1. Executive Summary

Lumina Protocol is the first decentralized parametric insurance infrastructure designed exclusively for artificial intelligence agents operating in DeFi. The protocol deploys on Base L2, settles in real USDC (Circle), and generates yield through Aave V3.

Unlike traditional insurance, which requires a human to file a claim, a committee to review it, and weeks of waiting to receive payment, Lumina uses mathematical triggers verified by oracles. If the condition is met (for example, ETH drops 30%), the payout is instant and automatic. No claims. No disputes. No waiting for humans.

The protocol offers 5 insurance products (BTC Catastrophe Shield, ETH Apocalypse Shield, Depeg Shield, IL Index Cover, Exploit Shield), 4 liquidity vaults (VolatileShort, VolatileLong, StableShort, StableLong) and operates through 13 smart contracts deployed in production. Core contracts (CoverRouter, PolicyManager), vaults and shields use UUPS upgradeable proxies under TimelockController; Oracle contracts (LuminaOracleV2, LuminaPhalaVerifier) are NOT upgradeable (Ownable) and require redeployment to replace.

Every interaction flow begins the same way: the human, through their AI agent, instructs the desired operation. The agent executes the on-chain transaction autonomously, interacting with Lumina's API and protocol contracts without manual intervention.

The business model is simple and transparent: a 3% fee on the premium paid by the insured, a 3% fee on the claim payout, and a 3% performance fee on the positive yield (profit) when liquidity providers withdraw funds from vaults.

2. Introduction

2.1 The Problem: DeFi Without Protection for Autonomous Agents

The agentic economy is growing exponentially. Thousands of AI agents manage DeFi positions, treasuries, liquidity pools, and yield farming strategies. However, these agents operate without any type of coverage against the most critical risks in the ecosystem: catastrophic market crashes, stablecoin depegs, severe impermanent loss, and protocol exploits.

Existing DeFi insurance protocols were designed for humans. They require graphical interfaces, community voting processes to validate claims, and resolution times incompatible with the speed at which autonomous agents operate. Lumina solves this problem with a purely programmatic and parametric approach.

2.2 Comparison with Existing Protocols

2.3 How Lumina Works

The human, through their AI agent, defines the desired coverage parameters: asset to cover, amount, duration, and product. The agent queries Lumina's API to obtain a precise quote, including the premium calculated using the kink utilization model. Once the quote is approved, the agent executes the on-chain transaction through the CoverRouter.

Simplified flow:

The collateral is locked 1:1 in the corresponding vault. If the trigger is activated during the policy's validity period, the payout is executed automatically. If the policy expires without the trigger being activated, the collateral is released back to the vault.

3. Protocol Architecture

3.1 Kink Utilization Model

The core of Lumina's pricing is a non-linear utilization model inspired by the interest rate models of Aave and Compound. The premium is calculated with the following complete formula extracted from the Solidity code:

Where:

• Coverage: insured amount in USDC
• P_base: annualized base rate for the product (e.g.: 15% for BCS, 20% for EAS, 2.5% for Depeg)
• RiskMult: risk multiplier per asset
• DurationDiscount: discount for long duration
• M(U): utilization multiplier (kink model)
• Duration: policy duration in days

Kink Model -- Utilization Multiplier M(U)

The inflection point (kink) is located at U_kink = 80%. Below the kink, the multiplier grows linearly. Above it, it grows aggressively to disincentivize overutilization.

Multiplier Table by Utilization Level

This model ensures that when the vault capacity is ample, premiums are competitive. As utilization approaches 80%, premiums rise gradually. Above 80%, growth is exponential, protecting LPs from overexposure.

Vault Investment Model

LPs deposit USDC into Lumina's vaults. This USDC is automatically deposited into Aave V3 to generate a base yield (3-5% APY). Additionally, insurance premiums paid by policy buyers flow to the vault, increasing the value of LP shares.

