Withdrawal and borrow limits

Every withdrawal and every new borrow is checked twice: against the account itself, which has to remain above its initial margin requirement, and against the spot market being drawn down, which has to keep enough of its deposit base intact to serve everyone else. This page is the second check.

Why a market-level check exists at all

Deposits are lent out, so a spot market never holds every token it owes. That stops working when a large share of the deposit base leaves in a short window, leaving the remaining depositors holding claims on a vault that is almost entirely out on loan.

So the protocol caps the rate of change rather than the level. Two bounds come out of the market's 24-hour trailing averages: how far deposits may fall, and how far borrows may rise. Both are market-wide, so an action can be refused because of what everyone else did in the window.

Where it applies

The check runs on every action that draws a spot market down: withdrawals, borrows, transfers between subaccounts or pools, and the sell leg of a swap. It is evaluated on the market's totals after the action. If the resulting position is a borrow both bounds apply; if the account stays a depositor, only the floor on deposits does.

The two bounds

Each bound is the stricter of two calculations, a level check against the 24-hour averages and a utilization check.

Level check

The floor on deposits is the 24-hour deposit average less whatever the circuit breaker allows to leave, which defaults to 2,500 bps, so the default floor is 75% of the deposit average. The ceiling on borrows depends on whether the market is the main pool or an isolated pool, which tolerates higher utilization. Each figure below is measured against the deposit base, the lesser of current deposits and the 24-hour deposit average:

The greater of the first two applies, capped at the hard ceiling.

Utilization check

Separately, the market decides the highest utilization it will be left at: never below its own optimal utilization, and otherwise halfway between the trailing 24-hour utilization and 100%. A market running quietly at 40% may be pushed to 70%; one already at 90% may reach 95%, so the tolerance narrows as the market gets tighter.

Worked example

An illustrative SOL market at $100 holds 200,000 SOL of deposits against 130,000 SOL of borrows, both equal to their 24-hour averages, at an optimal utilization of 80% and the default breaker.

The breaker puts the level floor at 150,000 SOL and the utilization check puts it at 157,576 SOL, so the market has about $4,242,400 of withdrawal headroom this window. A $10,000 retail withdrawal passes without coming near it; a $5,000,000 desk withdrawal is refused, even though the desk's account is far above its margin requirement.

The small-depositor exception

So that a drained market does not trap the depositors who did not drain it, an account is let through when it holds a deposit, has never net withdrawn more than it net deposited, and its balance plus the withdrawal stays under one tenth of the withdraw guard threshold. A market-wide budget bounds total exception outflow at roughly $10,000 per market per window.

The daily deposit cap

Deposits can be throttled too, by the mirror of the level check: a ceiling of the 24-hour deposit average plus a configured percentage per day. It is a per-market setting, and while no percentage is configured the ceiling does not bind. It is only evaluated when the market's deposit level rose, so withdrawals and repayments are never blocked by it. Read the market's deposit-cap parameters for the live setting.

The parameters, and who can change them

Three per-market parameters size everything above, and none of them pauses a market; pausing withdrawals is a separate admin operation, covered in Guard rails.

Withdraw guard threshold. The small-market cutout: deposits below it are never blocked from withdrawal and borrows below it are never blocked from opening. It can never be set above $10,000 of notional.

Withdraw circuit breaker. The percentage of the deposit average that may leave per window, defaulting to 2,500 bps. The warm admin key may keep or tighten it; raising it requires the cold key.

Deposit cap. Sets the daily deposit percentage and its guard threshold together.

If an action is refused

A refusal expires as the market's 24-hour averages roll forward, so the same action often succeeds later. In the meantime:

• Withdraw less. The check is against the market's resulting balance, so a smaller amount may fit.
• Withdraw a different asset. Each spot market carries its own limits.
• Repay a borrow first. Repayments are never blocked, and reducing borrows loosens the check for everyone.