This repository contains a design document only. There is no source code here.
Everything below describes an intended architecture. Any performance figure, benchmark, latency target, throughput number or Sharpe ratio in this document is a design target that has never been measured, not a result. Installation and usage instructions describe files that do not exist in this repository.
It is published as a specification and planning artefact. For systems that are actually built and tested, see web3-infrastructure.
A comprehensive collection of Real World Asset tokenization implementations — from fractional real estate and tokenized treasuries to private credit pools, commodity-backed tokens, and compliant security token infrastructure. Built to understand the $62B+ RWA ecosystem at the smart contract level.
- Overview
- Why RWA Tokenization?
- RWA Ecosystem Landscape
- Tech Stack
- Projects
- How RWA Tokenization Works
- Architecture Diagrams
- Repository Structure
- Getting Started
- Development Workflow
- Testing
- Security
- Legal & Compliance
- Deployment
- Key Concepts
- Top RWA Tokens
- Resources
- Contributing
- License
Real World Assets are the largest untapped market in crypto. Trillions of dollars in real estate, bonds, credit, and commodities sit in legacy systems with poor liquidity, high barriers to entry, and opaque markets. Tokenization puts these assets on-chain — enabling fractional ownership, 24/7 trading, instant settlement, and composability with DeFi.
What you'll build:
- Security token standards (ERC-3643, ERC-1400) with transfer restrictions and compliance
- Fractional real estate — own a piece of a building as an NFT or fungible token
- Tokenized US Treasuries and bonds that earn yield on-chain
- Private credit pools — underwrite and fund real-world loans on-chain
- Commodity-backed tokens — gold, oil, carbon credits on the blockchain
- Compliant issuance platforms with KYC/AML, investor accreditation, and transfer agents
- Oracle systems that bridge off-chain asset data to on-chain contracts
- Secondary marketplaces for trading security tokens
- Dividend and coupon distribution systems
| Traditional Assets | Tokenized RWAs |
|---|---|
| Minimum $50K-$250K for real estate | Fractional: invest from $100 |
| Settlement in T+2 days (stocks) | Instant settlement on-chain |
| Trading hours: Mon-Fri 9:30-4:00 | 24/7/365 global trading |
| Opaque pricing, broker-dependent | Transparent, auditable on-chain pricing |
| Complex paperwork, lawyers, escrow | Programmable compliance, automated cap tables |
| Limited to accredited investors | Global access (within regulatory bounds) |
| Illiquid (real estate, private credit) | Liquid secondary markets via AMMs and order books |
| Dividend distribution: weeks/months | Automated, instant distribution to token holders |
| $300T+ global asset market | <$62B tokenized today — massive growth ahead |
┌──────────────────────────────────────────────────────────────────────────────┐
│ RWA TOKENIZATION ECOSYSTEM │
│ │
│ ┌─────────────────────┐ ┌──────────────────────┐ ┌────────────────────┐ │
│ │ Tokenization │ │ Treasuries & Bonds │ │ Private Credit │ │
│ │ Platforms │ │ │ │ │ │
│ │ • Securitize │ │ • Ondo Finance (USDY) │ │ • Centrifuge │ │
│ │ • Polymath │ │ • BlackRock (BUIDL) │ │ • Goldfinch │ │
│ │ • Tokeny (ERC-3643) │ │ • Franklin Templeton │ │ • Maple Finance │ │