The total yield for LPs is composed of:

• Aave V3 base yield: 3-5% APY generated by the USDC deposit in Aave V3
• Insurance premium yield: Premiums paid by policy buyers (97% after the protocol fee) are distributed to the vault
• Total yield = Aave V3 base yield + insurance premium yield

The Kink Model also protects LPs: the higher the vault utilization, the higher the premiums charged, which translates to higher yield for liquidity providers. This creates a natural equilibrium where LPs are compensated proportionally to the risk they assume.

3.2 Policy Purchase Flow

The human, through their AI agent, initiates the coverage purchase. The complete on-chain flow is:

1. Human instructs their AI agent with the desired parameters
2. AI Agent calls Lumina's API to obtain a quote
3. API calculates the premium using the kink model and returns the parameters
4. Agent approves USDC to the CoverRouter and executes purchaseCover()
5. CoverRouter (0xd5f8678A0F2149B6342F9014CCe6d743234Ca025) validates parameters and routes to the correct Shield
6. Shield (BCS/EAS/Depeg/IL/Exploit) validates product-specific rules
7. PolicyManager (0xCCA07e06762222AA27DEd58482DeD3d9a7d0162a) registers the policy on-chain
8. Vault locks collateral 1:1 to back the coverage
9. USDC is transferred from the agent to the vault (premium) and the 3% fee is charged

3.3 Liquidity Provider (LP) Flow

The human, through their AI agent, deposits USDC into one of the four vaults to earn yield:

1. Human decides to deposit in a vault and communicates it to their agent
2. Agent approves USDC and calls deposit() on the selected vault
3. Vault receives the USDC and deposits it into Aave V3 (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)
4. The LP receives soulbound shares (non-transferable) proportional to their deposit
5. The shares accumulate yield from two sources: Aave V3 base rate (3-5% APY) + insurance premiums
6. To withdraw, the LP initiates a cooldown period (37 to 372 days depending on the vault)
7. After the cooldown, the LP can execute withdraw() and receive their USDC + accumulated yield
8. A 3% performance fee is charged on the positive yield (profit) upon withdrawal

3.4 Contract Architecture Table

3.5 Strict 1:1 Collateralization

Every policy issued on Lumina is backed by collateral locked 1:1 in the corresponding vault. This means that if an agent purchases $50,000 of BCS coverage, the vault locks exactly $50,000 in USDC (deposited in Aave V3 as aUSDC) to guarantee the payout in case of a claim.

This model eliminates the undercapitalization risk that affects other DeFi insurance protocols operating with shared pool models. If vault utilization reaches 95% (U_MAX), no new policies are accepted until capacity is freed.

The 1:1 locked collateral does not remain idle. It is automatically deposited in Aave V3 where it generates base yield (3-5% APY) while remaining available to cover claims. This means that even capital committed to active policies is generating yield for LPs.

4. Insurance Products

5. Dynamic Pricing Model (Kink Model)

5.1 Foundations

The Kink Model is a dynamic pricing system inspired by Aave and Compound's interest rate models, adapted for parametric insurance. Its dual objective is to guarantee permanent vault solvency and create a self-balancing market where supply (LP liquidity) and demand (agent policy purchases) find equilibrium naturally.

Unlike a fixed price, the Kink Model adjusts premium costs in real-time based on available capital in each vault. When liquidity is abundant, premiums are affordable. When capital is scarce, premiums increase dramatically, protecting LPs and attracting new capital.

5.2 Calculation Formula

The complete formula, extracted from PremiumMath.sol:

Where M(U) is the utilization multiplier:

On-chain parameters (PremiumMath.sol):

Multiplier table:

Numerical example: An agent buys BTC Catastrophe Shield for $50,000 coverage, 14 days, with U=50%:

Same scenario with U=85%:

5.3 Vault Utilization

Utilization (U) is defined as:

• "Locked capital" = USDC reserved 1:1 to cover active policies (allocatedAssets in BaseVault.sol)
• "Total assets" = aToken balance in Aave V3 + free USDC in vault (totalAssets() in BaseVault.sol)

When an agent purchases a policy, corresponding capital is locked. When the policy expires or executes, capital is released.

