Simplicity-authoritative · external wallets · script-only Taproot
The address
is the state.
Each Mint creates one unique Bitcoin Vault whose address commits to its Owner, Recovery identity, fixed Liquidator, financial state and three permitted exits. No known private key exists for the Taproot key path.
What the address commits to
Change one rule; get another Vault address.
The canonical state is hashed, embedded into the three scripts and committed by Taproot. Owner, Recovery, Liquidator, delays or amounts cannot be silently changed while keeping the same address.
Unique Vault address
Derived when a position is mintedNo known secret scalar
No key-path spendOwner + G
Script pathLiquidator L + LG
Script pathRecovery only
Script pathTaproot output-key derivation
Q = PNUMS + HTapTweak(PNUMS ∥ MerkleRoot) · GPNUMS is public but nobody is expected to know its private scalar. Here G is the secp256k1 curve generator, not Oro's Guardian key. The Merkle root commits to all three Tapleaves; changing a committed byte changes Q and therefore the address.
Exactly three exits
Every actor gets one narrow door.
Only the chosen leaf is revealed on-chain when spent. The other two remain hidden behind their Taproot commitments.
Repay & Burn
The Owner approves the exact repayment transaction. Oro adds G only after the committed program accepts it.
Liquidate
The release-fixed Liquidator signs with L. Oro adds LG only when the payout and accounting match the release.
Emergency
The Recovery key can reclaim the collateral through its delayed script path without either Oro Guardian.
No Guardian shortcut
G and LG are different server keys tied to narrow leaves. Neither is an internal-key secret, and Emergency does not depend on them.
The honest security boundary
Bitcoin and the proxy enforce different layers.
Oro does not claim that Bitcoin mainnet executes Simplicity today.
Bitcoin consensus
The NUMS-tweaked output, revealed Tapleaf, Schnorr signatures, CSV delay and ordinary transaction validity.
Oro program proxy
The pinned state transition, accounting, exact destination scripts, sibling outputs, fee cap and resource limits.
External wallets
Owner, Recovery and fixed Liquidator keys stay inside their wallets. Users approve narrowly scoped PSBTs.
Future native target
The same committed program semantics could move from the proxy into consensus if compatible Simplicity functionality reaches Bitcoin.