SHIELD

SHIELD holders escrow Stock Tokens and prefund coupons and the notional fee in USDG. They pay the coupons received by COUPON. At a maturity breach, SHIELD delivers stock and receives USDG notional; otherwise it receives its stock back plus unused prefund.

Position

fact SHIELD is leg 1 of a series in NoteLegs (ERC-1155), id (seriesId << 1) | 1. One unit is one raw quote unit of matched notional (10⁻⁶ USDG); each 1 USDG of matched notional is 1,000,000 raw leg units. Stock redemption uses the strike price and strike quote rate; see Physical Settlement.

Deposit

depositShield(seriesId, stockAmount, prefundQuote) transfers Stock Tokens and USDG into escrow during Subscription.

• Stock is valued at the reference price (OracleAdapter.latestPrice(feed), the price component of referencePrice: the latest print during the session, the last official close while the market is shut) for the prefund requirement and pro-rata matching bookkeeping. For the prefund requirement the price used is never lower than shieldPriceFloor(seriesId), the highest reference price at which the series has already accepted a SHIELD deposit, so a deposit made during a dip cannot lower the prefund per unit of stock that fixes the matched capacity for every depositor. Final matching uses s0.
• prefundQuote must be at least requiredPrefund(seriesId, stockAmount) and at most requiredPrefund × (1e4 + prefundHeadroomBps) / 1e4 (prefundHeadroomBps default 500, governed); a larger amount is rejected with ExcessPrefund rather than pooled:

fact Deposit Calculation

illustrative For the worked example, the coupon cap is 140 bps across twelve coupon observations. The notional fee is 75 bps: (140 × 12 + 75) / 10,000 = 17.55%, or 17,550.00 USDG on 100,000 USDG of notional. These are example assumptions, not universal constants.

The core books the Stock Token amount it actually receives (ZeroAmount if nothing arrives) and the whole prefundQuote sent; nothing is refunded at deposit time, and whatever the position does not use is returned at settlement through shieldUnusedPerUnit or as unmatched prefund via refund.

The app therefore shows three figures read from requiredPrefund: “Prefund required”, “Headroom (0.1%)” (added, rounded up, so the deposit still passes if the provisional price ticks up before inclusion) and “Total USDG pulled”. The requirement is re-read at submit; exactly the reviewed total is sent when it still covers the requirement, otherwise the deposit stops and asks for a new review.

Why Prefund at the Cap

The coupon is unknown until strike. Prefunding at the cap covers the maximum scheduled coupon liability and notional fee before the series becomes live. Unused matched prefund remains locked until settlement; unmatched prefund is refundable after strike.

illustrative With a 140 bps cap, twelve coupon observations and a 75 bps notional fee, the prefund is 17.55% of notional. A lower cap reduces the requirement but also lowers the maximum discovered coupon.

Matching at Strike

At strike, S = stockToQuote(totalShieldStock, s0) and N = min(D, S, notionalCap, prefundCapacity). Matched stock is quoteToStockUp(N, s0), rounded up so COUPON holders are never short on physical settlement. The prefund is split into:

• prefundMatched = N × prefundRateBps / 1e4 (rounded up), from which the notional fee is deducted immediately into accruedFees, leaving prefundRemaining.
• prefundUnmatched, refundable at once via refund.

prefundCapacity is the usable prefund divided by prefundRateBps, where the usable prefund is the lowest prefund-per-stock ratio among the series’ deposits (leastFundedShield) scaled to the whole stock.

Every SHIELD unit is charged the same prefund: at settlement each depositor is charged ceil(stock × prefundMatched / totalShieldStock) and refunded the rest of what it posted, so two depositors holding the same units have paid the same net prefund whatever the feed printed when each deposited and whatever margin each posted inside the headroom.

Unmatched stock is likewise refundable at once.

Cash Flows

shieldUnusedPerUnit = prefundRemaining / N is fixed at the terminal observation and paid per unit on redeemShield.

Economic Identity

SHIELD is long a down-and-in put struck at s0, knocked in only if the final observation is below the barrier, that switches off on autocall, financed by a coupon stream paid only while the barrier holds. Compared with buying a vanilla put:

Who Uses SHIELD

• Long-term Stock Token holders who fear a crash more than a drawdown.
• Lenders holding Stock Tokens as collateral who want tail cover on their book.
• Vaults and mandates that must remain invested but have a loss budget.

Transfers

SHIELD units are transferable. There is no per-unit accrual to settle on transfer (SHIELD pays rather than receives during the life), but the onLegTransfer hook still runs to keep bookkeeping symmetric. Refunds of unmatched deposits belong to the original depositor and are not transferred with units.

Risk Summary for SHIELD

• If every observation qualifies and no autocall occurs, you pay every coupon. If the maturity price is at or above the barrier, you receive stock and unused prefund, not a protection settlement; see Scenario B of the worked example.
• Autocall removes your protection exactly when the stock is strong; you must re-enter a new series to stay covered.
• Your Stock Tokens are locked until settlement. There is no early exit except by selling SHIELD units.