Hedging and risk
Why filling a trade creates risk
When a user swaps 10,000 USDT worth of NIGHT for ADA on Abyss, there is no second user on the other side. The desk itself takes the other side: it hands over ADA from its own inventory and keeps the user's NIGHT. At that instant the desk's holdings have changed shape whether it wanted them to or not: it holds less ADA and more NIGHT than a second ago.
That new shape is a bet. If ADA rises 2% over the next hour, replacing the ADA the desk just sold costs 2% more, which wipes out a 150 bps margin many times over. The desk never chose to bet against ADA; the bet is a side effect of serving the trade. In trading language, the fill left the desk with directional exposure: its profit now depends on which way the market moves.
The desk offsets that exposure. Within moments of the fill, the system opens an equal and opposite position on an external exchange: exposure to ADA there cancels the ADA it gave away here. If ADA rises, the loss on one side is the gain on the other, and vice versa. The desk's result stays what it was at the instant of the fill: the spread it charged, minus the hedge's cost. This is what market-neutral means, and the offsetting position is the hedge.
The language of positions: long, short, and legs
A position is any holding whose value moves with a price. Being long means being positioned to gain when the price rises: owning a token is the simplest long. Being short is the mirror image: being positioned to gain when the price falls. That sounds impossible with physical goods, but exchanges make it routine: you sell a contract now and buy it back later, and if the price fell in between, the difference is yours. Short positions are what make hedging possible, because they let the desk profit from exactly the move that would hurt its inventory.
And every swap has two legs: the side the desk receives and the side it pays out. Each leg changes the desk's shape independently, and each gets its own hedge. In the example above, keeping the user's NIGHT left the desk long NIGHT, so it opens a short NIGHT position on an exchange; paying out ADA left it short ADA, so it opens a long ADA position. Two legs, two offsetting positions, each placed on whichever configured venue actually lists that asset's perp. Hedge budgets, fees, and reconciliation all operate per leg, because that is the unit at which risk actually arrives. Choosing the venue by live cost (fees and funding compared across every venue that could take the leg, not just the first one configured) is on the near-term roadmap.
The instrument used is the perpetual future ("perp"): a standard exchange contract that tracks a token's price and can be held short or long indefinitely, at the cost of a periodic funding payment, which is one of the costs priced into the spread. Which venues hedge which asset is a live instrument mapping, not a fixed pairing: NIGHT is hedgeable on three of the five connected venues today; ADA and ETH on all five.
Reserving hedge capacity at quote time
Hedge capacity is reserved at quote time, not fill time. Each asset carries an exposure budget: a dollar cap on how much unhedged risk the desk may accumulate in it, computed continuously as the smaller of the operator's configured cap and the free collateral sitting on healthy exchanges right now. A quote that would exceed the budget is refused before the user ever sees a price.
The desk only promises what it can hedge, and it only counts hedge capacity it can see. If every venue for an asset goes unhealthy, that asset's budget drops to zero and quoting stops.
Other constraints:
- Sized within hard bounds. Per-hedge notional floors and ceilings, a leverage cap (default 1x: no leverage unless the operator raises it), and per-venue, per-symbol notional caps set tighter than the exchange's own.
- Priced within bounds. Hedge orders can run as immediate-or-cancel with a maximum slippage versus the exchange's mark price (default 50 bps), so a thin order book cannot quietly fill the desk at a terrible price.
- Batchable on demand. Every fill hedges immediately by default, one for one; an operator can arm a per-asset dead-band so small fills accumulate and hedge together once net exposure crosses a threshold, trading a little timing risk for fewer, cheaper hedges.
- Reconciled always. Recurring jobs poll every venue's account, positions, and orders, and reconcile each hedge against the exchange's own records; a hedge that cannot be confirmed is escalated, never assumed. Fills that cannot be hedged are parked as pending drafts for a human.
- Lifecycle-correct. A hedge is drafted at fill, made permanent at claim, and unwound if the order cancels or expires, so the book never carries a hedge for a trade that did not happen.
When a token has no hedge market
Not every asset the desk might one day list has a liquid perpetual future to hedge against. For those, the design falls back to inventory mode: instead of neutralizing the position with an exchange hedge, the desk holds it under a concentration cap tighter than the general one, and that cap becomes the entire risk boundary for the asset. It trades precision for availability: less exact than a hedge, but it lets the desk list an asset before a venue lists its perp. The mechanism is built; every asset trading today (NIGHT, ADA, ETH) has real perp markets and is hedged the normal way, so inventory mode currently sits in reserve for whatever lists next without one.
P&L
P&L is profit and loss. It comes in two kinds that must not be confused. Realized P&L is the spread actually earned on completed trades, minus the fees, funding, and gas actually paid. It can only be counted. Unrealized P&L is the paper value of positions still open: what the desk would gain or lose if it closed everything at the current market price. It moves with every tick and can evaporate.
The distinction matters operationally: a hedged book shows unrealized swings on each leg that cancel each other, so the health metric to watch is realized P&L, which is what the daily loss stop below counts. Judging a hedged desk by one leg's unrealized loss would trigger false alarms on every market move.
The breakers
Above the per-trade checks, a risk evaluator runs continuously and can halt trading on its own. Each breaker's threshold is an operator setting. Each trips a sticky flag that only a human can lift, so an auto-detected problem is reviewed by a person before trading resumes.
| Breaker | Trigger | Automatic action |
|---|---|---|
| Daily loss stop | The day's realized loss reaches the configured dollar limit | Halt new fills until the next day |
| Concentration caps | One asset exceeds its maximum share of total inventory value, or falls below its minimum | Halt fills; file a rebalance ticket |
| Stablecoin floor | On-chain stablecoin reserves fall below the configured floor | Halt fills; file a rebalance ticket |
| Liquidation distance | A leveraged hedge position's buffer to forced liquidation thins past the configured floor | Automatically reduce the position in steps (default: half per step), using reduce-only orders, before the exchange force-closes it |
| Trade-rate throttle | Fills arrive faster than the configured rate window allows | Pause quoting with a cooldown; abnormal flow is usually an exploit or a bug |
| Venue dead-man | A venue's account data goes stale past the configured age | Trip all layers and mass-cancel resting orders on that venue |
| Collateral floor | Free collateral on a venue falls below the configured minimum | File a top-up ticket; the asset budgets shrink automatically with the free margin |
Orders that reduce risk are always allowed. De-risking, flattening, and unwinds bypass the kill switches and rate caps, so an exit stays open even when everything else is stopped.