5.4 Self-Balancing Mechanism

The Kink Model creates a market that self-balances through capital scarcity:

When insurance demand is high and vaults have little available liquidity:

• Premiums rise, making coverage expensive for agents
• LP yields increase, rewarding them for higher risk
• New LPs are attracted by high returns, injecting more capital
• Utilization drops, premiums normalize — the cycle repeats

When there is abundant liquidity and low demand:

• Premiums are low, incentivizing agents to buy coverage
• LP yields are lower, which naturally limits excess capital

5.5 Three Operating Zones

Green Zone (0% to 60%): Abundant capital. Affordable premiums for agents. Moderate LP yield (Aave base + low premiums). Ideal conditions for buying insurance.

Yellow Zone (60% to 80%): Growing demand. Premiums begin rising gradually. Balance between affordable coverage and growing LP returns. The market approaches the inflection point.

Red Zone (80% to 95%): Scarce capital. Premiums surge exponentially. High LP yield attracts new depositors. Discourages new policies until liquidity returns. The protocol actively protects itself.

Blocked Zone (>95%): No new policies accepted. The vault protects itself from insolvency. Only existing policy execution and new deposits allowed.

5.6 Mathematical Solvency Guarantee

The model guarantees solvency through three mechanisms:

1. 1:1 Collateralization: Each policy has dedicated USDC backing
2. Exponential curve: Premiums become prohibitive before reaching the limit, naturally discouraging over-issuance
3. Absolute cap (95%): Automatic rejection of new policies — it is impossible for the vault to accept more than it can cover

5.7 Impact Per Product

All products share the same Kink Model (same M(U) curve) but differ in their P_base and risk factors.

5.8 Protocol Fee Structure

Complete example:

Fee receiver: 0x2b4D825417f568231e809E31B9332ED146760337

6. Vaults and Yield

6.1 The Four Vaults

Lumina operates with four specialized vaults, each with a different cooldown period and assigned insurance products:

Vaults with longer cooldowns offer higher estimated APY because they assume greater risk (longer duration policies, less frequent but higher impact events).

6.2 Yield Composition

The yield that LPs receive comes from two sources:

1. Aave V3 base yield (3-5% APY): USDC deposited in the vaults is automatically deposited into Aave V3 Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5), generating passive yield in the form of aUSDC (0x4e65fE4DbA92790696d040ac24Aa414708F5c0AB).
2. Insurance premiums: When an agent purchases a policy, 97% of the premium (after the 3% protocol fee) is distributed to the corresponding vault, increasing the value of LP shares.

6.3 Soulbound Shares (Non-Transferable)

Lumina's vault shares are soulbound: they cannot be transferred, sold, or used as collateral in other protocols. This design decision prevents:

• The creation of secondary markets for shares that could destabilize the vaults
• The use of shares as collateral in lending protocols, creating systemic risk
• The fragmentation of liquidity among multiple holders

The LP can only interact with their shares through deposit() and withdraw() (after the cooldown).

In future versions of the protocol, the implementation of an exclusive Lumina secondary market will be evaluated, where LPs can trade their positions. This market would operate under rules controlled by the protocol, maintaining vault stability while offering greater flexibility to participants.

6.4 Dedicated Collateral per Policy

Thanks to the 1:1 collateralization, each policy has its own dedicated backing in the vault. Even in the case of multiple simultaneous claims, each payment is guaranteed by already locked collateral. The vault priority system only applies to the allocation of new policies, not to the payment of existing claims.

7. Oracle and Verification

7.1 LuminaOracle

The LuminaOracleV2 contract (0x87B576f688bE0E1d7d23A299f55b475658215105) is the central data verification component of the protocol. It is NOT upgradeable (Ownable, no UUPS proxy). It operates with an N-of-M multisig scheme that can be expanded according to decentralization needs.

