Skip to main content
The confidential rail is the reason AroPay exists. It lets you settle on a public blockchain (with its auditability, finality, and neutrality) without broadcasting how much money moved.

​
The problem with public rails

On a standard ERC-20, every balance and every transfer amount is public, forever. For enterprise payments that leaks payroll, supplier pricing, treasury positions, and customer volumes to anyone with a block explorer.

​
cAROUSD in one paragraph

cAROUSD (Aro Confidential US Dollar) is the value layer of the Aro Confidential Rails: an ERC-7984 confidential token whose balances and transfer amounts are stored on-chain as ciphertexts under fully homomorphic encryption (FHE), built on the Zama Protocol. The contract can add and subtract encrypted values without decrypting them (that’s the homomorphic part), so transfers are verified and executed while the amounts stay opaque. Decryption requires a key-holder’s signature and happens off-chain through the Zama relayer network. In production, cAROUSD is designed to be backed 1:1 by liquid USDC and USDT at the Aro Liquidity Commitment; the Sepolia sandbox substitutes a test stablecoin.

​
What an observer sees

Confidentiality covers amounts, not participation. Addresses and the fact of a transfer remain public, like a bank statement where every figure is redacted but the counterparties are not.

​
Moving on and off the confidential rail

  • Mint converts public stablecoin into cAROUSD at 1:1.
  • Private transfers move cAROUSD between addresses with encrypted amounts.
  • Redeem burns cAROUSD and pays public stablecoin back at 1:1, settling asynchronously.

​
Who can decrypt what

FHE ciphertexts are decryptable only by authorized key-holders, via the relayer:
  • Your custodial wallets: the sandbox signs the decryption request with the wallet’s key, which is how the dashboard and /balances show plaintext confidential amounts.
  • External wallets: the sandbox has no key, so balances stay encrypted (encrypted: true, amount: null). The owner can decrypt with their own tooling.
  • Redeem processing: burning cAROUSD requires the burned amount to be publicly decrypted so the payout can be verified; that value (and only that value) becomes public as part of settlement.

​
Practical notes

  • All FHE happens server-side. You send and receive plain decimal strings; the sandbox handles encryption, decryption, and relayer interaction.
  • Confidential operations are slower than public ones: encrypted inputs must be produced and proofs verified. The first confidential call after a deployment restart is slower still, while FHE keys are fetched.
  • Confidential reads are heavier than gas reads. Poll GET /gas freely, but treat /balances as a read you do when you need it.
  • Under the hood, encrypted values are referenced by handles: the opaque hex strings you see in confidential.handle on balance responses.