Skip to main content
See /concepts/lifecycle for the end-to-end flow (policy → trigger → bond → wait/sell decision).
A Shield is one parametric product. In V5.4 Lumina ships 6 active flash-crash shields (3 BTC + 3 ETH), and every one of them runs the same slim BaseFlashShield logic. The differences between products are just parameters: covered asset, drop threshold, and time window.

​
The 6 V5.4 products

Shared parameters across all 6 products: Discover the live set with GET /products or lumina.products.list().

​
V5.4 addresses (Base mainnet)

Each product is reached via its FlashShieldAdapter (the address PolicyManagerV2.productShield(productId) returns). The adapter delegates to the underlying slim BaseFlashShield. See Adapters for why the two-layer pattern exists.

​
Shape

​
How BaseFlashShield gates a trigger

Every shield runs the same five checks in submitTrigger(payload, signature):
  1. Oracle signature. EIP-712 payload must be signed by LuminaOracleV2.oracleKey().
  2. 3 confirmations 60s apart. The oracle internally reads the Chainlink feed 3 times, at least 60 seconds between reads, and aggregates. A single spike won’t trigger; the move has to persist across the read window.
  3. L2 sequencer uptime. Reads Base’s Chainlink L2 sequencer uptime feed; if the sequencer is reported down or in grace period, triggers are rejected (no triggering during outages where users couldn’t react).
  4. Strike snapshot at purchase. Each policy stores the asset’s price at purchase time as the strike. The drop is measured against the strike — never against an arbitrary trailing peak or future price.
  5. Drop and window. Accept if (strike - currentPrice) / strike ≥ TRIGGER_DROP_BPS and block.timestamp ≤ policy.startedAt + durationSeconds.
On accept, the shield calls BondVault.mint(buyer, faceValueUsd) — the buyer receives an ERC-1155 ClaimBond with 800faceper800 face per 1,000 cover, 730-day maturity. No “claim” step is required.

​
The “drop from purchase price” mechanic

A common point of confusion: the drop is always measured against the strike snapshotted at purchase, not against a daily open, a TWAP, or the all-time high. Two consequences:
  • Buying right before a recovery is worthless — if BTC drops 2.6% from your strike a minute after you buy, you trigger. If it drops 2.6% from someone else’s strike but only 0.3% from yours, you don’t.
  • The strike persists for the full window. Multiple buyers of the same product at different times will have different strikes and may trigger on the same price move (or not), depending on each one’s strike.

​
Verifying a productId yourself

The productId is a 32-byte hash, not an address.

​
See also