Leverage Descent: Sybill proof OI caps

In March 2025, a trader opened an oversized short in a low market cap memecoin on Hyperliquid at 20× leverage, then moved the price so the position liquidated into the protocol’s market-maker vault. The vault took millions in losses, and Hyperliquid was forced to override the price oracle.

Hmm?

Seems like HLP cant close their $JELLY shorts cus their orders got rejected.

Maybe this is because OI caps have been hit.

Prob worth looking into it ASAP ser @chameleon_jeff @xulian_hl @HyperliquidX https://t.co/jYfnjxuLYH pic.twitter.com/VhLsLYSdsa
— Defi_Maestro ✺ (@Defi_Maestro) March 26, 2025

Every perpetual exchange shares this failure mode: a position too large for the market to absorb, forcefully liquidated into a backstop that can’t clear it.

This is why Perpl introduced Leverage Descent. As forward-looking open interest approaches the market’s cap, maximum leverage falls continuously. Near the limit, positions become heavily over-collateralized and self-insured on liquidation. No backstop draw, no bad debt, and no need to track individual wallets.

Here’s how Perpl’s Leverage Descent would have handled the $JELLY situation:

Background on OI Cap

Open interest (OI) is the total size of all open positions in a market. The cap keeps that total within a sane fraction of the underlying asset, sized against the coin's actual supply and what comparable venues carry, not against how deep the order book happens to be at any moment.

The important distinction: the cap and the descent-bound solvency, not liquidity. A position opened near the cap is so heavily over-collateralized that a price move can't push it bankrupt; on liquidation it simply returns its own collateral. That's why it never needs the book to absorb it. This is the same idea as Hyperliquid's size-based margin tiers and dYdX's open-interest-scaled initial margin, expressed on a permissionless EVM.

Naive Solutions

There are two obvious ways to stop an oversized position. Both work off-chain; both break on a permissionless chain.

Slam the door: reject any order once the market hits the cap. Simple, but it's a cliff: fine until the wall, then legitimate traders are blocked outright, and it says nothing about the position sitting just under the cap that's still only 5% collateralized. It bounds the total, not the solvency of what's inside it.
Lower leverage as you grow: drop a trader's max leverage as their own position grows, the way CEXs and app-chains do it. It works when you know who the account is. On a permissionless chain, you don't: split the position across ten wallets and each stays in the cheap, high-leverage tier, rebuilding the same oversized position with none of the margin. Defending it means detecting and clustering sybil wallets: an arms race you don't win.

The descent, in one curve

Our solution maps a market's forward-looking open interest (the OI the market would have if your order filled) to the maximum leverage you're allowed. Below 90% of the cap, nothing changes. From 90% to 95%, leverage falls linearly to 1×. From 95% to the cap, it falls to 0.01×. At or beyond the cap, it's pinned at 0.01×; you'd have to post about 100× the position's value.

The trader is never "blocked." If a market is in the top 10% of its cap, opening or increasing simply costs more collateral for the same size, shown as a lower maximum leverage. Closing stays free, and existing positions are untouched.

What the descent actually does

It's forward-looking. The leverage cap is computed on the OI the market would have if your order filled; your own size counts. A large order near the cap prices itself out.
It only touches opening and increasing. Closing or reducing a position is never penalized, at any OI. You are never trapped in a position because a market filled up.
Your liquidation price doesn't move. The descent sets the leverage on new size. The maintenance margin on an existing position is fixed when you open it and does not change as the market fills.
It's identity-blind: no sybil detection needed. It reads one number, the market's total open interest, never who is trading. Splitting a position across ten wallets doesn't help: the market's OI is unchanged, so the collateral demand is unchanged. Per-account limits, by contrast, have to detect and cluster sybil wallets just to hold.
Near the cap, a position is self-insured. Because opening near the cap demands so much collateral, any position that exists up there is over-collateralized enough to return its own collateral on liquidation. No backstop draw, no bad debt.

Effective maximum leverage as OI climbs

The same piecewise rule applied to three static leverage settings. Below 90%, the trader gets the market's full leverage; by 95%, every market is at 1×; at the cap, every market is at the 0.01× floor.

A centralized exchange enforces per-account tiers off-chain, trusting the operator. An app-chain like Hyperliquid runs its exchange as native chain logic, so it can add size-based tiers or adjust OI caps by upgrading the protocol itself.

Perpl has neither option and needs neither: on a permissionless EVM, the rule lives in the smart contract and is enforced on every order. Bounding OI relative to supply and descending leverage before the cap gives the same protection, keyed on aggregate OI so it can't be split across wallets.