# Cross-Collateral Design Study — Spot+Perp DEXs (2026-05-27)

Competitive research into how leading spot+perp venues handle **multi-asset collateral**, with a
recommendation for marginX. Companion to [`MULTI_COLLATERAL_DESIGN.md`](./MULTI_COLLATERAL_DESIGN.md)
(the implementation design & staged plan).

Venues studied: **Hyperliquid, Drift, Lighter, Pacifica, Extended, Orderly, Binance (Multi-Asset +
Portfolio Margin), dYdX v4, Backpack, Paradex, Aevo.**

---

## 1. Executive summary

**No production venue settles perpetual PnL in non-USD assets.** "Full cross-collateral settlement"
(paying PnL in BTC/ETH) does not exist anywhere studied. Two reasons every venue avoids it:
1. **Correlation risk** — if PnL settled in volatile collateral, a position's loss and its collateral's
   value drop coincide, leaving the protocol under-collateralized exactly when it can least afford it.
2. **Accounting/oracle explosion** — every settlement (funding hourly, PnL on every fill) would need an
   oracle read and a multi-asset conversion.

Everything reduces to a **USDC numeraire**. The real design spectrum is **three models** that differ only
in *how non-USDC collateral is drawn down to cover a USDC-denominated loss*:

| Model | Mechanism | Venues | Capital efficiency | Added risk |
|---|---|---|---|---|
| **1 — USDC-only** | only USDC is collateral; PnL & margin both USDC | dYdX v4, Paradex (today), Hyperliquid *classic* | low | none beyond position risk |
| **2 — Multi-asset margin, USDC-settled, auto-convert** | non-USDC = haircut-valued collateral; loss → negative USDC; at a threshold sell collateral on the venue's own book at oracle×liq-factor | Binance Multi-Asset, Aevo, Extended, Orderly, Lighter, Pacifica | high | collateral/PnL correlation; convert-at-worst-time |
| **3 — Multi-asset margin, USDC-settled, auto-borrow** | loss → borrow USDC against collateral (interest), convert only as last resort | Backpack, Pacifica (implicit), **Hyperliquid Portfolio Margin** | highest | + lending utilization & borrow-rate risk |

> Model 3 = Model 2 + an auto-borrow layer. They share ~80% of the implementation; Model 3 only adds the
> "borrow USDC against collateral before selling" step (which marginX's lending/UnifiedMargin system can back).

---

## 2. Where each venue sits

| Venue | Spot+Perp unified? | Perp collateral | Model | Settlement |
|---|---|---|---|---|
| **Hyperliquid (classic)** | mode-dependent; separate engines by default | **USDC only** | 1 | USDC |
| **Hyperliquid (Portfolio Margin, 2026)** | yes, one portfolio | USDC, USDH, BTC, HYPE | **3** (auto-borrow up to LTV) | USDC |
| **Drift** | yes (single cross-margin acct) | USDC, SOL, LSTs, BTC, ETH | 2/3 hybrid (keeper inherits) | USDC |
| **Lighter** | yes (UTA; spot newer) | USDC + ETH (first non-USDC, cap 2000 ETH) | 2 | USDC |
| **Pacifica** | yes (spot collateral in cross) | USDC + spot BTC/ETH/SOL/majors | 3 (implicit borrow) | USDC |
| **Extended** | perp-only (spot roadmap); unified margin live | USDC, USDT, wBTC, ETH, vault-shares, EURC | 2 | USDC |
| **Orderly** | spot+perp infra; perp uses margin | USDC, USDT, ETH | 2 | USDC |
| **Binance Multi-Asset Mode** | no (futures wallet) | BTC, ETH, BNB, SOL, … + stables | 2 | USDT/USDC |
| **Binance Portfolio Margin** | spot+futures+options risk-netted | 360+ assets | 2 | USD-stable |
| **dYdX v4** | perp-only | **USDC only** | 1 | USDC |
| **Backpack** | yes (true unified) | USDC, USDT, BTC, ETH, SOL, … | **3** (auto-borrow) | USDC (realized ~10s) |
| **Paradex** | perp+options (spot roadmap) | **USDC only (live)** | 1 | USDC |
| **Aevo** | perp+options | USDC, aeUSD, USDT, ETH, WBTC, weETH | 2 | USDC |

