The margin account
One account, one basket, one requirement at every hour: how collateral value, the debit and the margin figures are computed, what each figure gates, and what the desk cannot protect the basket from.
Custody
Every asset you deposit or buy is held by the MarginAccounts contract and booked to your address; there is no pooled wallet and no rehypothecation of your basket. The router takes custody only transiently inside a fill transaction, and assets leave the contract through exactly two doors: a withdrawal you sign or a sale. Your debit is a ledger entry against the same contract, marked continuously against the interest index of your staking tier, one index per tier (see interest).
The five figures
The desk describes an account with five numbers, all computed by the risk engine from per-class margin weights at Chainlink marks. There is a single initial and a single maintenance requirement for the whole basket: rates are set per asset, but the requirement is aggregated and tested once. No position is isolated and no asset is closed out on its own, and none of the five figures depends on the time of day.
| Figure | Definition |
|---|---|
| Collateral value, CV | Sum of quantity times mark over every asset held, including USDG. Each position is floored; USDG is never marked above 1.00. |
| Debit, D | USDG drawn from the vault plus accrued interest, marked at the current index and rounded up. |
| Equity, E | CV minus D. Can be negative. |
| Initial margin, IM | Sum of position value times that asset's initial margin rate, rounded up per position. Gates buys and withdrawals. |
| Maintenance, MM | Sum of position value times the maintenance rate, rounded up. Falling below it opens a maintenance call. |
Rounding always favours the requirement: value floors, requirements round up, buying power floors. An account can never round its way past a margin test. The per-class rates, one initial and one maintenance each, standing at every hour, with what the launch set lists in each class (the stock tiers are decided by measured depth: a stock token whose pinned pool bears less than 50,000 USDG inside the forced sale budget is tier B, and tier A at that line or above):
| Class | Initial margin | Maintenance |
|---|---|---|
| USDG | 0% | 0% |
| ETF tokens (5 listed at launch) | 40% | 25% |
| Stock tokens, tier A (16 listed at launch) | 50% | 30% |
| Stock tokens, tier B (4 listed at launch) | 60% | 40% |
| ETH, as WETH (1 listed at launch) | 35% | 25% |
| Majors (no member listed at launch) | 40% | 27.5% |
| Treasury tokens (no member listed at launch) | 10% | 5% |
A class with no member listed at launch keeps its rates so a listing can be added later without a change of logic; nothing on the desk carries it until one is. The full parameter set, including setter bounds, lives on the parameters page.
Buying power
A buy draws USDG buying power: your account cash is spent first and only the remainder draws the vault, raising your debit. Because the purchased asset lands in the basket and raises IM by its own rate, buying power is quoted per target asset:
BP(b) = max(0, XE) / im(b)
A buy or swap settles atomically and then must leave E at or above IM on the post-fill basket, or the whole transaction reverts. The quote is additionally capped by your account cash plus what the vault can currently extend, bounded by the vault's available cash and utilisation ceiling.
One requirement, every hour
The desk trades on chain around the clock, so nothing in the margin math consults a session clock or a calendar. Each asset carries exactly one initial rate and one maintenance rate, and both apply identically at 3am on a Sunday and at noon on a Tuesday. There is no stricter off-hours basis on buys, no uplift before a weekend, and no hour at which a held position is re-weighted. The requirement you were quoted when you opened a position is the requirement it carries for as long as you hold it, and it moves only when prices move or governance changes the rate.
The risk engine takes one argument, the account, and returns one initial and one maintenance figure for the whole basket. A buy is tested against that same pair, whatever the asset and whatever the hour.
Account states
| State | Condition | What changes |
|---|---|---|
| Healthy | E ≥ IM | Everything allowed. |
| Restricted | E below IM but at or above MM | Buying power is zero and withdrawals that would keep E below IM revert; nothing is sold. |
| Maintenance call | E < MM | A call opens with a grace window; buys and withdrawals are blocked until it cures. |
| Bad debt | CV is zero with a debit still open | The remainder is written off through insurance, then vault NAV. |
Calls, grace tiers, the hard floor and forced sale mechanics have their own page.
What blocks what
- Deposits are allowed in a call, in a forced sale, under every pause. They only ever help, and a deposit that restores E ≥ IM cures a call on the spot. The one thing that refuses a deposit is the desk-wide exposure cap on the asset: every account together may hold at most the cap of it, valued at the mark, and a deposit or buy that would take the desk past that is refused. The cap is shown on each asset's page.
- Sells are allowed in a call and with a delisted asset. They are refused in three cases: the instant a forced sale is executing on your account, while the asset carries the automatic venue halt a failed desk fill raises (see trading), and while the guardian's router halt is set on it, so an account in a call cannot cure by selling a halted asset. Sell proceeds pay the debit down first; only the surplus lands as account cash.
