Encumbrance levels
How much control the Tplus side cross-margin adapter holds over the external account determines how much trust the integration needs:
Today’s integration is credit-limited (observe and veto). Full encumbrance, which enables permissionless cross-margining, is under development.
Adapter binding
A TEE-based adapter holds the connection to the external venue and attests its code like every other Tplus component; the venue credentials it holds never leave the enclave. The user authorizes the adapter with an Ed25519-signed, replay-protected binding for the (venue, account) pair; only the bound adapter can report state for that pair.Credit lines
The user assigns a venue’s value to one Tplus sub-account via a credit line. Additional margin posted to the account is the priced venue balance, capped at the limit. Creating or increasing a credit line is unrestricted; modifying or deleting one in a way that reduces credit must pass an initial-margin re-check.120,000 USD of positive equity and a 100,000 USD credit limit, Tplus counts 100,000 USD.
Margin treatment
Cross-venue credit enters the same margin calculations as native collateral: initial-margin checks price it at the more conservative of oracle and mark price, and liquidation checks use the standard dual-price rules. Venue assets without valid prices, including circuit-broken ones, contribute zero.Withdrawal control
The adapter co-signs withdrawals from the external account. Before signing, the clearing engine simulates the post-withdrawal balance and approves only if every affected sub-account stays above maintenance margin.45,000 USD of MM surplus and an external withdrawal would reduce counted credit by 30,000 USD, the post-withdrawal surplus is 15,000 USD and the adapter can sign. If the withdrawal would reduce credit by 50,000 USD, post-withdrawal surplus is -5,000 USD and the adapter refuses to co-sign.
Venue outages
If the adapter disconnects or the venue becomes unreachable, the venue state freezes at the last known balance and maintenance checks continue to count it, so an exchange outage does not trigger liquidation. A freeze that stays unresolved past its timeout zeroes the venue’s contribution.75,000 USD continues to count during the timeout window. If the outage persists past the timeout, the contribution becomes 0 USD for margin checks until fresh venue state is available.