Skip to main content
These pages make four claims repeatedly: that a margin calculation can be checked in isolation, that anyone can recompute an auto-deleveraging selection, that funding is derived rather than decided, and that two honest nodes produce byte-identical results. A claim of that shape is worth nothing until someone outside the protocol has run it. This page is how. Each check names the inputs, where they come from, and — as importantly — what it does not establish.
Nothing but arithmetic
Public data, any node
Your own full node
A margin requirement
A liquidation price
An ADL selection
A funding payment
A block, byte for byte
Two of the five need no network at all: the formulas are pure functions over a published tier record.

​
1 · A margin requirement

What you need: a leverage-tier record and a position size. Nothing else. No node, no network, no account. Initial and maintenance margin are pure functions of notional and the tier record, with the formulas and the exact rounding on Leverage: IM=notional×im_leverage×10exponent\text{IM} = \text{notional} \times \text{im\_leverage} \times 10^{\text{exponent}} MM=max⁡ ⁣(notional×mm_leverage×10exponent−deduction,  0)\text{MM} = \max\!\left(\text{notional} \times \text{mm\_leverage} \times 10^{\text{exponent}} - \text{deduction},\; 0\right) The tier records are published in the DEX Config group of the API reference — im_leverage, mm_leverage, the shared exponent, and the per-tier deduction. Pick a notional, evaluate both expressions on paper, and compare against what the venue charges the same position. What it proves: the requirement is a published function of public parameters, not a per-account judgement. What it does not prove: that the tier record is well chosen. That is a governance question, not an arithmetic one.
Rounding is part of the specification, not a tolerance. If your integer differs from the venue’s by one unit, one of the two is wrong — see the rounding rules on the Clearinghouse page before concluding which.

​
2 · A liquidation price

What you need: the same tier record, plus your balance and position. The threshold is a ratio, defined on Liquidations: ratio=maintenance marginnet collateral\text{ratio} = \frac{\text{maintenance margin}}{\text{net collateral}} Net collateral is balance plus unrealized P&L, less what resting orders have reserved. Solve for the mark price at which the ratio reaches its trigger and you have the price the protocol will act at — before it acts. What it proves: the trigger is derivable in advance from your own numbers. What it does not prove: the price you will actually be closed at, which depends on the book at that moment and is bounded by the bankruptcy price.

​
3 · An auto-deleveraging selection

What you need: open positions and marks for one market, from any full node. Selection is a score, defined on Auto-deleveraging: score=unrealized profit %×effective leverage\text{score} = \text{unrealized profit \%} \times \text{effective leverage} Pull the positions in a market from the Accounts group and the certified price from the Oracle group, compute the score for each position on the profitable side, and sort. That ordering is the queue. Compare the top of your computed queue against the ADL indicator the interface shows. What it proves: the queue is a function of public state. Nobody is choosing, and there is no position in it that your own arithmetic cannot find. What it does not prove: that deleveraging will not reach you. A queue you can compute is still a queue you can be in.

​
4 · A funding payment

What you need: the order book and the certified index for the settlement round, plus your position. The rate is built in three steps on Funding — a depth-weighted premium, scaled to the market’s interval, then clamped: P=max⁡(0,  DW bid−index)  −  max⁡(0,  index−DW ask)indexP = \frac{\max(0,\; \text{DW bid} - \text{index}) \;-\; \max(0,\; \text{index} - \text{DW ask})}{\text{index}} F=F8h×interval seconds28,800Ffinal=clamp⁡ ⁣(F,  Fmin⁡,  Fmax⁡)F = F_{8h} \times \frac{\text{interval seconds}}{28{,}800} \qquad F_{\text{final}} = \operatorname{clamp}\!\left(F,\; F_{\min},\; F_{\max}\right) Then the charge itself: funding payment=position size×mark price×funding rate\text{funding payment} = \text{position size} \times \text{mark price} \times \text{funding rate} The book comes from the Markets group, the certified index from Oracle, and the payment the protocol actually made from the funding-payments endpoint in the Accounts group. Recompute and compare. What it proves: the rate was derived from the book and the index, not set by an operator. What it does not prove: that the index was right. See what the oracle does and does not guarantee.

​
5 · A block, byte for byte

What you need: a full node of your own. Anyone can run one — see Run a node.
This is the one check on the page that is not available today. The network is on a private testnet until public access opens, so the first four checks can be run now and this one becomes runnable then. It is listed here because the other four are only as good as this one.
This is the check the other four rest on. Take a committed block and its prior state, execute it, and compare your result against the network’s. Determinism here is enforced rather than hoped for: the execution path reads no wall clock, no runtime entropy, no floating point, and no hash-randomized iteration order, so a divergence is a defect rather than a tolerance. See Why the result is reproducible. Two properties make this a real test rather than a ceremony. The ordering is a consensus-committed object, so the sequence you replay is the sequence a quorum signed rather than one your node inferred. And the prices are committed by the same signatures, so there is no window in which you could replay against a price the network did not certify. What it proves: that the state you are being served was produced by the rules as published, on inputs the network committed. What it does not prove: that the rules are free of defects. Reproducing a bug exactly is still reproducing a bug — which is why audits and the bug bounty exist alongside this.

​
What none of it covers

Verification bounds what has to be taken on trust; it does not eliminate it. What remains — the validator set, the price quorum, governance’s reach over parameters, and the bridge — is enumerated on Trust assumptions. Read that page next if you came here to find the limits rather than the guarantees.

​
Where to go next

Trust assumptions

What is left over once everything checkable has been checked.

Run a node

Hardware, sync, and what a validator actually runs.

IntentionKernel

The four closures that make replay meaningful.

API reference

Field-level detail for every input named above.