Skip to main content
A derivatives trade is a promise that outlives the moment it was agreed. Two parties strike a price, and from then until the position closes each is exposed to the other’s ability to pay. That exposure, not the price, is the hard part of running a market. Traditional markets answered it with an institution: the central counterparty, or CCP. The Clearinghouse keeps the function and drops the institution. It is the component that stands between every buyer and every seller — and it is protocol code executing inside the block, not a company you have to be admitted to.

​
What a central counterparty is for

Without one, exposure is bilateral. Everyone you trade with is a credit decision you have to make and keep making, and the decisions multiply: n participants produce up to n(n-1)/2 relationships, each with its own terms, its own collateral, and its own opinion of what you are worth. A default does not stay where it started, because the party failing to pay you is failing four others at the same time. A CCP replaces that mesh with a hub, by a legal step called novation. The contract between buyer and seller is discharged and replaced by two contracts: the buyer faces the clearinghouse, and the clearinghouse faces the seller. It becomes the buyer to every seller and the seller to every buyer.
Bilateral — n(n-1)/2 exposures
Novation — n exposures
Party A
Party C
Party B
Party D
Party A
Party C
Party B
Party D
Clearinghouse
Each party is a separate credit decision, and a default does not stay where it started.
The hub is buyer to every seller and seller to every buyer: one counterparty to assess, one margin rule, one order in which losses are absorbed.
Four things follow, and together they are the reason the institution exists at all. One counterparty instead of many. You assess one balance sheet rather than everybody else’s, and you assess it once. Netting. Offsetting positions collapse into a single number. That is less collateral to post while the market is calm, and less to unwind when it is not. Margin under a published rule. A hub cannot absorb everyone’s risk unless it collects against it, so it takes initial margin up front and variation margin as prices move — under a methodology participants can read in advance and size themselves against. A default waterfall. When someone does fail, the losses are absorbed in a pre-agreed order: the defaulter’s own margin, then their contribution to a mutualised fund, then the clearinghouse’s own capital, then everyone else’s contributions. The order is the promise. Knowing it in advance is what lets a member price their exposure to the hub itself. This is what markets converged on after a century of trying the alternatives, and it works. It is also why a CCP is a systemically important institution rather than a piece of infrastructure.

​
What the institution costs

Every one of those four benefits arrives attached to a constraint, and the constraints come from the CCP being a company rather than a mechanism. Crypto’s two answers so far have both been worse rather than better. A centralized exchange is a CCP that also runs the market and holds the collateral, with none of the supervision and no way to verify the margin it says it holds. Early on-chain venues went the other way and had no clearinghouse at all: bilateral pools, external keepers, and a liquidation that happens if and when somebody finds it profitable to send the transaction.

​
The same function, without the institution

Intention takes the CCP’s job list and implements it as a component of kernel execution. One row of that table carries more than the others. In traditional markets the CCP and the institution that keeps the record of who holds what — a central securities depository — are deliberately separate legal entities. You do not want the party bearing counterparty risk to also be the keeper of the book that says who owns what, because a private book held by a single institution leaves nothing to check it against. The separation is the check. The Clearinghouse is both at once. It is the counterparty to every position and the only writer of the record. That merge is safe here for exactly the reason the separation existed: the book is not private. Every balance, position, and insurance-fund movement is public state attributed to the transaction that caused it; the waterfall runs at a threshold with no discretion available to anyone; and the whole cascade commits or aborts as one unit of the block. What institutional separation was buying is bought instead by the ledger being readable. None of this claims the protocol is safer than a CCP in every respect. A CCP has capital, a supervisor, and a century of default management practice behind it. What it does not have is a ledger anyone can read while the default is happening, or a waterfall that runs without a person deciding to run it. Those two are what this design buys, and it buys them by making the clearinghouse a function of the block rather than a party to the trade.

​
One writer, and only one

Inside the protocol the Clearinghouse is the only path by which anyone’s balance, position, margin, or open interest changes. Settling a fill goes through it. So do liquidation, auto-deleveraging, funding settlement, and margin reservation. That exclusivity is the design. Modules that hold state — accounts, positions, order books — store data and expose the operations that mutate it, but they do not initiate anything. There is one place where the ledger moves, which means there is one place to audit, one place to instrument, and one place where an invariant can be enforced without hoping every caller remembered it.

