Shield Mechanics
This page describes the operational mechanics of a Shield coverage market: how windows are defined, how the two pools work, the backing lifecycle, and how outcomes are resolved.
Coverage windows
Shield narratives are created for a specific security event with a defined time window:
| Window | Use |
|---|---|
| 30 days | Short-term risk assessment |
| 60 days | Medium-term conviction |
| 90 days | Full coverage period (standard for Partnership Shield) |
Pool structure
Each Shield narrative has exactly two pools:
- SAFE pool — backers who believe the protocol will not be exploited during the window.
- EXPLOIT pool — backers who believe a qualifying security failure will occur.
Both pools deploy capital into approved DeFi yield protocols (Kamino, Marinade, Save) from the moment of commitment. The pools are held in separate on-chain vault PDAs — see Shield Technical Specification.
Backing flow
- The backer selects a protocol narrative and chooses SAFE or EXPLOIT.
- Capital is committed and immediately routed to yield protocols.
- Yield accrues continuously throughout the coverage window.
- At resolution, oracle consensus determines TRUE (no exploit) or FALSE (exploit confirmed).
- Correct backers receive principal + accumulated yield + conviction multiplier.
- Incorrect backers forfeit principal; the yield already earned is retained.
Discovery Multiplier
Backers who commit during the discovery window (the first 20% of a coverage window) earn a 2.0× Discovery Multiplier. This rewards early conviction and compensates for the higher uncertainty at the start of a window.
The multiplier applies to the conviction score component of a backer's reward. It does not double the principal — direct SOL payout is always proportional to the raw amount committed. The multiplier is stored on-chain in the backing record (see Economics).
Resolution
Coverage is resolved by an N-of-M oracle committee: a verdict stands only once a threshold of distinct authorized oracle signers attest the same outcome — SAFE or EXPLOIT. Multiple independent data sources (on-chain price/event feeds, decentralized oracle networks, and evidence review) inform each signer; no single source resolves a market. The mainnet target is a ≥3-of-N distinct-signer threshold.
A 48-hour dispute window follows resolution before payouts are finalized. A claim-paying
EXPLOIT verdict additionally requires a security-council confirmation before it can finalize
— see Shield — Resolution for the dedicated magma_shield_resolution
surface (a designed, host-tested scaffold; not yet deployed). On devnet the oracle threshold is
relaxed for testing (see Technical Specification).
Self-backing (Partnership only)
Partnership Shield protocols may back their own SAFE pool. This:
- Signals confidence in their own security posture.
- Provides a partial self-hedge — on a confirmed exploit, up to 50% of the SAFE pool routes to
the protocol team, bounded by an admin-settable cap (
max_self_hedge_bps). Any share the cap frees is redirected to the winning EXPLOIT backers, so a team cannot profit from being exploited with outside backers' capital. - Is fully transparent on-chain — self-backing positions are visible like any other.
Self-backing has no minimum backing amount; the protocol's return on a confirmed exploit is what the self-hedge cap bounds. Community Shield does not support self-backing.
Yield spread cap
MAGMA applies a maximum 0.5% yield spread above the raw DeFi protocol rate. This covers operational costs while ensuring backers receive competitive yield. Yield accrues continuously from the commitment date and is never clawed back on a losing position.