6.1.5 Failure Modes & Real-World Practice

Basic Prerequisites: 04 · Matching & Priority.

---

1. Intuition & Practical Objective

The mechanics of pages 01–04 are clean: deterministic matching, exact queue positions, well-defined states. Real markets are hostile to that cleanliness in a small number of specific, repeatable ways. This page names them precisely so a practitioner knows which mechanical assumption to distrust and how the violation shows up in money.

The three that matter, in one line each:

1. Adverse selection at the touch - passive fills are not random; they cluster exactly when the price is about to move against you, so the spread is a premium for a written option, not profit.
2. Queue-position risk - you can be right about price and still never fill, or fill only in the states you least want. Waiting behind a large queue is not neutral.
3. Latency - the book you act on is a stale copy; anyone faster can convert your resting quote into a free option and exercise it against you.

Everything else (spoofing, fleeting liquidity, feed desync) is a variation on these three.

---

2. Mathematical Ground Truth & Derivations

2.1 The toxic-fill identity. Post a buy limit $h$ below the mid (a passive quote capturing half-spread $h$). A sell order arrives and fills it. Conditional on the fill, the “true” value of the asset has moved by $J>0$ against you with probability $\pi$ (an informed counterparty) and not moved otherwise. Your per-fill P&L is

$${\pi }_{\text{fill}}=\{\begin{array}{ll}h,& \text{uninformed (prob }1-\pi ),\\ h-J,& \text{informed (prob }\pi ),\end{array}⟹\boxed{\mathbb{E}[{\pi }_{\text{fill}}]=h-\pi J}.$$

The quote is profitable only while the informed share is below the break-even toxicity

$${\pi }^{\star }=\frac{h}{J}.$$

Note the structure: more spread $h$ tolerates more toxicity, and larger informed moves $J$ require less. This is the seed of the entire adverse-selection literature (Glosten–Milgrom) and of toxicity metrics like VPIN (Toxic Order Flow & VPIN).

2.2 Queue position as a race. Your order sits behind $Q_0$ lots. It clears when aggressive flow has consumed $Q_0$ lots at your price - at execution rate $\mu$, an effective queue-clearing rate $\mu /Q_0$. Meanwhile an adverse price move arrives at rate $\nu$. The two are competing exponential clocks, so

$$P(\text{adverse move before fill})\approx \frac{\nu }{\nu +\mu /Q_0}\underset{Q_0\uparrow }{\to }1.$$

The expected wait to fill (execute $Q_0+s$ lots at rate $\mu$) is

$$\mathbb{E}[T]\approx \frac{Q_0+s}{\mu },$$

linear in the queue ahead. Combining the two: a deep queue makes you slow and selectively filled - the worst of both - because long queues clear only during aggressive bursts, which is precisely when the price is moving.

2.3 Latency as a loss term. Suppose an adverse signal (a large order, a related-venue move) arrives and predicts aggressive flow at rate ${\mu }_{\text{mo}}$; you must cancel within your latency $\delta$ before that flow lands. The fill is picked off unless your cancel wins the race:

$$P(\text{picked off})=1-e^{-{\mu }_{\text{mo}}\delta },$$

so with signal rate $\lambda$ the loss rate is

$$\text{Loss}=\lambda (1-e^{-{\mu }_{\text{mo}}\delta })(J-h).$$

For small $\delta$ this is $\approx \lambda {\mu }_{\text{mo}}\delta (J-h)$ - linear in latency, and the multiplicative $J-h$ is why the same latency is cheap in a tight, calm book and ruinous in a wide, fast one. Latency is not “speed for its own sake”; it is the cost of racing for the cancel.

---

3. Computational Implementation - the three risks in numbers

The script quantifies all three: the toxic-fill P&L curve (closed form + Monte Carlo), the queue-race odds, and the latency loss term. Standard library only.

Three readings. Toxicity: at $\pi =0.20$ the passive quote earns exactly nothing; a mere 30% informed flow turns a $0.01 half-spread into a $0.005-per-fill bleed - quoted spreads are calibrated to this. Queue: at $Q_0=1,000$ you wait an order of magnitude longer and face an 83% chance the adverse move beats your fill; the queue converts a “cheap” back-of-book quote into a lottery you expect to lose. Latency: moving from 0.1 ms to 10 ms (100× slower) raises the pick-off rate from 0.5% to 39% and the loss from $0.02/s to $1.57/s - an ~80× increase, which is why co-location and kernel-bypass exist (Low-Latency Systems Architecture).

---

4. Failure Modes & First-Principles Breakdowns (numbered)

1. Adverse selection at the touch (the spread is an option premium). The fill event is informative: you are filled more often when you are about to be wrong. $\mathbb{E}[\pi ]=h-\pi J$ goes negative past ${\pi }^{\star }=h/J$. Any strategy that treats the quoted spread as a riskless margin is short an unpriced option.
2. Queue-position risk (right, but never filled - or filled only when wrong). A resting order’s expected fill is governed by the size ahead of it, not its price. Deep queues mean long waits and adverse selection, because long queues clear mainly in aggressive bursts. Passive liquidity has fill risk and selective-fill risk simultaneously; both are structural consequences of FIFO priority (04).
3. Latency pick-off (a stale quote is a free option). The book you act on is a reconstruction of a past state; a faster participant can trade the current book against your stale quote. The loss is linear in latency, $\approx \lambda {\mu }_{\text{mo}}\delta (J-h)$, and explodes with $J$ - so latency risk is state-dependent, worst exactly when volatility is high.
4. Feed desynchronisation (the state is wrong). Dropped, duplicated, or out-of-sequence L3 messages corrupt the reconstruction. The failure is silent: the book still looks valid (uncrossed, sane sizes) but every derived signal - spread, imbalance, queue position, OFI - is computed on a wrong state. Mitigation is sequence-number gap detection and periodic snapshot resync.
5. Manipulative / fleeting liquidity (a valid state is not a truthful one). Spoofing posts large orders outside the touch and cancels before execution; fleeting liquidity flashes quotes that vanish on contact. The matching engine cannot distinguish intent from commitment, so depth is not belief. Metrics built on quoted size (naive OFI, depth-weighted imbalance) are fooled; size-weighted executed flow is not.
6. Self-trade and crossed-book handling. A single participant on both sides of a trade is either prevented (self-match prevention, which can cancel a genuine hedge) or allowed (creating wash trades and capital/regulatory problems). And because a crossing order must match immediately, a “crossed book” in your reconstruction is not a signal - it is proof your state has already drifted.

---

5. References

• Hasbrouck, Empirical Market Microstructure
• Foucault, Pagano & Röell, Market Liquidity
• Glosten & Milgrom (1985), Bid, ask and transaction prices in a specialist market with heterogeneously informed traders
• Easley, Kiefer, O’Hara & Paperman (1996) / Easley, Hvidkjaer & O’Hara (2002)
• Bouchaud, Farmer & Lillo, How markets slowly digest changes in supply and demand (2009)
• Menkveld & Zoican (2017), Need for speed? Exchange latency and liquidity

---

6. Connected Graph Bridges

• Back: 04 · Matching & Priority · Index Hub
• Forward: 06 · Advanced Extensions
• Related: Adverse Selection & Glosten–Milgrom · Toxic Order Flow & VPIN · Inventory Management & Quote Skewing · Limit Order Book Mechanics & L3 Data · Queue Position & Fill Probability