KillbotDownload app
← All postmortems
major incident · 2026-04-22

DCA runaway: 22 abnormal risk-stop exits

Same-direction DCA without consensus repetition gating triggered 22 risk-stop exits at -$152.74 cumulative. New hard rule added: same-direction adds require a fresh consensus signal.

Resolved at 2026-04-23T11:42:00Z
Fix commit b59675b3a1c7
Impact −$152.74 USDT

What happened

Between 2026-04-21 18:00 UTC and 2026-04-22 16:30 UTC, the bot executed twenty-two risk-stop exits across BTCUSDT and ETHUSDT positions, with a cumulative paper PnL impact of −$152.74. None of these exits were caused by a market regime change or strategy decision — they were the byproduct of the engine repeatedly adding to losing positions in the same direction without requiring a new consensus signal.

Root cause

src/aggregator.rs allowed same-direction position additions whenever any leader in the pool re-emitted a signal, even if the signal was a stale re-broadcast of the original entry. With 8 active leaders and 30-second polling, this produced an effective DCA cadence of one new fill every 2-4 minutes when a position was open and trending against us.

Once a risk-stop fired, the next leader signal — often within minutes — would re-open the position in the same direction, and the cycle repeated until the leader pool consensus changed.

Detection

Operator noticed the abnormal trade count on the daily report. The risk-stop exit count was 22 on a day with only 4 distinct entry decisions, which is impossible under correct logic. Investigation began at 16:30 UTC.

Fix

src/aggregator.rs:consensus_decision now tracks the consensus signal ID that opened each position. Same-direction additions require a new consensus signal ID — re-broadcasts of the same signal are ignored.

The hard rule is now part of src/risk_overlay.rs:check_all_rules so it cannot be bypassed by future strategy code paths.

Lessons

  1. Implicit assumptions are risk. We assumed leader signals were distinct events; they were re-broadcasts. Make the assumption explicit in the type system (consensus_signal_id is now non-optional).

  2. Risk-stop exits should never re-open in the same direction within the same regime window. Added as a separate rule.

  3. Daily report saved us. The anomaly was visible at 18:00 UTC on the daily PnL summary, ~1.5h after the last bad fill. Faster alerting would have stopped the bleed sooner — wired Telegram alert for >5 risk-stop exits in 1h on 2026-04-23.