Skip to main content
Risk-Native Semantics (RNS) is the third of Intention’s four protocol-native guarantees. It specifies that the risk pipeline — mark pricing, liquidation triggering, insurance fund accounting, auto-deleveraging, funding settlement — executes as part of the protocol, inside the same atomic execution step as matching.

​
Definition

Let ρ\rho denote the risk pipeline. Under RNS, for every block BB, the execution of the state transition δ(Σ,B)\delta(\Sigma, B) invokes ρ\rho in the same execution session as matching, such that:
  • Risk operations see the same intermediate state as matching operations within the block.
  • Risk operations do not require any external trigger to execute.
  • The entire matching-plus-risk composition commits or aborts as a single atomic unit of δ(Σ,B)\delta(\Sigma, B).
Risk is not a separate contract that reacts to matching. It is part of matching.

​
Why it matters

On a general-purpose chain, matching, liquidation, insurance, and ADL live in separate contracts. That split creates several attack and failure categories the protocol cannot reach into:
  • Keeper MEV. Liquidations are user-submitted transactions executed by keeper bots competing in a latency race. Keepers profit from the race; users pay the friction; sometimes the race stalls under load and positions go unliquidated at exactly the moment liquidation matters most.
  • Governance latency on insurance actions. If the insurance fund is a multisig-controlled contract, topping it up or drawing from it requires human signatures — minutes to hours of delay, or political friction during a tail event.
  • Partial-fill risk. A fill that leaves a taker undermargined is observable between the matching contract and the risk contract. Anything that reads state in that window sees an unsafe state.
  • ADL discretion. Auto-deleveraging counterparty selection done off-chain or via governance-appointed operators invites discretion; with discretion comes challenge.
RNS eliminates these by making risk a protocol-native state machine that runs with matching, not after it.

​
How Intention enforces it

RNS is realized by the atomic execution context of IntentionKernel and by the six protocol-native risk engines that run inside it. Mark price. Each instrument carries an index price (the canonical external observation from the in-consensus oracle) and a mark price (a smoothed, manipulation-resistant settlement reference). Mark price is derived through a median-based combination of multiple candidates — the index, EMA-smoothed combinations of the index and the on-chain book mid, and a book-median — so no single distorted component can drag the mark. Protocol-level clamps bound per-block movement. Margin regimes. Intention supports three margin modes (cross, isolated, portfolio) crossed with two position modes (net, hedged), giving six regime combinations. Each position carries separate long and short quantums, separate IM and MM quotas per direction, a funding-accumulator snapshot, and explicit bankruptcy prices. IM and MM are tiered by position size within governance-tunable envelopes. Liquidation. When a subaccount’s collateral falls below maintenance margin, the protocol itself submits a bankruptcy-bounded forced-close order against the resting book. No keeper bot. No external trigger. No gas auction. Penalties route to the insurance fund. Residuals the book cannot absorb at or better than the bankruptcy price transfer to the fund; if the fund is insufficient, ADL is invoked. Auto-deleveraging (ADL). The loss-of-last-resort mechanism. Opposing counterparty positions are closed at the bankruptcy price, selected by a deterministic scoring rule (roughly pnl_ratio × leverage) auditable from public state. No discretion. Insurance fund. Protocol state, not a multisig. Contributions come from liquidation penalties; withdrawals cover bankruptcy absorption. Target size is a fraction of open interest, with governance-tunable policy within protocol-immutable envelopes. Funding settlement. Funding is sampled at high frequency and settled at scheduled intervals. The rate derives from the mark-index premium, clamped between protocol bounds that prevent unbounded liability under external-market pathology.

​
The unifying property

All six components execute within a single atomic context. A fill triggers a margin check, which triggers a liquidation, which draws from the insurance fund, which triggers ADL if necessary, which produces further margin checks — and the entire cascade commits or aborts as one unit of δ(Σ,B)\delta(\Sigma, B). There is no intermediate state in which a margin breach is observable without the corresponding risk action in progress. Risk is not a reaction to execution; it is part of execution.
RNS depends on PTA: risk state machines access a trustworthy price because the price seen by the liquidation engine is the same price signed by consensus.

​
What this enables

  • No keeper races and no keeper MEV. Liquidation is a protocol action, not a user transaction.
  • Deterministic ADL. Counterparty selection is a function of public state; every affected trader can audit it.
  • Insurance fund under protocol discipline. Contributions and draws are protocol actions recorded on the execution stream, not multisig decisions.
  • No partial-fill windows. A fill that leaves a taker undermargined triggers liquidation in the same execution step.
  • Parameters, not algorithms, are governance-tunable. Mark-smoothing weights, ADL scoring, insurance policy, funding-rate bounds, and IM/MM tiers update within protocol-defined envelopes. The algorithms themselves are protocol-immutable.
RNS is what lets Intention describe its clearing architecture as “decentralized clearing” without hand-waving: the clearing function is fixed in code, not delegated to humans.