Silence before the breach.
On August 18, 2025, Kalshi filed a request with the CFTC to list perpetual futures on the MerQube US 500 Index. The system is already live for crypto perpetuals—launched in June 2025, it cleared $1 billion in notional volume in its first week. The market reaction was muted. CME shares rose 1.26%, Cboe up 0.12%. The traditional exchanges are not pricing in a threat. But the code of the perpetual contract—the funding rate mechanism, the index dependency, the liquidation engine—is a known quantity. The real unknown is whether the CFTC will allow this product to exist, and whether the court will let the CFTC decide.
Context: The Protocol Mechanics of a Regulated Perpetual
Kalshi is not a DeFi protocol. It is a CFTC-regulated designated contract market (DCM) that started as a prediction market platform. Over the past year, it has pivoted aggressively into derivatives. In May 2025, it received approval to list perpetual futures on crypto assets. By June, the product was live. Within weeks, Kalshi filed to list perpetuals on gold, silver, copper, and now the US 500 stock index. The product mechanics are standard for the crypto perpetual space: no expiry, a funding rate mechanism that periodically exchanges payments between longs and shorts to keep the contract price anchored to the index, and a centralized order book matching engine. The index source for the US 500 is MerQube, a third-party provider. This is not a smart contract. It is a centralized system with a risk engine, position limits, and CFTC oversight.
From a technical auditing perspective, Kalshi’s architecture is a black box. There is no open-source code, no GitHub repository, no way to verify the matching engine’s correctness or the liquidation logic’s edge cases. The only verifiable data point is the self-reported $1 billion notional volume in week one. Verification > Reputation.
Core: Code-Level Analysis and Trade-offs
Let me break down the critical components of a perpetual contract and assess Kalshi’s implementation based on available information.
1. The Funding Rate Mechanism
The funding rate is the heart of a perpetual. It is a periodic payment exchanged between longs and shorts, calculated as a function of the difference between the perpetual price and the index price. The formula is typically:
funding_rate = clamp((perpetual_price - index_price) / index_price, -max_rate, +max_rate)Kalshi uses a similar mechanism, but the exact parameters—funding interval, max rate, premium/discount calculation—are not disclosed. In my experience auditing centralized perpetual exchanges (e.g., during my 2020 DeFi Summer audit of Aave’s interest rate model), the edge cases in funding rate calculations often arise from extreme volatility. If the index price feed from MerQube is delayed or incorrect, the funding rate can diverge from the true market premium, leading to unfair settlements. The risk is amplified for stock index perpetuals because the underlying equities market is not 24/7. Kalshi’s perpetual will trade 24/7, but the index price from MerQube is only updated during US market hours. This creates a gap: during off-hours, the perpetual price is anchored to a stale index, increasing the risk of manipulation. A single bad actor could push the perpetual price far from the index, then collect funding payments for hours before the index updates. One unchecked loop, one drained vault.
2. The Index Dependency
Kalshi relies on MerQube for the US 500 index. This is a single point of failure. If MerQube’s data feed is interrupted, Kalshi must either halt trading or switch to a backup source. The article does not mention any backup. In traditional finance, exchanges maintain multiple data sources and a fallback mechanism. Kalshi’s risk management around this is unknown. Based on my experience with institutional custody audits (e.g., the Shamir’s Secret Sharing framework I proposed for key recovery), the absence of a documented backup plan is a red flag. Code is law, until it isn’t.
3. The Liquidation Engine
For a perpetual, liquidation is the critical safety valve. When a trader’s margin falls below the maintenance threshold, the engine must close the position. In a centralized order book, this is handled by the risk engine. The key parameters are: initial margin, maintenance margin, and liquidation penalty. Kalshi’s crypto perpetuals reportedly had no major liquidation events in their first week, but that is a short sample. Stock index perpetuals will have different volatility profiles. The S&P 500 has a daily volatility of around 1%, while crypto can swing 10% in an hour. This means the liquidation engine for stock index perpetuals must be calibrated much more tightly to avoid false liquidations. If the engine is too aggressive, it will liquidate positions that later recover, causing customer disputes. If too lenient, counterparty risk accumulates. The optimal parameters are a trade-off between safety and user experience. Kalshi has not published these parameters.
4. The Centralized Infrastructure
Kalshi is not a smart contract. It is a centralized server running a matching engine, risk engine, and database. This means it is subject to server downtime, DDoS attacks, and insider threats. The CFTC requires DCMs to have business continuity plans, but the effectiveness of these plans is only tested during actual incidents. The $1 billion volume in week one suggests the system handled the load, but it does not prove resilience under stress. In the 2022 bear market, I saw multiple centralized exchanges suffer from matching engine failures during high volatility. Kalshi’s track record is too short to assess.
Contrarian: The Blind Spots in the Regulatory Shield
The market narrative is that Kalshi’s CFTC oversight makes it safe. This is a dangerous assumption. The CFTC’s approval of the crypto perpetuals does not mean the product is secure. It means the product meets the CFTC’s minimum standards for market integrity, anti-manipulation, and customer protection. But the CFTC does not audit the code; it audits the processes. The actual security of the system depends on Kalshi’s internal engineering, which is opaque. The CME lawsuit against the CFTC over the crypto perpetual approval adds another layer of uncertainty. If the court rules against the CFTC, the entire approval could be vacated, and Kalshi’s crypto perpetuals could be shut down. This is a binary risk that is not priced into the market’s reaction.
Furthermore, the shift from prediction markets to derivatives changes the user base. Prediction market users are often retail speculators with small positions. Perpetual futures attract professional traders who will test the system’s limits. Kalshi’s risk engine may not have been battle-tested against sophisticated algorithms. The funding rate mechanism, if not carefully calibrated, can be exploited by traders with large capital to manipulate the premium. I have seen this in unregulated crypto perpetuals: a whale pushes the perpetual price to a high premium, then collects funding from short sellers for days. Kalshi’s CFTC oversight may deter such behavior, but it does not prevent it. The CFTC can only act after the fact.
Takeaway: The Vulnerability Forecast
Kalshi’s stock index perpetual is a product innovation, not a technical revolution. The core risk is not the funding rate formula or the order book—it is the dependency on a single regulator and a single index provider. The CME lawsuit will determine the product’s viability. But even if the CFTC approves and the court upholds, the real test will be the first major volatility event. Will the liquidation engine hold? Will the index feed survive a flash crash? Kalshi has not provided the data to answer these questions. The market is pricing in a 0% probability of failure. That is a bet I would not take.