Risks
The risks a trader, maker, or vault depositor takes on Subliquid and what limits each one.
Confidential hardware
Privacy depends on the confidential hardware and on the published build it attests to. A flaw in either could expose account state such as positions, orders, and stops, though it would not move funds. Independent operators keep recovery copies of the ledger outside that hardware, so privacy also depends on them keeping those copies private. Infrastructure operators see the IP address, timing, and size of encrypted requests, which could suggest when a connection traded but never its account, side, or price (Privacy).
Settlement
Independent signers check every settlement before custody accepts it. Custody enforces that total balances are conserved but cannot verify each account’s balance on its own, so a colluding majority of those signers could misallocate funds within those totals (Onchain settlement).
Engine availability
If the engine stops, signed actions are refused and feeds stop updating until it returns. Resting orders, triggers, and positions stay as last committed and nothing acknowledged is lost. No mark, funding, or liquidation runs in that time, so a position can meet a price gap when the engine returns. Funds stay in custody throughout.
Chain and USDC
Custody, deposits, and withdrawals run onchain in native USDC. If the chain stops producing blocks, deposits and withdrawals wait until it resumes while trading continues. USDC’s issuer can freeze the USDC held at any address, custody included. Every balance, margin, fee, and payout is in USDC, so if USDC trades below the dollar, everything held on the exchange is worth less in dollars by the same amount.
Oracle and index
Perp prices follow a spot index from seven venues. If fewer than two remain live, the index holds its last good value while the mark follows the book, so a fast move in that time reaches liquidation only once prices return.
SUB perp index
SUB has no outside listing, so the SUB perp indexes SUB's own book and launch pool, which trade less than the major venues and can be moved together. Oracle and mark caps, a 3x leverage limit, and an open interest cap of 20,000,000 SUB bound the exposure (Markets and pricing).
Auto-deleveraging
When a liquidation leaves a deficit, profitable and leveraged positions on the other side can be closed at the previous mark without their owner's action. A holder is never taken below its maintenance margin (Margin and liquidation).
AMM vault
Depositors carry the vault's losses as well as its gains, including losses on positions it takes as the liquidation backstop. Each deposit locks the owner’s shares for 4 days. If losses ever took vault equity below zero, deposits and withdrawals would pause until equity is positive again (AMM vault).
Smart contracts
Custody, the SUB token, vesting, the rewards reserve, the claim contracts, the cross-chain deposit adapter, and the launch pool hook have no upgrade path or admin key, so a bug found later cannot be patched in place. Deposits from other chains also depend on the native USDC transfer between chains. SUB held by the treasury multisig depends on that multisig’s signers (Security and custody).