---

## 3. Per-venue detail

### Hyperliquid
- **Classic:** USDC-only perp margin (contracts USDT-denominated but margin/settlement USDC). Spot↔Perp are
  separate engines; funding perps needs an explicit `usdClassTransfer`. Cross/Isolated/Strict-Isolated modes.
- **Portfolio Margin (pre-alpha ~Mar 2026):** eligible collateral USDC/USDH/BTC/HYPE; non-stables back
  positions at LTV (HYPE 0.5). Borrow oracle = `median(spot, mark×USDT/USDC, oracle×USDT/USDC)` (3-way median,
  manipulation-resistant). **Liquidation threshold = `0.5 + 0.5·LTV`** (HYPE → 0.75). Auto-borrows USDC up to
  `balance·price·ltv`. Per-asset & per-user **caps** (e.g., HYPE supply 10M, BTC 4k). USDC-settled.
- **Incident — JELLY (Mar 26 2025):** a self-liquidated short passed to the HLP backstop vault while spot
  JELLY was pumped ~250%, leaving HLP ~$12M underwater; ADL didn't trigger; resolved by validator **oracle
  override**. Fix: **cap on HLP's liquidator component**. Lessons: uncapped backstop + thin spot liquidity +
  manipulable oracle = catastrophic; own-token (HYPE) collateral = reflexivity risk.

### Drift (Solana)
- Multi-asset cross-margin (USDC/SOL/LSTs/BTC/ETH) in **risk-segregated pools**. Single unified account; spot
  deposits directly back perps. **Two-tier asset weights** (USDC 1.0; SOL initial 0.80 / maintenance 0.90).
  **IMF dynamic de-weighting by size:** `weight = min(0.80, 1.1/(1+0.003·√collateral))`. USDC-settled (per-market
  PnL pool). Liquidation = **keeper inherits position/collateral at a discount** (`liquidate_perp_pnl_for_deposit`),
  partial+throttled, halted if oracle deviates ≥50% from 5-min TWAP. Backstop: external Insurance Fund →
  internal (vAMM profits) → socialized loss. Isolation via **subaccounts**. (v1→v2 rebuild after 2022 risk event.)

### Lighter (zk-rollup on Ethereum)
- Perp DEX, spot newer (UTA unified margin). Multi-asset margin launched with **ETH** (global cap 2000 ETH).
  `TAV = USDC + Σ LTVⱼ·balⱼ·priceⱼ` (opening/health), `TALT = USDC + Σ LTⱼ·balⱼ·priceⱼ` (liquidation), with
  per-asset **LTV / LT (≥LTV) / LF (liquidation floor) / liquidation-fee cap + supply caps**. Multi-asset = cross-only.
  USDC-settled. Liquidation **sells collateral via IoC orders** at `IndexPrice × LF`. Exact ETH LTV/LT/LF not
  published in prose docs.

### Pacifica (Solana)
- Spot + 35+ perps. **Cross margin pools USDC + perp uPnL + LTV-adjusted spot collateral** into one equity;
  **implicit USDC borrowing** when `equity_without_spot < 0` (utilization-based APR, kink at 80%). Documented
  **LTV: BTC/ETH 0.90, majors 0.80; $10k/asset/user cap**; hedge bonus. USDC-settled. Liquidation: sell spot on
  book → perp tiers: market order → **backstop vault** → **ADL**. Pool deleverage at 95% utilization.

### Extended (Starknet)
- Perp-only (spot/lending roadmap); unified margin + internal money-market live. Collateral USDC/USDT/wBTC/
  ETH/vault-shares/EURC with **two contribution factors** (equity vs available-balance): USDC 100/100, USDT
  95/90, wBTC 90/80, ETH 90/80. USDC-settled; negative USDC → money-market borrow (interest ~15 min). Cross
  default; isolation = up to **10 separate trading accounts**. Liquidation: **spot collateral first** (20%
  chunks, $1k min) → **Community Vault buys at bankruptcy price → Dutch auction (0%→~10%)**. Vault = MM +
  insurance + auction buyer + (future) lender, with per-market daily-drain caps (≤5%/day global).

### Orderly (omnichain orderbook)
- Spot+perp infra; perp uses margin. Collateral USDC/USDT/ETH with **base weight + size-scaling discount
  factor** (USDT 0.95 / disc 1.5e-6; ETH 0.80 / disc 7e-6). USDC-settled. Cross + Isolated (true per-position).
  **Auto-convert** collateral when LTV>95% or USDC<−$11k (USDT 0.025% / ETH 3.5% convert fee). Position liq =
  **decentralized liquidators** inherit at discount → Insurance Fund → ADL (offsets top profit/leverage
  traders). Per-chain vaults; only LayerZero messages move, funds never bridge.

