Margin Architecture
The optional spot-margin extension composes SEAL-authorized funding with public Aave collateral/debt accounting and Uniswap V3 execution. It does not hide Aave position state or disclose private checkpoint openings. The normative behavior is in specification section 15.2.
Accounts and isolation
SealMarginAccount is a deterministic clone with immutable adapter, Aave lender and Uniswap factory. Public and private adapters use separate identities. One account may contain several markets; Aave aggregates collateral, variable debt and health by account address. Separate accounts have separate controllers and nonces.
Pool backing and saver shares are not margin collateral. Neither the SEAL pool nor its vaults grants borrowing power or credit delegation to the margin account. Shared-account liquidation can affect every contributing market in that account; it does not authorize seizure of another account or separate SEAL notes. These isolation properties are tested, not formally proven against every future external state.
Funding and authorization
A private account uses a fresh random ECDSA controller stored in the encrypted account document. Every private action, including first open, requires its controller signature. The EIP-712 AccountMarginAction or AccountMarginBatch binds the action digest and exact checkpoint-update hash. Funded actions use a 71-field pool withdrawal proof and an empty account-only proof. Unfunded actions use an empty funding proof and an 11-field account-only proof. Both prove the position-specific secret owner tag; the checkpoint advances atomically with the action.
Public funding is authorized by its controller wallet, directly or through a signed relayed request, with an existing allowance or supported permit. The public adapter increments the controller revision on every action; the client reuses saved inventory when that revision is unchanged. Authorization binds chain, adapter, pool, account, nonce, deadline, market, amounts, fees, swap limits, health minimums and settlement terms.
Collateral, debt and execution
| Action | Execution |
|---|---|
| OPEN or increase | Fresh funding, flash additional collateral, supply collateral, borrow debt asset, swap to repay the flash loan |
| ADD_COLLATERAL | Supply fresh funds without initiating new borrowing |
| REPAY | Repay variable debt from fresh funds and return excess |
| REDUCE | Flash debt, repay part, withdraw bounded collateral and swap to repay the flash loan |
| CLOSE | Repay selected debt, withdraw permitted collateral and return or retain proceeds |
| SHIELD | Deposit retained private-account proceeds into SEAL |
| WITHDRAW_PENDING | Pay retained proceeds to the explicitly authorized public recipient |
A long holds the traded asset as collateral and borrows its quote. A short supplies quote collateral and borrows the traded asset. Native execution needs a supported direct canonical pool and current reserve eligibility; the ordinary swap route graph is broader.
A solvent close can repay from released collateral without fresh funds. Remaining shared debt, liquidity and repayment costs may prevent an exit. Closing one selected market need not close every reserve. Client close-all builds a separately reviewed sequence against current balances.
Health, interest and oracles
Aave determines collateral factors, reserve caps, variable debt accrual, oracle valuation and liquidation rules. The extension adds no independent fixed leverage cap. UI choices up to 5× long and 4× short are not guaranteed executable levels.
Every OPEN, REDUCE and CLOSE carries a signed minHealthFactor; execution reverts if post-action Aave health is below it. Add-collateral and repay ignore that floor so rescue actions remain available. The execution floor does not prevent later liquidation as prices and interest change.
Current account P&L combines oracle-valued equity, retained proceeds, historical contributions and net returns. It is account-level, not per-market profit. See client valuation in the specification.
Liquidation and settlement
Liquidation is permissionless when Aave's conditions hold. It can seize shared account collateral and is public. Oracle failure, price gaps, changing interest and delayed inclusion can deteriorate health.
Private settlement binds output and refund commitments and minimum shares to the reviewed action. Returned SEAL notes become usable only after the public position action and settlement succeed. Retained pending proceeds stay public account balances until shielded. Small leftovers may be insufficient to mint a share and can cause atomic rejection.
Privacy boundary and MEV
Account/controller addresses, collateral, debt, amounts, direction, adjustments, health and liquidation remain public. Private funding aims to obscure the public-wallet relationship; account reuse links all trades in that account. Intent services can observe request metadata and timing.
Public execution exposes swap terms to MEV. Signed amount/debt/slippage/fee bounds, deadlines, nonces and the health floor bound authorized execution, but do not guarantee good prices, anonymity or inclusion. Proof binding does not conceal external DeFi state.
Failure cases and validation
Invalid authorization, stale nonces, expired terms, unhealthy outcomes, liquidity failure or authenticated-callback checks revert atomically, including note funding and account mutation. Gas can still be charged. A simulation cannot reserve future state.
Flash callbacks authenticate the active Aave request; swap callbacks authenticate the active canonical pool and input budget. Temporary approvals are cleared, and balances are checked against the reviewed operation.
The deployment runbook covers manifests and qualification. See Audits for acceptance status and Margin Risk for the user summary.