│ │ • RealT │ │ • Backed Finance │ │ • TrueFi │ │
│ │ • Centrifuge │ │ • Matrixdock (STBT) │ │ • Credora │ │
│ └─────────────────────┘ └──────────────────────┘ └────────────────────┘ │
│ │
│ ┌─────────────────────┐ ┌──────────────────────┐ ┌────────────────────┐ │
│ │ Real Estate │ │ Commodities │ │ Identity & KYC │ │
│ │ │ │ │ │ │ │
│ │ • RealT │ │ • Paxos Gold (PAXG) │ │ • Polygon ID │ │
│ │ • Lofty │ │ • Tether Gold (XAUT) │ │ • Civic │ │
│ │ • Landshare │ │ • Toucan (carbon) │ │ • Fractal ID │ │
│ │ • Parcl │ │ • KlimaDAO (carbon) │ │ • Synaps │ │
│ │ • Tangible │ │ • Agrotoken │ │ • ERC-3643 ONCHAINID│ │
│ └─────────────────────┘ └──────────────────────┘ └────────────────────┘ │
│ │
│ ┌─────────────────────┐ ┌──────────────────────┐ ┌────────────────────┐ │
│ │ Oracles / Data │ │ DeFi Integration │ │ Marketplaces │ │
│ │ │ │ │ │ │ │
│ │ • Chainlink (PoR) │ │ • MakerDAO (RWA │ │ • tZERO │ │
│ │ • Chronicle │ │ vaults) │ │ • INX │ │
│ │ • API3 │ │ • Aave (GHO + RWA) │ │ • Securitize Markets│ │
│ │ • Tellor │ │ • Frax (sFRAX) │ │ • OpenSea (real │ │
│ │ • RedStone │ │ • Sky/Spark │ │ estate NFTs) │ │
│ └─────────────────────┘ └──────────────────────┘ └────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────┘
| Layer | Technology |
|---|---|
| Smart Contracts | Solidity 0.8.x |
| Frameworks | Foundry, Hardhat |
| Security Token Stds | ERC-3643 (T-REX), ERC-1400/1404, ERC-20 + restrictions |
| NFT Standards | ERC-721, ERC-1155, ERC-6551 (Token Bound Accounts) |
| Vault Standards | ERC-4626 (yield-bearing tokens) |
| Identity | ERC-3643 ONCHAINID, Polygon ID, Civic, ZK-proofs |
| Oracles | Chainlink Proof of Reserve, Chronicle, API3 |
| Compliance | Transfer restrictions, whitelists, lock-up periods |
| DeFi Composability | Aave, MakerDAO, Uniswap (for secondary liquidity) |
| Legal Wrapper | SPV (Special Purpose Vehicle), LLC, Trust structures |
| Frontend | Next.js, React, wagmi, viem |
| Indexing | The Graph, Ponder |
| Networks | Ethereum, Base, Polygon, Avalanche, Arbitrum |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 01 | ERC-3643 Security Token (T-REX) | Fully compliant security token with identity registry and transfer rules | T-REX, ONCHAINID, compliance modules |
| 02 | ERC-1400 Security Token | Partitioned security token with document management and controller operations | Tranches, forced transfers, document URI |
| 03 | Restricted Transfer Token | ERC-20 with whitelist, blacklist, lock-up, and max-holder restrictions | Transfer hooks, compliance rules, modular |
| 04 | Token Factory (Multi-Asset) | Deploy new tokenized assets permissionlessly with configurable compliance | Factory pattern, CREATE2, registry |
| 05 | Cap Table Manager | On-chain shareholder registry with vesting, dilution, and corporate actions | Cap table, equity math, vesting schedules |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 06 | Fractional Property Token | Tokenize a single property into fungible shares — buy/sell fractions | Fractional ownership, SPV, dividend distribution |
| 07 | Real Estate NFT (Deed Token) | Each property is a unique NFT with legal deed metadata and title history | NFT deed, metadata standards, title chain |
| 08 | Rental Income Distribution | Collect rent off-chain, distribute yield to token holders proportionally | Revenue distribution, claim system, oracle |
