Liquidation

Liquidation in Papersol is a hard bust: when a position is liquidated, the whole margin is lost. There is no partial liquidation and no remaining equity is returned.

The bust price is used directly, with no adjustment, when your own close or a retired-market settlement settles. A permissionless liquidate also requires a fresh price within the EMA limit, the confidence-band or underwater-at-mid condition, the timing, pending-close and settlement-pin checks below, and someone sending the transaction. A price merely touching the bust price is not enough.

Bust price

bust_distance = floor(entry × (floor(1e9 / leverage) − bust_buffer_e9) / 1e9)
              ≈ entry × (1/leverage − 0.0005)

bust price  (long)  = entry − bust_distance
bust price  (short) = entry + bust_distance
zero-equity (long)  = entry × (1 − 1/leverage)      ("hard stop" in the app)
zero-equity (short) = entry × (1 + 1/leverage)

bust_buffer_e9 is currently 500,000, which is 0.05% (5 bps). It is a governance parameter and must stay below 0.1%. The bust price is 5 bps of entry before the point where the loss equals your margin.

Leverage	2x	10x	25x	50x	100x	500x	1000x
Adverse move to bust	49.95%	9.95%	3.95%	1.95%	0.95%	0.15%	0.05%
Adverse move to zero equity	50%	10%	4%	2%	1%	0.2%	0.1%

When a position can be liquidated

liquidate succeeds only if all of these hold for the Pyth price update it is given:

1. It is an authentic, fully Wormhole-verified update for the market's feed, with prev_publish_time ≤ publish_time, and it passes the EMA check: |price − EMA| × 10,000 ≤ EMA × 500 (max_ema_dev_bps), compared exactly (Oracle and safety). The confidence limit (max_conf_bps) doesn't apply to liquidations. Confidence matters only through the band rule in condition 6, so a wide band can't keep an underwater position alive.
2. It was published after the update your position was opened at.
3. It is at most liq_max_age_s old (currently 10 s). Age is measured from the later of the Solana clock and the market's newest recorded oracle time, so a lagging clock can't make an old price look fresh.
4. If your position has a pending close, it was published before that close's pin. Otherwise the close you already committed to takes precedence.
5. The market has no final settlement price. If a settlement is pending, it was published before the market's settlement pin: from the pin on, the settlement price decides. A position that busted before the pin can still be liquidated until the settlement executes, which the program allows only after pin + 120 s, when no pre-pin price is fresh enough to use.
6. The position is bust in at least one of these two ways:
   • Bust after the confidence band. The program first moves the price in your favour by Pyth's confidence interval (price + conf for a long, price − conf for a short) and checks the bust price against that. Oracle uncertainty alone never liquidates you.
   • Underwater at the midpoint. ceil(notional × adverse move / entry) ≥ margin: the loss at the plain Pyth price already consumes the whole margin. The confidence band never keeps a position alive past zero equity.

The update can be any qualifying update, not just the newest. A brief print past the trigger within the 10 s window is enough (a wick).

During a move of more than 5% away from Pyth's EMA, no update passes condition 1, so liquidations (and fills) pause until the EMA catches up.

Who liquidates, and at what price

• Anyone can call liquidate, with no reward. The liquidator pays the transaction fee and receives nothing. The position's rent goes back to whoever paid it, which is you or your session key. The Papersol keeper scans every market about once a second.
• The recorded exit is the Pyth midpoint of the update used. Your result doesn't depend on it: you lose the whole margin.

What you lose

• Your entire margin. returned = 0, and raw_pnl is recorded as −margin.
• While the payout queue is empty, 2% of the margin is the loss fee (split between stakers and dev) and 98% goes to the house treasury. While the queue is active, the whole margin goes to the house's side bucket and there is no fee.
• $NOTE is minted on the full margin at the current mint rate. A normal loss mints on the loss minus the fee, or on the whole loss while the queue is active ($NOTE).

Closing past the bust price

Your own close, and a retired market's settlement, also settle as a liquidation if the exit price is at or past the bust price. No confidence band applies to these. A close that fills between the bust price and zero equity loses the whole margin, even though the raw loss would be smaller.

Pending closes and liquidation

• A pending close shields the position from prices published at or after its pin. A bust that happened before the pin can still liquidate it.
• The shield doesn't end when the close expires. It stays until the expired close is cancelled, the close is voided, or the position is closed. The Papersol keeper cancels expired requests automatically. If a position is liquidated while a close request is pending, that request stays behind and still has to be cancelled to recover its escrow. In a settled market, a position with a pending close isn't settled until that close is filled, voided, or expired and cancelled.
• If the close's pinned update is inadmissible, the close can never fill. Anyone can then void_close it, the shield is removed, and the keeper rescans for liquidations right after voiding.

Worked example: 1000x

BTC long, entry $100,000, margin $10, notional $10,000, current parameters.

• Bust distance = 100,000 × (0.001 − 0.0005) = $50, so the bust price is $99,950. Zero equity is $99,900.

Pyth mid	Confidence	Bust after band?	Underwater at mid?	Liquidatable
$99,955	$8	$99,963 > $99,950: no	Loss $4.50 < $10: no	No
$99,945	$8	$99,953: no	Loss $5.50: no	No, but a close filling at $99,945 settles as a liquidation
$99,940	$8	$99,948 ≤ $99,950: yes	—	Yes
$99,900	$150 (15 bps)	$100,050: no	Loss $10.00 ≥ $10: yes	Yes
$99,900	$600 (60 bps, above max_conf_bps)	$100,500: no	Loss $10.00: yes	Yes (the confidence limit doesn't apply)

Outcome of the liquidation: you lose $10. With the queue empty, the fee is $0.20 ($0.10 to stakers, $0.10 to dev), the house gains $9.80, and 440 $NOTE is minted (10 × 44 at the current flat rate; +5% if you were referred).

At 1000x the band rule can only trigger before zero equity when the update's confidence band is narrower than the 5 bps bust distance. With a wider band, however wide, a 1000x position is liquidated by the underwater-at-mid rule, at zero equity. (For scale, the code comments cite about 8 bps as a typical BTC band. That is an observation, not a program limit.)