Protocol Overview
Oro has two main flows: bringing gold exposure into Aztec, and using that confidential gold exposure as collateral.
ZGLD: gold exposure on Aztec
ZGLD is the Aztec-side asset that represents supported gold-backed value after it enters the protocol.
At a high level:
- the user brings supported collateral from an EVM chain;
- the EVM side accounts for that collateral;
- an Aztec message allows
ZGLDto be made available on Aztec; - the user can then hold, transfer, or use
ZGLDas collateral.
Holding ZGLD does not create liquidation risk. Risk starts when ZGLD is deposited and ORO is minted against it.
ORO: debt created against ZGLD
ORO is the dollar-targeted asset created when a user opens a collateralized position with ZGLD.
Minting ORO expands supply in a controlled way. The protocol checks that the position remains sufficiently collateralized before allowing new ORO to be created.
If the position becomes unsafe, it may be subject to liquidation according to the protocol's risk rules.
If the oracle price is stale or unreliable, minting should stop until the protocol has a fresh reference again.
Repay and withdraw
To reduce risk, a user repays ORO. Once debt is reduced, more ZGLD may become withdrawable.
The clean mental model is:
- deposit
ZGLDto create borrowing capacity; - mint
OROonly while the position is safe; - repay
OROto recover collateral flexibility; - withdraw
ZGLDwhen the remaining position allows it.

Bridge back
When a user wants to leave Aztec, ZGLD can be exited back through the bridge flow. The Aztec side records the exit, and the EVM side releases the corresponding asset when the message is valid.
When the exit fee is enabled, the bridge burns the full ZGLD amount on Aztec but releases 99% of that amount as XAUT on Ethereum. The remaining 1% stays in the EVM vault as protocol-owned fees. If the fee switch is disabled, the EVM unlock amount matches the burned ZGLD amount.
What is automated?
Oro uses supporting services to make the app faster and the bridge smoother:
- the backend prepares the current protocol view for the app;
- the oracle reports gold price updates;
- the relayer progresses bridge transfers.
These services should help the user experience. They should not silently replace the protocol checks that protect collateral, supply, and message validity.