| 09 | Property DAO | Token holders vote on property decisions — renovate, sell, change tenants | Governance, proposal, quorum, execution |
| 10 | Real Estate Marketplace | Secondary market for trading property tokens with compliance checks | Order book, whitelist-gated trading |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 11 | Tokenized US Treasury (T-Bill Token) | ERC-4626 vault backed by US Treasury bills — earn risk-free yield on-chain | T-bill backing, NAV calculation, rebasing |
| 12 | Yield-Bearing Stablecoin | Stablecoin that automatically earns treasury yield (like USDY, BUIDL) | Rebasing, accrual, transfer restrictions |
| 13 | Corporate Bond Token | Tokenized bond with coupon payments, maturity date, and callable features | Coupon schedule, maturity, call/put options |
| 14 | Bond Ladder Vault | Auto-rolling treasury positions across different maturity dates | Ladder strategy, roll management, duration |
| 15 | Fixed Income AMM | AMM optimized for yield-bearing assets — trade bonds with low slippage | Yield curves, duration-adjusted pricing |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 16 | Senior/Junior Tranche Lending Pool | Structured credit with senior (low risk) and junior (high risk) tranches | Tranching, waterfall, first-loss capital |
| 17 | Invoice Factoring Protocol | Businesses tokenize invoices and sell at discount for immediate capital | Invoice NFT, discount rate, recourse |
| 18 | Revenue-Based Financing | Lend against future revenue — repayment scales with business performance | Revenue share, repayment cap, oracle feed |
| 19 | Real-World Loan Origination | Full loan lifecycle — application, underwriting, funding, servicing, repayment | Loan NFT, amortization, default handling |
| 20 | Credit Risk Oracle | Bring off-chain credit data on-chain — business financials, credit ratings | Oracle, attestation, credit scoring |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 21 | Gold-Backed Token | Each token redeemable for physical gold held in audited vaults | Proof of Reserve, redemption, custody |
| 22 | Carbon Credit Token | Tokenize verified carbon offsets — retire on-chain for ESG compliance | Carbon registry, retirement, vintage |
| 23 | Agricultural Commodity Token | Tokenize crop yields — soybeans, corn, wheat backed by physical delivery | Commodity pricing, delivery, seasonal cycles |
| 24 | Art & Collectibles Fractionalization | Fractionalize high-value art, wine, and collectibles into tradeable shares | Appraisal oracle, custody proof, insurance |
| 25 | Tokenized Precious Metals Vault | Multi-metal vault (gold, silver, platinum) with real-time NAV and redemption | Multi-asset vault, NAV oracle, rebalancing |
| # | Project | Description | Key Concepts |
|---|---|---|---|
| 26 | Transfer Agent Smart Contract | On-chain transfer agent — manage shareholder registry, corporate actions | Transfer agent, reg compliance, record keeping |
| 27 | Investor Accreditation Verifier | Verify accredited investor status using ZK proofs (no PII on-chain) | Reg D/S, accreditation, ZK verification |
| 28 | Proof of Reserve Oracle | Chainlink-style PoR — cryptographically prove off-chain assets back tokens | Attestation, auditor nodes, reserve ratio |
| 29 | Dividend / Coupon Distributor | Automated proportional distribution of yield to all token holders | Snapshot, Merkle distribution, claim/push |
