, 400 or 1000 ms, equal to the feed's channel |
| max future tick | 1000 to 10,000 ms |
| freshness gate | 1 to 10 slots |
| hard cancel | 60,000 to 3,600,000 ms |
| limit order life | 5 s to 24 h |
| session key and agent key life | at most 30 days |
the pause guardian
the guardian is a hot key with two powers, both one way:
- close the opens gate. this blocks new bets, DUST MODE rounds, limit orders and limit fills. the guardian cannot reopen it. only the owner can.
- retire an instrument. permanent. the guardian presents a verified tick at or after the hwm, and that price becomes the frozen price.
it cannot change a parameter. it cannot touch a balance. what a retire does to open bets, orders and rounds is in settlement and keepers.
never pausable: withdraw, harvest, closes and settles, liquidations, claims.