It currently operates in 1-of-1 mode (expandable to N-of-M). The oracle verifies Chainlink feeds, implements a 1-hour sequencer check for Base L2, and validates data freshness before accepting it as input for triggers.

7.2 Chainlink Feeds Table

Volatile asset feeds (ETH, BTC) have a staleness of 20 minutes, while stablecoin feeds have a staleness of 24 hours, reflecting the lower expected volatility.

7.3 Multisig Verification: verifyPackedMultisig

The signature verification system uses a concatenated signature scheme ordered by address. Each authorized signer produces an ECDSA signature over the oracle data, and the signatures are concatenated in ascending order of signer address.

The verifyPackedMultisig function deserializes the signatures, verifies that each one comes from an authorized signer, that they are in the correct order (to prevent duplicates), and that the required N-of-M threshold is reached.

7.4 LuminaPhalaVerifier for Exploit Shield

The LuminaPhalaVerifier contract (0x468b9D2E9043c80467B610bC290b698ae23adb9B) verifies the secondary trigger of Exploit Shield via ECDSA signature verification of authorized Phala workers from an admin-curated list. It is NOT upgradeable (Ownable, admin-curated worker EOA list). It does NOT verify remote SGX/TDX attestations on-chain. It does NOT verify hardware enclave signatures on-chain. What it DOES: ecrecover(dataHash, signature) and verifies the recovered address is in _authorizedWorkers, a list maintained by the owner (Gnosis Safe).

This is critical for Exploit Shield because exploits can involve oracle manipulation. By using an independent verifier, Lumina adds a second confirmation layer, though the trust assumption is that the admin only adds workers whose keys were verified off-chain as originating from legitimate Phala enclaves.

8. Business Model

8.1 Monetization

Lumina Protocol generates revenue through a simple and transparent dual fee model:

8.2 Fee Receiver

All protocol fees are sent to the address:

This address is controlled by the TimelockController with a 48-hour delay, ensuring transparency and auditability.

8.3 Performance Fee on Vault Withdrawals

A 3% performance fee is charged only on the positive yield (profit) when withdrawing funds from vaults. The fee is calculated on the difference between the withdrawn amount and the cost basis (original deposit). If there is no profit, no fee is charged.

Example: An LP deposits $10,000 USDC. After accumulating yield, they withdraw $10,500 USDC. The profit is $500 ($10,500 - $10,000). The performance fee is 3% × $500 = $15. The LP receives a net of $10,485.

This structure aligns the protocol's incentives with those of the LPs: Lumina only charges when the LP actually makes money.

8.4 Model Scalability

Lumina's business model is inherently scalable:

• More LPs deposit into vaults, increasing total coverage capacity
• More capacity allows issuing more policies and covering more agents
• More policies generate more premiums, which increases yield for LPs
• Higher yield attracts more LPs, closing the virtuous cycle

This flywheel is reinforced with each new participant, creating a positive network effect.

9. Security

9.1 Smart Contracts

The protocol's 13 contracts have been developed with Solidity security best practices:

• Solidity 0.8.20: Native overflow/underflow checking
• CEI Pattern (Checks-Effects-Interactions): All critical functions follow this pattern
• SafeERC20: All USDC transfers use OpenZeppelin's SafeERC20 library
• ReentrancyGuard: Protection against reentrancy attacks on all functions that handle funds
• UUPS Proxies: Upgradeable contracts with OpenZeppelin's UUPS pattern, controlled by TimelockController
• 119 tests: Complete suite of unit and integration tests

9.2 Governance

The protocol's governance implements a layered security model:

• TimelockController (0xd0De5D53dCA2D96cdE7FAf540BA3f3a44fdB747a): 48-hour delay for all administrative operations. Any change to critical parameters requires a waiting period that allows LPs to react.
• Gnosis Safe 1-of-1 (planned 2-of-3) (0xa17e8b7f985022BC3c607e9c4858A1C264b33cFD): Currently 1-of-1 signer. Planned upgrade to require at least 2 of 3 authorized signers.