| 30 | RWA-DeFi Bridge | Enable RWA tokens as collateral in DeFi — MakerDAO vault, Aave market | Collateral adapter, risk parameters, oracle |
┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ ORIGINATE│───►│ STRUCTURE│───►│ TOKENIZE │───►│ DISTRIBUTE│──►│ MANAGE │
│ │ │ │ │ │ │ │ │ │
│ Identify │ │ Legal │ │ Deploy │ │ Primary │ │ Secondary │
│ asset │ │ wrapper │ │ smart │ │ offering │ │ trading │
│ │ │ (SPV/LLC) │ │ contracts │ │ to │ │ │
│ Due │ │ │ │ │ │ investors │ │ Yield │
│ diligence │ │ Reg D/S/A │ │ Mint │ │ │ │ distribution│
│ │ │ compliance│ │ tokens │ │ KYC/AML │ │ │
│ Appraisal │ │ │ │ │ │ checks │ │ Corporate │
│ │ │ Custody │ │ Set rules │ │ │ │ actions │
│ │ │ agreement │ │ │ │ Fund │ │ │
└──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘
┌────────────────────────────────────────────────────────────────────────────┐
│ FRACTIONAL REAL ESTATE TOKENIZATION │
│ │
│ Physical Property: 123 Main St, Austin TX │
│ Appraised Value: $1,000,000 │
│ │
│ Step 1: LEGAL STRUCTURE │
│ ┌────────────────────────────────────────────┐ │
│ │ SPV (Special Purpose Vehicle) │ │
│ │ "123 Main St LLC" │ │
│ │ │ │
│ │ • Owns the property │ │
│ │ • Manages rental income │ │
│ │ • Handles taxes, insurance, maintenance │ │
│ │ • Governed by operating agreement │ │
│ └──────────────────────┬─────────────────────┘ │
│ │ │
│ Step 2: TOKENIZE │ ownership of SPV │
│ ┌──────────────────────┴─────────────────────┐ │
│ │ Smart Contract: PropertyToken.sol │ │
│ │ │ │
│ │ Total Supply: 1,000,000 tokens │ │
│ │ Price per Token: $1.00 │ │
│ │ Token Standard: ERC-3643 │ │
│ │ Transfer Restrictions: KYC whitelist │ │
│ └──────────────────────┬─────────────────────┘ │
│ │ │
│ Step 3: INVEST │ │
│ ┌──────────────────────┴─────────────────────┐ │
│ │ │ │
│ │ Alice buys 100,000 tokens ($100K) → 10% │ │
│ │ Bob buys 50,000 tokens ($50K) → 5% │ │
│ │ Carol buys 10,000 tokens ($10K) → 1% │ │
│ │ ... 200+ other investors │ │
│ └──────────────────────┬─────────────────────┘ │
│ │ │
│ Step 4: EARN │ │
│ ┌──────────────────────┴─────────────────────┐ │
│ │ Monthly Rent: $5,000 │ │
│ │ - Management fee (10%): -$500 │ │
│ │ - Expenses: -$500 │ │
│ │ = Distributable: $4,000/month │ │
│ │ │ │
│ │ Alice (10%): $400/month │ │
│ │ Bob (5%): $200/month │ │
│ │ Carol (1%): $40/month │ │
│ │ │ │
│ │ Annual yield: $48,000 / $1M = 4.8% APY │ │
│ └─────────────────────────────────────────────┘ │
│ │
│ Step 5: TRADE (secondary market) │
│ Alice sells 50,000 tokens to Dave on marketplace │
│ Transfer agent verifies Dave is KYC'd and whitelisted │
│ Ownership updated on-chain instantly │
└────────────────────────────────────────────────────────────────────────────┘
Investor Protocol Off-Chain Treasury
│ │ │ │
├── deposit USDC ─────►│ │ │
│ ($100,000) │ │ │
│ ├── mint T-Bill Tokens ───►│ │
│ │ (100,000 tokens) │ │
│◄── receive tokens ──┤ │ │
│ │ │ │
│ │── transfer USDC ─────────► │
│ │ to custody account │ │
│ │ ├── purchase T-Bills ─────►│
│ │ │ ($100K, 5.25% yield) │
│ │ │ │
│ │ [yield accrues daily] │
│ │ │ │
│ │◄── NAV update ───────────┤ │
│ │ (Chainlink PoR oracle) │ │
│ │ │ │
│ Token value: $1.00 → $1.0144 (after 1 month at 5.25%) │
│ │ │ │
│── redeem tokens ────►│ │ │
│ ├── burn tokens │ │
│ │── request liquidation ──►│ │
│ │ ├── sell T-Bills ─────────►│
│ │◄── USDC returned ────────┤ │
│◄── receive USDC ────┤ │ │
│ ($101,440) │ │ │