### Binance
- **Multi-Asset Mode:** futures-wallet only (not spot-unified). Collateral BTC/ETH/BNB/SOL/… + stables; haircuts
  ~2.5% BTC/ETH, ~5% others, stables ~0.01–1.1%. PnL stays USDT/USDC; a loss = **negative stable balance**;
  **Auto-Exchange** proportionally converts positive assets when deficit < −5k/−10k USDT or −0.1 BTC, or LTV≥0.995.
- **Portfolio Margin:** spot/futures/options risk-netted, 360+ collateral assets, **tiered haircuts by notional**
  (BTC 100→85%, altcoin →0% above caps). uniMMR-based.

### dYdX v4 (Cosmos)
- Perp-only, **USDC-only** collateral & quote. `quoteBalance` may go negative. IMF/MMF scale with notional.
  Cross default; isolation via subaccounts. Simplest/safest; capital-inefficient.

### Backpack
- **True unified cross-margin** (spot + perp + lending one pool). Collateral USDC/USDT/BTC/ETH/SOL/…; lent
  assets count as 100% collateral while earning. `Collateral Value = qty·mark·weight`, weight decreases with
  size. **Futures PnL settles in USDC every ~10s**; deficit hierarchy: redeem USDC lends → **auto-borrow USDC
  against collateral** → convert as last resort. Liquidation at MMR≥100%, partial-first, orderbook + backstop LPs,
  1% liq fee.

### Paradex (Starknet)
- Perp+options; **USDC-only live** (multi-collateral/spot/auto-borrow on roadmap, currently only inside Vaults).
  Cross/Isolated/Portfolio-Margin(beta). USDC-settled.

### Aevo
- Perp+options, no spot. Collateral USDC 100 / aeUSD 100 / USDT 99 / ETH 90 / WBTC 90 / weETH 85 (%). USDC-settled;
  loss = negative USDC; **ordered auto-convert** (USDC→USDT→aeUSD→ETH→WBTC→weETH) at 1 USDC threshold, per-asset
  convert fees. Portfolio margin for hedged books.

### World (world.inc, MegaETH) — the reference for "Model 3 done right" (World's "ATLAS" portfolio margin)
- **Beyond Model 3: full risk-based portfolio margin (World brands it "ATLAS") with cross-product netting + integrated
  under-collateralized lending as the settlement backbone.** Base/settlement = **USDM**; perps always settle &
  fund in USDM.
- **Account health = risk-based valuation (RBV) > 0; liquidation at available margin = 0** (not negative-balance
  auto-convert). If you can't pay funding/loss in USDM: 24h 0-interest loan → else the engine **auto-borrows USDM
  from the lending market** against your basket (auto-borrow is the *native* settlement path, Model 3).
- **Netting by underlying** (standout): 10 ETH spot − 10 ETH perp short → ~0 risk → ~0 margin. Spot+perp+loans net.
- **Shock pricing:** per-asset `risk_price` (vol) + `risk_slippage` (liquidity); `adjHigh = mark·(1+risk_price −
  risk_slippage·sign(bal))`, `adjLow = mark·(1−risk_price − risk_slippage·sign(bal))`; collateral valued at min.
  `AdjustedBalance = holdings − borrowed(+10d interest) + lent·0.98`. Params reviewed quarterly, slow-moving.
- **Lending:** fixed-rate, fixed **10-day** term, **under-collateralized** (pre-fund 10d interest only); lent = 98% margin.
- **Collateral = anything listed in spot** (USDT/USDM/WETH/BTC.b/SOL/HYPE/yield-bearing wiTRY/**vault tokens
  WLP, wlUSDm, wlBTCb**).
- **Liquidation: FULL (no partials), no ADL, bilateral bankruptcies**; all positions sold to USDM via taker orders;
  liquidator ≤1%.
- **Assessment:** the cleanest Model-3 + portfolio-margin design studied; netting is the killer feature. **Do NOT
  copy wholesale:** full-liq/no-ADL/bilateral-bankruptcy and under-collateralized lending are aggressive and
  ecosystem-specific. **Critically, marginX's `src/margin/` module (RiskOracle{riskPrice,riskSlippage,lendingHaircut},
  ShockPricing up/down-shock-min, UnifiedMarginAccount unified RBV, LendingOrderBook 10-day loans) is marginX's
  **Quantum Risk Engine (QRE)** — the same risk-based-valuation approach, already built + audited but NOT deployed
  and NOT wired to perps.** So the World-style endpoint
  (Path B below) reuses existing audited code.