- Buys are blocked in a maintenance call, during a forced sale, during a USDG depeg pause, under the guardian's buying power pause, while the asset carries either halt, while its listing is set to buys blocked or delisted, past the asset's desk-wide exposure cap, and when the draw would pass the vault's utilisation ceiling or the claim queue exceeds vault cash.
- Withdrawals must leave E ≥ IM on the reduced basket and are blocked during a call. Withdrawing USDG additionally requires a clear debit: cash never leaves the account while anything is owed. During an incident a guardian can hold every collateral withdrawal for up to 72 hours, after which anyone may lift the hold.
Worked example: an example book
An example book holds 5 ETH at $3,000 and 60 AAPL at $200, the AAPL bought entirely on margin. At ETH rates of 35% / 25% and tier A stock rates of 50% / 30%:
D = $12,000
E = 27,000 − 12,000 = $15,000
IM = 0.35 × 15,000 + 0.50 × 12,000 = 5,250 + 6,000 = $11,250
MM = 0.25 × 15,000 + 0.30 × 12,000 = 3,750 + 3,600 = $7,350
Equity clears IM by $3,750 of excess, so the account is healthy with $7,500 of tier A stock buying power, and it sits $7,650 above the maintenance requirement. These are the protocol spec's worked-example figures, and the test suites pin them to the cent. They are worked with the desk fee off; at the 0.20% the desk charges on a trade, the largest tier A buy that settles is $7,485, because the fee comes off the notional before the asset lands, and that is the buying power figure the desk shows.
Everything above reduces to E against MM. Prices move CV, interest ticks D up every second, and the moment E drops below MM a call opens. The overview and positions pages track this margin of safety live, and a call bar appears on every screen once a call or forced sale is open.
What the desk cannot protect you from
Three of the contracts your account rests on are somebody else's, and each carries a power over the collateral in your account that the desk cannot override. This section says what those powers are and what the desk does when one is used, because nothing on the desk can prevent it.
The stock and ETF tokens. Every one of them is a debt security of Robinhood Assets (Jersey) Limited, issued behind one registry the issuer controls from a bare key with no timelock. That registry can pause transfers, per token or for every token at once: while a token is paused, transfer, approve and permit all revert, so deposits, withdrawals, buys, sells and above all forced sales stop for that asset while prices keep moving. It can burn collateral out of MarginAccounts custody, from any holder and even while the token is paused: the desk's ledger still shows the position, the risk engine overstates collateral, and the forced sale reverts on the real balance. And it can upgrade every token's code in one transaction, so every property verified at launch (no transfer fee, no rebase, no holder allowlist) is a snapshot rather than a guarantee.
USDG. The cash in every account and the whole of the vault is an issuer's token too. Its issuer can pause it and can freeze an address, receiving as well as sending; its admin sits behind a timelock, but the pause and the freeze sit on one hot key. A frozen MarginAccounts or CashVault cannot send or receive USDG: no deposits, no withdrawals and no settlements until the issuer lifts it, and a frozen balance the issuer wipes is gone.
$CALL. The token is a launchpad's contract the desk did not write, and the Staking contract custodies whatever you stake in it. The deploy refuses a token that visibly carries a power over its holders, but a power under a name the check does not know, or a fee, rebase or hook inside transfer itself, could still freeze or take staked balances and the reward reserve. Staked $CALL never counts as collateral, so that reach ends at your stake and never touches your margin.
What the desk does. It watches: the api's monitor reads the issuer's registry, every listed equity token, USDG and, once it exists, $CALL for pause, block, freeze, role, upgrade and custody-burn events, and pages the operator as each lands. A paused token stops forced sales in it: a call on an account holding it stays open, the leg is skipped on every sweep, the sale resumes when the pause lifts, and the Risk Council can block new buys of the asset meanwhile. A burn is a loss the desk cannot recover, and there is no on-chain response to it: nothing removes the burned position's value from CV, IM or MM, so withdrawals of other collateral against that value stay possible until the account is in call, the burned leg's forced sale is skipped as a venue failure, which halts the asset for user trades, while the call stays open, and the write-off cannot run while the phantom value stands. What the roles can do is block buys of the asset or delist it, raise its requirements to the ceiling, and pause buying power, withdrawals and the asset's router while the affected accounts are read. The loss is bounded per name by the desk-wide exposure cap, 6 forced sale clips of the asset's measured depth, and until it is written off it sits in the vault's NAV at par, which is why the cash vault page says the same thing from the depositor's side.