┌────────────────────────────────────────────────────────────────────────┐
│ STRUCTURED CREDIT POOL │
│ │
│ Real-World Loans: $10M total (SME lending, invoice factoring) │
│ Expected Yield: 12% APR │
│ Expected Default: 3% │
│ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ │ │
│ │ SENIOR TRANCHE (70% = $7M) JUNIOR TRANCHE (30% = $3M)│ │
│ │ ┌─────────────────────┐ ┌─────────────────────┐ │ │
│ │ │ │ │ │ │ │
│ │ │ Lower yield: 6% │ │ Higher yield: 26% │ │ │
│ │ │ Lower risk │ │ Higher risk │ │ │
│ │ │ Paid FIRST │ │ Paid LAST │ │ │
│ │ │ │ │ │ │ │
│ │ │ Protected by │ │ Absorbs FIRST │ │ │
│ │ │ junior tranche │ │ losses │ │ │
│ │ │ (first-loss buffer)│ │ (first-loss capital)│ │ │
│ │ │ │ │ │ │ │
│ │ └─────────────────────┘ └─────────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────────────┘ │
│ │
│ WATERFALL (how repayments flow): │
│ │
│ Loan Repayments ($1.2M/year) │
│ │ │
│ ├──► 1. Senior interest ($420K = 7M × 6%) │
│ ├──► 2. Senior principal (if redemption) │
│ ├──► 3. Junior interest (remaining → $780K target) │
│ └──► 4. Junior principal (if redemption) │
│ │
│ DEFAULT SCENARIO (3% = $300K loss): │
│ │ │
│ ├──► Senior: fully protected (0% loss) │
│ └──► Junior: absorbs $300K ($3M → $2.7M = 10% loss) │
│ Junior still earns: (780K - 300K) / 3M = 16% net yield │
└────────────────────────────────────────────────────────────────────────┘
┌──────────────────────────────────────────────────────────────────────┐
│ PROOF OF RESERVE (PoR) │
│ │
│ On-Chain Off-Chain │
│ ┌──────────────┐ ┌──────────────────────┐ │
│ │ Token Contract│ │ Custodian / Vault │ │
│ │ │ │ │ │
│ │ totalSupply: │ Chainlink │ Gold bars: 1,000 oz │ │
│ │ 1,000 GOLD │◄─── PoR Oracle ─────┤ Audited monthly │ │
│ │ │ │ Serial #s on file │ │
│ │ Each token = │ Attestation: │ │ │
│ │ 1 oz gold │ reserves ≥ │ Third-party auditor │ │
│ │ │ totalSupply │ confirms holdings │ │
│ └──────────────┘ └──────────────────────┘ │
│ │
│ Verification Flow: │
│ │
│ 1. Auditor inspects physical vault → signs attestation │
│ 2. Chainlink node reads attestation → posts on-chain │
│ 3. Smart contract checks: reserves >= totalSupply │
│ 4. If under-reserved: pause minting, trigger alert │
│ 5. Anyone can verify: call proofOfReserve() on-chain │
│ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ function mint(address to, uint256 amount) external { │ │
│ │ require( │ │
│ │ reserveOracle.latestReserve() >= │ │
│ │ totalSupply() + amount, │ │
│ │ "Insufficient reserves" │ │
│ │ ); │ │
│ │ _mint(to, amount); │ │
│ │ } │ │
│ └──────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────────┐
│ INVESTOR LAYER │
│ ┌──────────────┐ ┌──────────────────┐ ┌──────────────────────────────┐ │
│ │ Investor App │ │ Marketplace │ │ Portfolio Dashboard │ │
│ │ (Web/Mobile) │ │ (Secondary Trade) │ │ (Holdings, Yield, Docs) │ │
│ └──────┬───────┘ └────────┬─────────┘ └──────────────┬───────────────┘ │
└─────────┼──────────────────┼────────────────────────────┼───────────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ COMPLIANCE GATEWAY │
│ ┌────────────┐ ┌─────────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ KYC/AML │ │ Accreditation │ │ Transfer │ │ Sanctions │ │
│ │ Verification │ │ Verification │ │ Restrictions │ │ Screening │ │
│ │ (ZK / Civic) │ │ (Reg D/S check) │ │ (Whitelist) │ │ (OFAC) │ │
│ └────────────┘ └─────────────────┘ └──────────────┘ └──────────────┘ │