## marginX path choice (informed by World)
| | Path A — perp-local (Model 2) | Path B — activate the Quantum Risk Engine (World-style) |
|---|---|---|
| What | collateral registry + oracle×haircut basket in BalanceManagerVault; liquidate on CLOB | deploy dormant UnifiedMarginAccount/RiskOracle/ShockPricing; perp positions become a component of its RBV |
| Gets you | multi-asset collateral for perps | full portfolio margin + cross-product netting + integrated lending |
| Reuses | RiskOracle params only | the whole audited Quantum Risk Engine module |
| Effort/risk | smaller, incremental | larger — merge two margin systems, deploy lending stack, re-audit union |
| Netting (spot+perp hedge → ~0 margin) | no | yes |

**Recommendation:** Path B is the superior long-term architecture (World validates it; marginX already has the
audited code). Pragmatic sequence: build Path A's foundation (registry + basket valuation — Path B needs it too),
then converge to Path B by wiring perps into UnifiedMarginAccount RBV — but KEEP marginX's safer partial
liquidation + ADL + InsuranceFund (do not adopt World's full-liq/no-ADL/bilateral-bankruptcy), keep USDC base
(not USDM), and keep tight caps + faster risk-param updates for volatile collateral (not quarterly-static).

---

## 4. The three models — pros & cons

### Model 1 — USDC-only (dYdX, Paradex-today, HL-classic)
- **Pros:** simplest; no oracle-priced collateral; no correlation/cascade risk; trivial liquidation.
- **Cons:** capital-inefficient — users must source/hold USDC; idle BTC/ETH can't be margin.

### Model 2 — Multi-asset margin, USDC-settled, auto-convert (Binance/Aevo/Extended/Orderly/Lighter/Pacifica)
- **Pros:** capital-efficient; "use BTC/ETH/MON as margin"; reuses the venue's own spot book for conversion;
  no new lending market; the most battle-tested pattern.
- **Cons:** collateral/PnL correlation (volatile collateral behind volatile positions); conversion happens at
  market price during stress; requires robust haircuts + caps + a reliable oracle.

### Model 3 — Multi-asset margin, USDC-settled, auto-borrow (Backpack, Pacifica, HL-PM)
- **Pros:** most capital-efficient; closest to "cross-collateral" UX; collateral isn't force-sold immediately
  (borrow first), so users avoid realizing collateral at the bottom.
- **Cons:** couples trading risk with **lending-pool utilization + borrow-rate** risk; borrow interest compounds
  losses; utilization caps can block the borrow path in stress (forcing conversion anyway); largest, most
  coupled build to ship safely.

---

## 5. Recommendation for marginX

**Build the Model 2 foundation now; design it so Model 3 (auto-borrow, HL-PM-equivalent) is an incremental
Phase-2 layer.** marginX already owns every primitive:

| marginX has | Used for |
|---|---|
| CLOB **spot + perp** orderbooks | Sell seized collateral on our own spot book (Lighter/Pacifica/Orderly/Extended pattern) — no auction infra |
| `BalanceManager` (token-agnostic custody) | Hold the collateral basket |
| `RiskOracle` + `ShockPricing` | Two-tier weights + worst-case valuation (already governance-controlled) |
| `InsuranceFund` + `BackstopVault` + **ADL** | Backstop hierarchy for bad debt |
| Lending / `UnifiedMarginAccount` | **Phase-2 auto-borrow** → Model 3 |

**Design specifics (best-of-breed):**
- Cross-margin **basket**: equity = Σ `balance_i · oraclePrice_i · weight_i` (+ uPnL − fees), 18-dec USD.
- **Two-tier weights** (initial < maintenance) via RiskOracle: e.g. USDC 1.00, USDT ~0.95, BTC/ETH ~0.90 init / ~0.95 maint.
- **Size-scaling de-weighting** (Drift IMF / Orderly discount) to cap concentration.
- **Per-asset + per-user supply caps** at launch.
- Liquidation: **sell collateral first on the spot CLOB** at oracle×liquidation-factor (Lighter LF floor +
  capped fee), then perp positions, then ADL + insurance.
- Oracle hardening: **3-way median** collateral price (HL) + **oracle-deviation liquidation halt** (Drift
  ≥50%/TWAP). Ties into the open `getPnl`-oracle follow-up.
- **Capped backstop** (HL post-JELLY) — the backstop/insurance cannot overexpose to one liquidation.