9.3 API and Backend

The API connecting AI agents to the contracts implements:

• Rate limiting: Request frequency control to prevent abuse
• CORS: Strict configuration of allowed origins
• Helmet: HTTP security headers
• NonceManager: Nonce management to prevent replay attacks and guarantee transaction sequentiality

9.4 Oracle

Oracle security is based on three layers:

• Multisig: N-of-M signature verification for oracle data
• Chainlink spot price verified via EIP-712 signed proof (LuminaOracleV2): The relayer reads latestRoundData from the Chainlink feed and signs the result with signTypedData. There is NO on-chain TWAP computation
• Sequencer check: Verification that the Base L2 sequencer has been active for at least 1 hour before accepting oracle data

9.5 Session Approval

For purchases made through relayers, the protocol requires session approval: the buyer must sign an explicit consent authorizing the relayer to execute the purchase on their behalf. This prevents a relayer from purchasing unauthorized policies with the user's funds.

9.6 OWS Integration

Lumina integrates the OWS (Open Wallet Standard) to facilitate secure interaction between AI agents and wallets. This integration allows agents to operate with granular and revocable permissions, without the need to expose private keys.

10. Actuarial Data

10.1 BTC Catastrophe Shield / ETH Apocalypse Shield -- Expected Value for LPs

The 38% margin reflects the fat-tail nature of BCS/EAS risk: catastrophic events are infrequent but severe. In years without events, the margin is significantly higher. In years with multiple events, the margin can be negative.

10.2 Depeg Shield -- Expected Value for LPs

Depeg Shield has the highest premium volume and a healthy 62% margin. Depeg events are rare (1-2 times per decade for major stablecoins) but when they occur they are systemic.

10.3 IL Index Cover -- Expected Value for LPs

IL Index Cover's proportional payout model and the 2% deductible create a favorable margin. Most policies expire with IL below 2%, generating premiums without claims.

10.4 Exploit Shield -- Expected Value for LPs

Exploit Shield has the lowest absolute volume but the highest percentage margin. The dual trigger, the 14-day waiting period, and the $50,000 per wallet cap significantly limit exposure.

10.5 Worst-Case Systemic Scenario

A systemic scenario (market crash + depeg + exploit simultaneously) could generate a loss of 21.9% of TVL. Recovery is projected at 10-12 months through premium accumulation. This scenario is extremely unlikely given the independent correlation groups between products.

11. Risks

12. Roadmap

13. Legal Framework

13.1 Protocol Structure

Lumina Protocol operates as a decentralized protocol deployed on Base L2 (Chain 8453). The smart contracts are immutable in their core logic, with upgrade capability through UUPS proxies (for core contracts, vaults and shields) controlled by a TimelockController with a 48-hour delay and a Gnosis Safe 1-of-1 (planned 2-of-3). Oracle contracts (LuminaOracleV2, LuminaPhalaVerifier) are NOT upgradeable (Ownable).

The protocol does not custody user funds. LP deposits are maintained in Aave V3, and claim payouts are executed directly from the vaults to the agents' wallets. The protocol only charges fees as an intermediary.

13.2 Product Nature

Lumina offers parametric protection products based on mathematically verifiable on-chain triggers. Lumina's products do not constitute insurance in the traditional regulatory sense: they do not require an insurer's license, do not involve subjective claim evaluation, and do not depend on judicial processes for dispute resolution.

Payments are automatic, deterministic, and verifiable by any third party that inspects the blockchain.

13.3 Regulatory Risks

The DeFi regulatory landscape continues to evolve. There are risks that future jurisdictions may classify on-chain parametric products as regulated insurance products, which could require licenses, additional regulatory compliance, or geographic restrictions.