└──────────────────────────────┬──────────────────────────────────────────────┘
│
┌──────────────────────────────┼──────────────────────────────────────────────┐
│ SMART CONTRACT LAYER │
│ │ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Security Token│ │ Compliance │ │ Dividend │ │ Marketplace │ │
│ │ (ERC-3643 / │ │ Module │ │ Distributor │ │ (Order Book) │ │
│ │ ERC-1400) │ │ │ │ │ │ │ │
│ │ │ │ • Whitelist │ │ • Snapshot │ │ • List/delist│ │
│ │ • Mint/burn │ │ • Lock-up │ │ • Claim │ │ • Bid/ask │ │
│ │ • Transfer │ │ • Max holders│ │ • Push dist │ │ • Settlement │ │
│ │ • Partition │ │ • Jurisdiction│ │ • Reinvest │ │ • Compliance │ │
│ └──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘ │
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Cap Table │ │ Proof of │ │ RWA-DeFi │ │
│ │ Manager │ │ Reserve Oracle│ │ Bridge │ │
│ │ │ │ │ │ │ │
│ │ • Shareholders│ │ • NAV feed │ │ • Collateral│ │
│ │ • Vesting │ │ • Reserve │ │ adapter │ │
│ │ • Corp actions│ │ attestation│ │ • MakerDAO │ │
│ │ • Voting │ │ • Audit proof│ │ • Aave │ │
│ └──────────────┘ └──────────────┘ └──────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
│
┌──────────────────────────────┼──────────────────────────────────────────────┐
│ OFF-CHAIN LAYER │
│ │ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Legal Entity │ │ Custodian │ │ Auditor │ │ Transfer │ │
│ │ (SPV / LLC) │ │ (Assets) │ │ (Attestation)│ │ Agent │ │
│ └──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
rwa-tokenization-projects/
├── 01-erc3643-security-token/
│ ├── src/
│ │ ├── SecurityToken.sol
│ │ ├── IdentityRegistry.sol
│ │ ├── ComplianceModule.sol
│ │ ├── TrustedIssuersRegistry.sol
│ │ └── interfaces/
│ ├── test/
│ │ ├── SecurityToken.t.sol
│ │ ├── Compliance.t.sol
│ │ └── invariant/
│ ├── script/
│ ├── foundry.toml
│ └── README.md
├── 06-fractional-property/
│ ├── src/
│ │ ├── PropertyToken.sol
│ │ ├── PropertySPV.sol
│ │ └── RentalDistributor.sol
│ ├── test/
│ └── README.md
├── 11-tokenized-treasury/
│ ├── src/
│ │ ├── TBillVault.sol ← ERC-4626 vault
│ │ ├── NAVOracle.sol
│ │ └── RedemptionQueue.sol
│ ├── test/
│ │ └── fork/
│ └── README.md
├── 16-tranche-lending-pool/
│ ├── src/
│ │ ├── SeniorTranche.sol
│ │ ├── JuniorTranche.sol
│ │ ├── LoanManager.sol
│ │ └── Waterfall.sol
│ ├── test/
│ └── README.md
├── 21-gold-backed-token/
│ ├── src/
│ │ ├── GoldToken.sol
│ │ ├── ProofOfReserve.sol
│ │ └── RedemptionGateway.sol
│ ├── test/
│ └── README.md
├── 28-proof-of-reserve/
│ ├── src/
│ │ ├── PoROracle.sol
│ │ ├── ReserveVerifier.sol
│ │ └── interfaces/
│ ├── test/
│ └── README.md
├── lib/ # Shared Solidity dependencies
│ ├── forge-std/
│ ├── openzeppelin-contracts/
│ ├── T-REX/ # ERC-3643 reference
│ └── solmate/
├── interfaces/ # Common RWA interfaces
│ ├── ISecurityToken.sol
│ ├── IComplianceModule.sol
│ ├── IIdentityRegistry.sol
│ ├── IProofOfReserve.sol
│ └── IDividendDistributor.sol
├── libraries/ # Shared utilities
│ ├── ComplianceLib.sol
│ ├── NAVMath.sol
│ ├── WaterfallLib.sol
│ └── DistributionLib.sol
└── README.md
- Foundry —
curl -L https://foundry.paradigm.xyz | bash && foundryup - Node.js >= 18.x (for frontends and tooling)
- Git
- An RPC provider account (Alchemy or Infura)
# Clone the repository
git clone https://github.com/pranay123-stack/rwa-tokenization-projects.git
cd rwa-tokenization-projects
# Navigate to a project
cd 01-erc3643-security-token
