App Account

An AppAccount is the bridge between Platus's shielded pool and the public DeFi world. It lets a private note drive an arbitrary on-chain call: a swap, a deposit into a lending market, a mint — while keeping the user's identity and other positions unlinkable.

Each AppAccount is a per-(user, application) EOA, installed via EIP-7702 delegation onto an address deterministically derived from the user's key subtree. One EOA per dApp means a protocol can keep persistent per-account state, while your activity stays unlinkable across dApps.

Key derivation for these accounts is covered in Wallet & Client Security.

How an action executes

A "public route" Action attaches an actionPayload = abi.encode(ActionCall) and an actionGas cap. During settlement, the Orchestrator routes the action's amount to the AppAccount and calls execute:

The authorization model is intentionally minimal: per-op ECDSA signature + per-app fund siloing. The EOA signs the actionDigest (which binds chainid, the Orchestrator, the Vault, the deadline, the Action's nullifiers/commitments/cv_net/rks, and the call's target/amount/callData). AppAccount.execute re-binds address(this) and chainid before recovery, so a signature is not portable across accounts or chains.