The manual.

Gold has outlived every currency ever printed against it. AURUM is a reserve protocol with a single, deliberate habit: accumulate tokenized gold and never stop. The treasury holds SPDR Gold Shares • Robinhood Token (GLD) — a tokenized claim on the world’s most trusted gold ETF — plus a hard floor of USDG and its own liquidity.

AUR is the unit of account for that habit. It is not pegged to gold, but it is not unbacked paper either: the assay window (§08) redeems AUR for GLD at the vault’s backing, any hour of any day. Every mechanism — bonds, staking rewards, LP fees, range defense — points in one direction: more gold in the vault per AUR outstanding.

Buy. AUR trades against GLD in the protocol-owned pool. Market buying is the simplest way in and directly deepens the pairing the treasury earns fees from.

Bond. Sell USDG, GLD or AUR/GLD LP to the treasury and receive AUR priced by a reverse Dutch auction (§07), vesting linearly over five days — claims land as staked sAUR, earning from the first second. Bonding is the engine of accumulation: USDG bonds are swapped into gold on the spot through the Uniswap V3 GLD/USDG pool inside a tight TWAP band, GLD bonds place metal directly into the vault, and LP bonds are unwrapped into gold and re-vested AUR.

Stake. Deposit AUR into the vault and receive sAUR, one-to-one with principal — the share price never moves, by design. Yield lives outside it: each eight-hour epoch opens a reward stream that accrues per second to every share for as long as it stays staked, and stakers claim their AUR whenever they like — nothing is ever forfeited. Unstaking returns AUR at par, any time.

The treasury is the vault. It holds three classes of reserves and nothing else:

• USDG floor. A 5% slice of the genesis raise plus all USDG bond proceeds, held as stable backing. The floor never leaves the vault — not even through redemption.
• GLD bullion. Acquired at genesis, through GLD bonds, and as LP fees. The habit itself.
• Protocol-owned liquidity. The AUR/GLD pool, owned by the treasury, sitting behind a multisig and a 48-hour timelock. Fees accrue gold natively.

Every AUR carries a computable backing: reserves valued at oracle prices, divided by supply. The treasury can only move funds through the permissioned operator path — no discretionary withdrawals, no team multisig raids.

AURUM opens with a fixed-price genesis sale in USDG. Terms are locked in the contract before the first deposit and cannot be altered mid-sale:

At finalization the contract mints allocations, splits the raise, seeds the AUR/GLD pair, and hands the LP position to the treasury — in one atomic transaction. The 90% acquisition leg stays in the treasury as USDG and converts to GLD permissionlessly over the following days: anyone may trigger convertToGld, limited to $2,500 per hour and banded against the reference-pool TWAP, because that pool is too thin at launch for a single swap. While conversion is pending, no staking emissions can mint. If the softcap is missed by the cutoff, every deposit is refundable in full.

AURUM runs a minimal range-bound stability system with bands denominated in GLD against the protocol’s own thirty-minute TWAP — self-contained, with no dependence on external price feeds. When price presses above the upper wall, a cushion bond opens selling AUR for GLD at band price: resistance that fills the vault. When price falls through the lower wall, the treasury buys back and burns AUR through the router, rate-limited per epoch so support regenerates instead of exhausting. Band geometry is governance-set behind the timelock.

5% transfer tax is skimmed at the token level on every buy and sell of AUR on the registered AUR/GLD pool, the moment the trade touches the pair. The taxed AUR accumulates in the TaxCollector, where anyone can call processTax() to swap it to GLD and deliver it straight into the treasury — guarded against sandwiching by a TWAP-banded minimum output, and against waste by a dust threshold.

Protocol plumbing never pays the toll: staking, unstaking, bond payouts and claims, redemptions, RBS buybacks and burns, mints and the genesis flows are all exempt — only anonymous market traffic on the pool is taxed. Governance can tune the rate but can never raise it above a hard-coded 10% cap. Every swap through the tax is more gold behind every AUR that stays.

Bond markets do not sit at a fixed discount. Each market runs a reverse Dutch auction: the AUR price opens at a premium to the thirty-minute TWAP and decays in a straight line toward a floor set at a discount below it. Both endpoints track the live TWAP, so the whole ladder slides with the market — only your position on it moves with time.

The catch, and it is the design: each purchase moves the auction clock back toward its opening premium in proportion to the market capacity it consumes. Fill the market and it reopens at the premium; buy a little and the price barely moves — so no buyer can sweep a market at its cheapest, and no one can reset it for free either. Patience is rewarded, greed is taxed, and the vault wins either way.

Three guardrails make bonds safe for the vault. The auction floor is max(TWAP discount, live GLD backing per AUR) — if price ever trades below backing, the floor rises to meet it and bonds simply cannot mint below the vault’s floor: non-dilutive by construction. Each market’s outstanding unclaimed debt is hard-capped at a governance-set share of supply, so bond issuance can never outrun the token. And when you claim, the vested AUR doesn’t land idle in your wallet — it is deposited into the staking vault and delivered as sAUR, earning epoch yield from the moment of claim; unstake whenever you like.