# Install dependencies
forge install
# Build
forge build
# Run tests
forge test -vvvcp .env.example .env# RPC Endpoints
MAINNET_RPC_URL=https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY
BASE_RPC_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
POLYGON_RPC_URL=https://polygon-mainnet.g.alchemy.com/v2/YOUR_KEY
AVALANCHE_RPC_URL=https://avax-mainnet.g.alchemy.com/v2/YOUR_KEY
SEPOLIA_RPC_URL=https://eth-sepolia.g.alchemy.com/v2/YOUR_KEY
# Deployment
PRIVATE_KEY=your_deployer_private_key
ETHERSCAN_API_KEY=your_etherscan_api_key
# Oracles
CHAINLINK_POR_FEED=0x...
NAV_ORACLE_ADDRESS=0x...
# Compliance
KYC_PROVIDER_API_KEY=your_kyc_key
IDENTITY_REGISTRY=0x...
# Off-Chain
CUSTODIAN_API_KEY=your_custodian_api
TRANSFER_AGENT_ENDPOINT=https://api.transfer-agent.comNever commit private keys or API secrets. All projects include
.gitignorewith.envexcluded.
# Compile
forge build
# Run all tests
forge test
# Fork test against live MakerDAO / Aave
forge test --fork-url $MAINNET_RPC_URL --match-path "test/fork/*" -vvv
# Gas report
forge test --gas-report
# Deploy
forge script script/Deploy.s.sol --rpc-url $BASE_RPC_URL --broadcast --verify
# Interact with deployed token
cast call $TOKEN "totalSupply()" --rpc-url $BASE_RPC_URL
cast call $TOKEN "balanceOf(address)" $INVESTOR --rpc-url $BASE_RPC_URL# Unit Tests — individual functions (mint, transfer, compliance)
forge test --match-path "test/unit/*"
# Integration Tests — full asset lifecycle
forge test --match-path "test/integration/*"
# Fuzz Tests — random amounts, addresses, edge cases
forge test --match-path "test/fuzz/*"
# Invariant Tests — properties that must always hold
forge test --match-path "test/invariant/*"
# Fork Tests — test against live DeFi protocols
forge test --match-path "test/fork/*" --fork-url $MAINNET_RPC_URL
# Compliance Tests — transfer restriction scenarios
forge test --match-path "test/compliance/*"// Token supply must never exceed Proof of Reserve
function invariant_supplyBackedByReserves() public {
uint256 totalSupply = token.totalSupply();
uint256 reserves = porOracle.latestReserve();
assertLe(totalSupply, reserves, "Supply exceeds reserves");
}
// Only whitelisted investors can hold tokens
function invariant_onlyWhitelistedHolders() public {
address[] memory holders = token.getHolders();
for (uint i = 0; i < holders.length; i++) {
assertTrue(
identityRegistry.isVerified(holders[i]),
"Non-verified holder detected"
);
}
}
// Lock-up: tokens transferred during lock-up period must revert
function invariant_lockupEnforced() public {
if (block.timestamp < token.lockupEndDate()) {
vm.prank(investor);
vm.expectRevert("Transfer restricted: lock-up period");
token.transfer(recipient, amount);
}
}
// Dividend distribution: total claimed must equal total distributed
function invariant_dividendAccounting() public {
uint256 totalDistributed = distributor.totalDistributed();
uint256 totalClaimed = distributor.totalClaimed();
uint256 totalUnclaimed = distributor.totalUnclaimed();
assertEq(totalDistributed, totalClaimed + totalUnclaimed);
}
// Tranche waterfall: senior must be paid before junior
function invariant_waterfallOrder() public {
if (pool.seniorOwed() > 0) {
assertEq(pool.juniorPaid(), 0, "Junior paid before senior");
}
}
// NAV must be updated within acceptable staleness window
function invariant_navFreshness() public {
uint256 lastUpdate = navOracle.lastUpdateTimestamp();