The team actively monitors regulatory developments in major jurisdictions (US, EU, UK, Singapore) and is prepared to adapt the protocol's structure as necessary.

13.4 Disclaimer

14. Production Addresses

Network: Base L2 (Chain 8453)  |  Deployment date: March 29, 2026

Governance

Core

Vaults

Shields (Products)

External Contracts

Operational Keys

Chainlink Feeds

15. Correlation Groups

Lumina's products are designed to cover risks with low correlation between them, limiting the possibility of simultaneous claims:

Correlation Analysis

• BCS, EAS and IL Index Cover have high correlation: a market crash triggers BCS/EAS and simultaneously generates significant IL. For this reason, they share the VolatileShort vault.
• Depeg Shield has low correlation with volatility products. A stablecoin depeg can occur independently of market direction (e.g.: banking crisis, Tether regulatory risk).
• Exploit Shield has low correlation with all other products. Protocol hacks are idiosyncratic events that do not depend on market conditions.
• Systemic event (all triggers simultaneously) is the worst-case scenario. Vault segregation by risk type and the waterfall system partially mitigate this risk. The maximum estimated loss is -21.9% of TVL ($438K out of $2M).

16. API and Agents

16.1 General Description

The human, through their AI agent, interacts with Lumina Protocol through a REST API that exposes the protocol's core functionalities. The API allows quoting, purchasing policies, checking status, and verifying triggers without the need to interact directly with the contracts.

Main endpoints:

16.2 SKILL Reference

The complete API documentation and instructions for configuring agents can be found in the protocol's SKILL file: LUMINA-SKILL.txt (Version 3.0, March 2026).

The SKILL file contains:

• Detailed description of each product with parameters, examples, and pricing tables
• Step-by-step instructions for an agent to purchase coverage
• Instructions for depositing and withdrawing as an LP
• Parameters for each vault and their estimated APYs
• Fee information and how to plan coverages considering the 3% fee

16.3 Agent Setup Flow

1. The human configures their agent with Lumina's API URL and their wallet credentials
2. The agent queries /quote with the desired parameters (product, asset, amount, duration)
3. The agent evaluates the quote and decides whether to proceed
4. The agent approves USDC to the CoverRouter via approve()
5. The agent executes /purchase or directly calls CoverRouter.purchaseCover()
6. The policy is registered on-chain in the PolicyManager
7. The agent can monitor their policy status via /policy/:id

17. Conclusion

Lumina Protocol represents the first parametric insurance infrastructure designed exclusively for the agentic economy. By combining verifiable mathematical triggers, decentralized oracles, strict 1:1 collateralization, and yield generated through Aave V3, the protocol offers a complete solution for the critical risks that AI agents face in DeFi.

Key Protocol Strengths

• Pure parametric: No subjective claims, no voting, no waiting. The trigger activates and the payout is immediate.
• Designed for agents: Programmatic API, session approval for relayers, OWS integration, SKILL documentation.
• 1:1 collateral: Each policy is backed 100% by real USDC locked in the vault. No undercapitalization risk.
• Real yield: LPs earn compound yield from Aave V3 + insurance premiums, with estimated APYs of 3-21%.
• Layered security: Solidity 0.8.20, ReentrancyGuard, CEI, TimelockController 48h, Gnosis Safe 1-of-1 (planned 2-of-3), EIP-712 proofs, sequencer check.
• Transparent business model: 3% premium + 3% payout. No hidden fees. 3% performance fee on positive yield from vault withdrawals.

Vision

Lumina aspires to become the standard insurance infrastructure for the agentic economy. As millions of AI agents manage trillions of dollars in DeFi assets, the need for programmatic, instant, and reliable coverage will be as fundamental as today's lending and trading infrastructure.

With the roadmap toward additional products (Gas Spike, Slippage, Bridge Shield), an NFT policy marketplace, native token, and DAO governance, Lumina positions itself as the reference protocol in decentralized insurance for the new generation of autonomous participants in the DeFi ecosystem.