Role: Sender (María in Madrid sending €100 to Elena in Caracas)
Feature: Automatic refund protection without manual intervention
Philosophy: It’s the user’s money. Protection should be automatic, not manual.
Traditional wallets: User must remember to check, decide, and click “refund.”
Asgaya: User sets conditions once. System monitors automatically. Refunds when appropriate. No refund button.
Why this matters: Senders fund the infrastructure (pay fiat to sellers, enable ecosystem). They deserve zero-friction UX.
María sees conditions explained once at covenant creation:
┌─────────────────────────────────────┐
│ 💸 Sending €100.00 / 84000 VES │
│ To: Elena#142 │
│ │
│ You will be automatically │
│ refunded if: │
│ • Not claimed in 8 hours │
│ • BCH price drops >7% (€930) │
│ │
│ ✅ selected BCH seller fee 0.5% │
│ [ request Payment instructions] │
│ total €100.50 │
│ │
└─────────────────────────────────────┘
Key insight: Conditions shown upfront. María understands protection before paying.
After María pays Isabel via Bizum, she sees:
┌─────────────────────────────────────┐
│ 💸 Sending €100.00 │
│ To: Elena#142 │
│ │
│ ⏰ Expires in: 7h 58min │
│ 📊 Price: €995/BCH ✅ │
│ 🔒 Covenant: 0.0107 BCH locked │
│ │
│ ● Payment Active │
│ 🤖 Auto-monitoring enabled │
│ │
│ Waiting for Elena to claim... │
│ │
│ ← Back │
└─────────────────────────────────────┘
What’s happening in background:
Note: No “Refund” button visible. System handles it automatically.
When price drops 3% (early warning), María sees:
┌─────────────────────────────────────┐
│ 💸 Sending €100.00 │
│ To: Elena#142 │
│ │
│ ⏰ Expires in: 6h 12min │
│ ⚠️ Price: €970/BCH (-3%) │
│ 🔒 Covenant: 0.0107 BCH locked │
│ │
│ ⚠️ Price Drop Warning │
│ │
│ BCH dropped 3%. Auto-refund will │
│ trigger if it drops below €930 │
│ (7% threshold). │
│ │
│ No action needed - monitoring. │
│ │
│ ← Back │
└─────────────────────────────────────┘
What this is:
When price drops below €930 (7% threshold), system automatically refunds and protects the value by default.
┌─────────────────────────────────────┐
│ ✅ Refund Protected │
│ │
│ Price dropped >7% (€930/BCH) │
│ │
│ ✅ Protected: 100 H€ │
│ (equivalent to €100) │
│ │
│ Remittance can still complete. │
│ Elena can cash out H€. │
│ │
│ [Send H€ to Elena] │
└─────────────────────────────────────┘
Note: H€ minting uses bull pool capacity. If pool exhausted, you’ll receive BCH instead.
What happened automatically (default setting):
María did nothing. System protected her automatically.
Why automatic protection:
Technical note: Covenant would reject Elena’s claim anyway (price < floor). Auto-refund + H€ minting preserves the remittance value.
When Elena doesn’t claim within 8 hours, system automatically refunds and protects the value by default.
┌─────────────────────────────────────┐
│ ✅ Refund Protected │
│ │
│ Timeout: Not claimed in 8 hours │
│ │
│ ✅ Protected: 100 H€ │
│ (swapped from 0.0107 BCH) │
│ │
│ Your €100 value preserved. │
│ Elena can still cash out. │
│ │
│ [Send H€ to Elena] [View Swap] │
└─────────────────────────────────────┘
Note: BCH → H€ swap requires H€ seller on bulletin board. If no liquidity, you’ll receive BCH instead.
What happened automatically (default setting):
Why automatic swap:
Technical note: H€ tokens are native BCH tokens (CashTokens). Anyone can be an H€ seller on the bulletin board - completely permissionless role. Phase 0: Asgaya bootstraps liquidity.
Edge case handled: If María’s device was offline, seller or recipient device would trigger refund. If all offline, María’s device refunds when back online. Auto-swap happens when device reconnects.
Traditional wallet might show:
⚠️ Refund Conditions Not Met
Time remaining: 6h 12min
Price: €970 (above floor €930)
Refund anyway? This may be unfair to recipient.
[Cancel] [Refund Anyway]
Asgaya doesn’t show this. System decides based on pre-agreed conditions. No decision fatigue.
