Skip to main content

User Flow

This page describes the intended user journey in plain language.

Before using Oro​

The user needs:

  • an EVM wallet for the source or destination chain;
  • an Aztec wallet/profile for confidential actions;
  • supported gold-backed collateral;
  • enough gas or fee balance for the relevant chain.

During early testnet phases, limits and allowlists may apply.

Bridge into Aztec​

The user chooses an amount to bridge from Ethereum to Aztec.

The app asks for an EVM wallet confirmation because the source action locks funds on the EVM side. After the lock, the bridge worker follows the transfer until ZGLD is available on Aztec.

If the relayer is delayed, the transfer should remain visible. The app should show that progress has stalled rather than hiding the transfer.

Use ZGLD​

Once received, ZGLD can be used without borrowing.

This matters: Oro is not only a lending flow. It also gives users a confidential gold-backed asset on Aztec.

Mint ORO​

If the user wants liquidity, they can deposit ZGLD and mint ORO.

The app shows the position health before the user signs. If the backend, oracle, or protocol reads are unavailable, minting is blocked until the data is fresh again.

Repay and withdraw​

The user repays ORO to reduce debt. After repayment, they can withdraw some or all of their ZGLD, depending on the remaining collateral ratio.

Bridge back to Ethereum​

For the Aztec to Ethereum direction, the source action is on Aztec. The user provides the destination EVM address and confirms the Aztec-side action.

If the exit fee is enabled, the user burns the full ZGLD amount on Aztec and receives 99% of that amount as XAUT on Ethereum. If the fee is disabled, the received XAUT amount matches the burned ZGLD amount.

The current app design does not require an extra Ethereum signature for this direction, because Ethereum is not the source side of the transfer.

If a service is offline​

The app is designed to fail closed for actions that can change user risk.

  • Backend offline: position-changing actions pause.
  • Oracle stale: minting pauses.
  • Relayer stalled: existing transfers stay visible, new bridge actions may be blocked.
  • Aztec RPC unknown: the app shows a separate service warning.

Read-only data may remain visible, but stale data should not be used to create a new transaction.