​
Formulas are separate from effects

The rules that decide how much are implemented as pure, stateless functions: margin requirements, liquidation prices, deleveraging selection, fee computation, open-interest limits, and leverage tiers. They take values and return values. They read no ledger state and mutate nothing. The Clearinghouse calls them and applies the results.
Risk formulas — pure, no writes
Clearinghouse — the only mutator
Margin
Settle fills
Liquidation
Reserve margin
Deleveraging selection
Liquidate
Fees
Deleverage
Open-interest limits
Settle funding
Account · position · open-interest stateone writer, so a replay cannot diverge
values
writes
Two things follow. A margin calculation can be verified in isolation against a table of inputs and expected outputs, with no chain and no state to set up. And because the formulas are bit-exact fixed-point — with rounding fixed at the arithmetic layer rather than per call site — two validators computing the same requirement get the same integer, not the same number to within a tolerance.
Rounding is part of the specification, not an implementation detail. Margin rounds up where it protects the system; fees floor or ceil according to which side benefits. A node that rounded differently would not be slightly wrong — it would produce a different ledger and fork.

​
Margin and reservation

An account’s capacity is not just its balance. Resting orders reserve capacity against the position they could open, so an account cannot promise the same collateral to two orders and discover the conflict only when both fill. Reservation is maintained by the Clearinghouse as orders are placed, amended, cancelled, and filled, and it is re-derived when a position changes underneath resting orders — which is why reduce-only orders resting against a position that has since shrunk are re-evaluated rather than left stale. Margin is tiered: requirements scale with position size within governance-set bounds, so a position large enough to be hard to unwind carries a proportionally larger requirement. See Margin modes and Leverage for the trading-side view.

​
The default waterfall

This is the CCP mechanism the section above described, with the committee removed. The kernel runs the risk stage in a fixed order before matching, so forced flow is resolved before discretionary flow is admitted. When an account cannot cover its own losses, the shortfall falls through a fixed sequence of absorbers:
The risk stage, in fixed order, before matching
1 · Vault deleveraging
2 · Liquidation
3 · Auto-deleveraging
An account that cannot cover its own losses
Closed against the order bookbounded by the bankruptcy price
The insurance fundprotocol state, funded by liquidation penalties — not a multisig
Auto-deleveraging opposing positionsselected by a deterministic score anyone can recompute
Settled
shortfall remains
shortfall remains
Liquidation is a protocol action. When an account’s collateral falls below its maintenance requirement, the network itself closes the position against the book, bounded by the bankruptcy price. There is no keeper transaction, no gas auction, and no race to be the one who triggers it — which removes both the extraction that races produce and the failure mode where nobody shows up during the exact congestion that makes liquidation necessary. The insurance fund is the protocol’s equivalent of the mutualised default fund, and it is protocol state: funded by liquidation penalties and drawn on to absorb bankruptcies. It is not a multisig, which means topping it up or drawing from it does not require human signatures during precisely the minutes when human signatures are hardest to collect. Auto-deleveraging is the loss of last resort, used when the book and the insurance fund together cannot absorb a bankruptcy. It occupies the position a CCP fills with tear-ups and cash calls on surviving members — with the difference that opposing positions are closed at the bankruptcy price, selected by a deterministic score computed from public state. Anyone can recompute the selection; nobody chooses it. See Liquidations and Auto-deleveraging for thresholds and worked examples.

​
Funding

Funding is sampled continuously and settled on schedule against positions as they stand at settlement, derived from the premium of mark over index and clamped between protocol bounds. Because it runs as a Clearinghouse stage inside block execution, a funding payment is a protocol operation with the same attribution as any other state change — not a periodic sweep by an external process. See Funding for rates, intervals, and how the premium is computed.

​
Why this belongs in the protocol

The alternative — clearing as contracts reacting to a matching engine — creates a window. Between the fill and the margin check, there is a state in which an account is undermargined and something can observe it. Between the trigger and the keeper’s transaction, there is a state in which a position should have been liquidated and has not been. Here the whole cascade — a fill causes a margin check, which triggers a liquidation, which draws on insurance, which may trigger deleveraging, which produces further margin checks — commits or aborts as a single unit of the block. There is no intermediate state in which a breach is observable without the response to it already in flight. That is the property a CCP promises and cannot deliver, because its guarantee lives in a rulebook and its ledger closes at the end of the day. Here the guarantee is the execution.

​
Where to go next

Matching

Where the fills the Clearinghouse settles come from.

IntentionKernel

The stage order that puts forced flow before discretionary flow.

Liquidations

Thresholds, the liquidation waterfall, and what a trader sees.

Funding

Rates, intervals, and premium computation.