Default behavior (90% of users):
Advanced users can configure:
┌─────────────────────────────────────┐
│ ⚙️ Auto-Refund Protection │
│ │
│ ● Automatic (Recommended) │
│ Protect refunds from volatility │
│ • Price drop: Mint H€ │
│ • Timeout: Swap BCH → H€ │
│ │
│ ○ Manual Control │
│ You decide after each refund │
│ ⚠️ Exposed to volatility │
│ │
│ ○ Always BCH │
│ Never auto-convert │
│ ⚠️ Maximum volatility exposure │
│ │
│ [Save Settings] │
└─────────────────────────────────────┘
For most senders:
Example scenario without auto-protect:
t=0: Price drops >7% → refund triggered
t=5: María sees notification: "Convert to H€?"
t=10: María clicks "Yes" → price dropped another 3%
Result: Lost €3 waiting for user input
With auto-protect (default):
t=0: Price drops >7% → refund + mint H€ (instant)
t=5: María sees notification: "✅ Protected: 100 H€"
Result: €100 value preserved
Disable if: You’re bullish on BCH, trading rather than sending remittances, or accept full volatility risk. For everyone else: Leave it on (automatic protection).
When auto-protect can’t execute:
Price drop abort:
Timeout:
Phase 0 note: Asgaya bootstraps both bull pool and H€ bulletin board liquidity. Edge cases unlikely but possible during high volatility.
How auto-refund monitoring works:
How price monitoring works:
Price Discovery from Real Trades
Market Price Calculation
Covenant Monitoring
Benefits:
When any device detects refund condition:
// Device broadcasts alert
nostr.publish('asgaya:covenant:abc123', {
type: 'PRICE_DROP_ALERT',
currentPrice: 920,
threshold: 930,
action: 'TRIGGERING_REFUND'
});
Other devices see alert:
Everyone informed instantly. No coordination failures.
Nostr message types used:
PRICE_DROP_ALERT - Any device detects >7% dropREFUND_BROADCAST - Sender broadcasted refund txREFUND_CONFIRMED - Refund tx confirmed (seller gets buffer)CLAIM_BROADCAST - Recipient broadcasted claim txCLAIM_CONFIRMED - Claim tx confirmed (seller gets buffer)Full Nostr message schema documented in Distributed Monitoring
Core philosophy: It’s the user’s money. Covenants should enable, not imprison.
Asgaya’s approach:
Why automatic protection by default:
Manual prompt approach:
⚠️ Price dropped >7%. Convert to H€?
[Yes] [No]
Automatic approach (Asgaya):
✅ Refund Protected
Protected: 100 H€ (equivalent to €100)
The difference: Volatility doesn’t wait for user input. In 30 seconds, price could drop another 2%. Automatic protection (configurable in Settings) serves 90% of users who want stability, not volatility exposure.
Full rationale: See Covenant Simplicity Principle for the complete design philosophy and Bitcoin protocol analogy.
Scenario: Price drops >7%, but María’s phone is dead.
What happens:
Result: María gets refund even if offline. Redundancy works.
Scenario: Price drops >7%, but María, Elena, and Isabel all offline.
What happens:
Edge case: Elena’s claim would fail anyway (price < floor), so no urgency. María gets BCH back whenever her device reconnects.
Scenario: María sent payment but realizes Elena doesn’t need it.
Asgaya position: This is discouraged but not prevented.
What María can do:
Why not easy refund button:
If truly urgent: María can broadcast refund manually (covenant allows it). App just doesn’t make it easy.
This UX succeeds when:
| Traditional Wallet | Asgaya |
|---|---|
| User must check status manually | Automatic monitoring |
| “Refund” button always visible | No button (auto-refunds) |
| User decides when to refund | App decides (pre-agreed conditions) |
| User decides if/when to stabilize | Auto-protect by default (configurable) |
| Funds stuck if user forgets to refund | Impossible - auto-refund guaranteed |
| Volatility exposure on refunds | Automatic H€ minting/swap (default) |
| Complex UI with many options | Simple - just status display |
| Decision fatigue (“Should I refund?”) | Zero decisions - just notifications |
| Emergency escape requires manual refund | Same (advanced users can broadcast) |
Why this design:
How it works:
Full sender journey:
| 🏠 Home | ↑ Sender Journey | 📖 Glossary |
Related: Covenant Simplicity
Status: Phase 1.5 - Documentation (auto-refund UX designed, implementation planned)
Updated: 2026-07-25