Beyond USDG and GLD, a third market bonds AUR/GLD LP tokens. The LP is unwrapped on deposit: its gold leg enters the vault at the backing-floored bond price and its AUR leg is burned and re-credited into your vest, so an LP bond can never lower the gold behind any AUR. Every market also enforces a small minimum deposit, so dust can never reopen an auction. It stays staged until genesis finalization seeds the POL pool and registers the pair.

The vault stands behind its paper. At any time you may burn AUR at the assay window and receive its GLD backing — treasury gold divided by supply — paid from the vault itself. A 2% assay fee is retained by the treasury, which means every redemption leaves the remaining AUR a little more golden than before.

Two guardrails keep the promise honest. Redemption pays GLD only: the USDG floor and the protocol’s liquidity cannot leave through this window — the treasury enforces it in code, not policy. And redemptions draw on a per-epoch capacity that refills linearly, so no single rush can drain the vault; when the tank runs low, the queue waits for the refill, not for a bailout. The oracle freshness of the price behind your payout is enforced on chain.

The vault is also the bank. Post AUR as collateral and draw USDG straight from the treasury, valued at the AUR TWAP: up to 65% max LTV, with liquidation armed at 80%. Loans cost a 0.5% origination fee — deducted from the payout while you owe the gross — and roughly 8% APR, accruing every second. Repayments apply interest-first.

Every fee stream flows home: origination fees never leave the treasury, interest is repaid into it, and when a position breaks the 80% threshold a liquidator may close up to half the debt (all of it if underwater), seizing collateral plus a 10% bonus — half theirs, half the vault’s. The vault’s half accumulates as protocol collateral, and anyone can send it to the furnace: burnProtocolCollateral() destroys that AUR, raising the GLD backing of every remaining claim. The desk is transfer-tax exempt, and its only treasury power is a narrowly-scoped USDG payout path — it can lend, and nothing more.

Most staking programs print yield out of thin air and call it revenue. AURUM runs the opposite rule: GLD backing per AUR is not permitted to fall. Backing is measured in GLD terms at a reference USDG/GLD rate that is oracle-driven, synced once per epoch with an asymmetric clamp: it rises freely (a higher rate only ever makes the revenue bar stricter) and falls at most 5% per epoch, and a stale oracle simply keeps the last rate — so a gold dip cannot fabricate revenue. Once per eight-hour epoch a permissionless poke() compares backing per AUR against its all-time high-water mark: only growth above the mark — genuine unbacked inflow from transfer-tax proceeds, lending interest and assay fees — funds an emission, capped at exactly the amount that leaves backing untouched. Borrow/repay round-trips and price moves print nothing (loan principal counts as vault value), and while the genesis gold acquisition is still converting, nothing is minted at all. The minted AUR opens that epoch’s per-second reward stream, claimed by stakers on the Stake page.

Genesis allocations vest over five days from finalization. If you would rather not wait, the sale contract offers a one-way door: claim early and half of your total allocation is burned forever while the other half is released to you immediately (less anything already claimed). The allocation then closes for good — there is no partial exit and no return. Burned AUR never touched the market, so treasury GLD is divided among fewer claims: the exit of the impatient pays the patient.

A vault can have a little theater. The Button is a standing game of nerve: every press costs 5 USDG and resets the round clock. 80% of each press feeds the round pot; 20% goes straight to the treasury as backing. When the clock finally runs to zero, the last presser takes the whole pot — and anyone can call settle() to pay them and open the next round.

Every press mints a transferable Press NFT (round, press number, timestamp, fully on-chain art). Those presses are not just receipts: they are the key to the vault’s future interactive components — hold them. A round that expires with zero presses simply rolls its deadline forward, so the button never dies, it only waits.

The team takes no allocation at genesis and earns no fee stream — ever. The only path to compensation is the incentives bond, and it only activates if the protocol succeeds first: it unlocks only after the market capitalization has held above $1M for seven straight days (anyone can reset the clock on a dip) and genesis conversion is complete, is restricted to allow-listed team addresses, and prices AUR at the vault’s full treasury value per AUR — never below the GLD floor every holder can redeem at — so the vault gains gold and no holder loses backing. It is hard-capped at 10% of supply, cumulative, so the right vests with growth. The team also receives a 10% carry on every revenue-funded emission, carved out of the emission rather than added to it, vesting over five days. If the vault never grows, the team never earns. That is the alignment.

AUR and sAUR are cryptoassets, not securities, shares, or deposits. Holding AUR confers no claim on GLD, on physical gold, on SPDR Gold Shares, or on any issuer, custodian, or person. The treasury’s assets belong to the protocol, not to token holders.

GLD (0xC9a981FE…eBFC4e) is a beacon-proxy token issued by a third party on Robinhood Chain. The issuer can upgrade, pause, or freeze it, and on-chain liquidity is limited to a few million dollars. This is a core, known risk of the protocol — treat the vault’s gold as only as reliable as its issuer. Smart-contract risk, oracle risk, and total loss of value are all possible. Nothing in this manual is investment, legal, or tax advice. Do not bond, stake, or buy with funds you cannot afford to lose.