Flash Crash Protection

The 8 Defence Flash Crash System

Use of multiple price sources in our Index.
Use of exponential moving average on the difference between our futures and index price.
Trade Bandwidth around the mark price of the instruments.
Caps on the max deviation between a futures price and the index price.
Incremental liquidation so any impact on a non-genuine move is limited but also this would not create a liquidation cascade as is possible on other native crypto exchanges.
A circuit breaker of 10% in two calculation cycles due to gap risk whilst crypto is trading on other exchanges.
Using the implied option synthetic.
Interpolation from the expiries around.

Method

The first line of defence comes from the use of multiple price index sources for our Index.
We take mid prices from the bid/ask feed from the above exchanges.
We then calculate the median of these prices and calculate a Min Price of 0.5% below the median and a Max Price of 0.5% above the median.
The next step is calculating the Price Used of each source which is the Mid Price if the Mid Price is between the Min Price and Max Price, or the Min Price if the Mid Price is below the Min Price, or Max Price if the Mid Price is above the Max Price.
Finally, we calculate the weighted average of the Price Used with the Weights to give the final Index value.
If only 2 index sources are available if the difference between them is more than this value we'll lock the index price on the platform.

Impact

If one exchange dropped to close to 0, that would result in a minimal impact - just a 0.1% drop in the BTC index.
If two exchanges dropped to close to 0, that would also have a minimal impact with just a 0.2% drop.
There would need to be a flash crash on 3 exchanges to have a flash crash on the Deribit Index

The second line of defence comes from the use of an exponential moving average.

An exponential moving average (EMA) is a moving average that gives more weight to recent price changes.
We use an EMA between the difference of the Futures price and the Index price.
If there is a sudden change in the futures bid/ask and hence mid-price without the index moving, the futures would take at least 60 seconds to move from the current price to that target price.
This means a flash crash would have to exist for a relatively long period of time, given our index's first line of defence before it can start to significantly impact the futures price. Once this period has passed, it then could even be considered that the new price is a genuine price change across crypto markets.

The third line of defence comes from the use of trade bandwidths.

The trade bandwidth creates a minimum sell price below the mark price and a maximum buy price above the mark price.
This means that orders can’t trade beyond this bandwidth at any moment in time which adds another layer of price protection, as well as protection against mistrades.
If liquidity in the book is not sufficient to absorb a large market order, the market order can only go as far as the bandwidth.

The fourth line of defence comes from the use of max deviation caps.

This is a cap on the maximum deviation that can occur between the index and the future.
In the example parameter setting on the right, this means the future mark price can’t deviate by more than 5% from the Index price hence reducing the impact of a potential flash crash.

The fifth line of defence comes from the use of incremental liquidation.

Forced reductions of positions, and liquidations, often happen during peak stress of the market.
Incremental Liquidation means that only a portion of a user’s position is liquidated when the maintenance margin is breached (rather than the full position).
If not sufficient liquidity on the instrument, we would hedge risk using the perpetual which is the most liquid instrument on Deribit.

The sixth line of defence comes from the use of circuit breakers.

A circuit breaker is a momentary pause in trading.

We have a circuit breaker for a 10% index move in 2 calculation cycles which generally equates to 2 seconds.
We intentionally keep this wide since if an actual legit move happens, we are left with a halted platform and carry the gap risk while crypto trading still goes on at other exchanges. This can result in us liquidating users at worse prices.
Once a circuit breaker is triggered, a 1 min platform trading halt takes place. After 1 minute, an automated check is performed on the index, and if for a subsequent 30 seconds, the index is stable again, trading is enabled. Otherwise, it remains disabled until it is manually enabled again.

The seventh line of defence comes from the use of the information in the option bid and asks.

We use the information of the implied option synthetic in the future mark price calculation. This effectively adds liquidity for the purpose of the futures mark price calculation.
So even if during a crash, the future order book widens significantly, we still have the information from the options to better pinpoint where the mark price is.

The eighth line of defence comes from the use of the futures prices in neighbouring expiries.

This takes into account the forward term structure to further protect from flash crashes.
So if one futures expiry widens significantly, we still have the information from the futures around to better pinpoint where the mark price is.