**Launch collateral set:** USDC, USDT, BTC, ETH **on all chains**; **MON on Monad only**.

> ⚠️ **MON reflexivity.** MON is Monad's native/gas token — the exact own-token-collateral risk that drove the
> HYPE/JELLY blow-ups on Hyperliquid. Enable MON with a **low weight + tight per-user/global cap**, and exclude
> it from backing MON-correlated markets. It is configured per-chain (the registry simply doesn't enable MON on Arc).

---

## 6. Sources

**Hyperliquid:** [account modes](https://hyperliquid.gitbook.io/hyperliquid-docs/trading/account-abstraction-modes) ·
[portfolio margin](https://hyperliquid.gitbook.io/hyperliquid-docs/trading/portfolio-margin) ·
[margining](https://hyperliquid.gitbook.io/hyperliquid-docs/trading/margining) ·
[JELLY analysis](https://oakresearch.io/en/analyses/investigations/hyperliquid-jelly-attack-context-vulnerability-team-solution) ·
[Halborn](https://www.halborn.com/blog/post/explained-the-hyperliquid-hack-march-2025)
**Drift:** [cross-collateral](https://docs.drift.trade/getting-started/cross-collateral-deposits) ·
[account health](https://docs.drift.trade/trading/account-health) ·
[liquidations](https://docs.drift.trade/protocol/trading/liquidations/liquidation-engine) ·
[insurance fund](https://docs.drift.trade/protocol/insurance-fund)
**Lighter:** [multi-asset margin](https://docs.lighter.xyz/trading/multi-asset-margin) ·
[The Defiant](https://thedefiant.io/news/defi/lighter-unveils-multi-asset-margin-starting-with-eth)
**Pacifica:** [docs overview](https://pacifica.gitbook.io/docs/trading-on-pacifica/overview) · [llms-full](https://pacifica.gitbook.io/docs/llms-full.txt)
**Extended:** [unified margin & balances](https://docs.extended.exchange/extended-resources/trading/unified-margin-and-balances) ·
[liquidation logic](https://docs.extended.exchange/extended-resources/trading/liquidation-logic) ·
[vault](https://docs.extended.exchange/extended-resources/vault)
**Orderly:** [multi-collateral margin](https://orderly.network/blog/MultiColat/) ·
[liquidations](https://orderly.network/docs/introduction/trade-on-orderly/perpetual-futures/liquidations)
**Binance:** [multi-asset mode FAQ](https://www.binance.com/en/support/faq/what-is-multi-assets-mode-and-which-assets-are-supported-29b45c485d664028b9ca1cdf90b24f6f) ·
[auto-exchange](https://www.binance.com/en/support/faq/how-does-auto-exchange-work-in-the-multi-assets-mode-4108bab5e4784a8db0a6b8b88dcb1ccd) ·
[portfolio margin collateral](https://www.binance.com/en/support/faq/binance-cross-margin-collateral-haircuts-4bec9126c021472285b20874f9380dfb)
**dYdX v4:** [margining](https://docs.dydx.xyz/concepts/trading/margin)
**Backpack:** [margin system](https://support.backpack.exchange/exchange/trading/margin-system) ·
[settlement](https://guide.backpack.exchange/trading/settlement-and-realization) ·
[unified cross margin](https://learn.backpack.exchange/articles/unified-cross-margin-accounts)
**Paradex:** [margin system](https://docs.paradex.trade/risk/margin-system) ·
[vaults](https://www.paradex.trade/blog/paradex-vaults-the-future-of-on-chain-investment-management)
**Aevo:** [collateral framework](https://docs.aevo.xyz/aevo-products/aevo-exchange/cross-margin-collateral-framework)

---

*Research conducted 2026-05-27 via parallel web research across official docs/blogs. Facts vs. inference
flagged in the source research; some per-asset weights are configured on-chain and revised at venue
discretion — verify live values before parameterizing.*