assertLe(
block.timestamp - lastUpdate,
24 hours,
"NAV data is stale"
);
}
// Total holder count must not exceed regulatory maximum
function invariant_maxHolderLimit() public {
uint256 holderCount = token.holderCount();
assertLe(holderCount, compliance.maxHolders());
}| Attack | Description | Mitigation |
|---|---|---|
| Fake Proof of Reserve | Oracle reports false reserves to allow unbacked minting | Multi-auditor PoR, Chainlink decentralized nodes |
| Compliance Bypass | Transferring to non-whitelisted address via flash loan or proxy | Transfer hooks that check BOTH sender and receiver |
| Oracle Manipulation (NAV) | Manipulate NAV oracle to inflate/deflate token price | TWAP, multi-source oracles, staleness checks |
| Admin Key Compromise | Attacker gets admin key, mints unbacked tokens or changes rules | Multi-sig, timelock, governance |
| Reentrancy on Redemption | Re-enter during redeem to drain more collateral than entitled | CEI pattern, ReentrancyGuard |
| Lock-Up Circumvention | Wrapping locked tokens in another contract to bypass restrictions | Check original token, disallow wrapping |
| Front-Running Distributions | Buy tokens before dividend snapshot, sell after | Snapshot at random block, vesting after claim |
| Sybil for Holder Cap | One entity creates many wallets to bypass max holder limits | KYC-linked identity, sybil detection |
| Stale NAV Arbitrage | Redeem at outdated NAV when real value has dropped | Real-time NAV updates, redemption queue |
| Legal Entity Attack | SPV dissolved or assets seized without on-chain reflection | Legal agreements, multi-jurisdiction structure |
| Regulatory Rug Pull | Platform suddenly blocked by regulators, assets frozen | Multi-jurisdiction compliance, transparent ops |
- Proof of Reserve oracle active and verified by multiple auditors
- Transfer restrictions enforced at token level (not just frontend)
- Identity registry immutable by single admin (multi-sig required)
- Lock-up periods enforced on-chain, not bypassable via wrapping
- NAV oracle has staleness check and fallback mechanism
- Dividend distribution uses snapshot — no front-running
- Redemption queue with cooldown period for large amounts
- Emergency pause with multi-sig trigger
- Reentrancy guards on all state-changing functions
- Max holder count enforced at contract level
- Admin operations behind timelock (mint, burn, compliance changes)
- Off-chain legal structure mirrors on-chain ownership
| Regulation | Jurisdiction | What It Covers | Relevant Projects |
|---|---|---|---|
| Reg D | USA | Private placement exemption — accredited investors only | All security tokens |
| Reg S | USA | Offshore offering — non-US persons only | International issuance |
| Reg A+ | USA | Mini-IPO — up to $75M, non-accredited allowed | Wider distribution |
| Reg CF | USA | Crowdfunding — up to $5M | Small offerings |
| MiCA | EU | Crypto-asset regulation — ART, EMT, other crypto-assets | EU-based tokens |
| MiFID II | EU | Securities regulation — applies to tokenized securities | Security tokens in EU |
| FCA | UK | Crypto and security token regulation | UK offerings |
| MAS | Singapore | Capital Markets Services License for security tokens | SG-based tokens |
┌────────────────────────────────────────────────────────────────────┐
│ ERC-3643 COMPLIANCE STACK │
│ │
│ ┌──────────────────┐ │
│ │ Security Token │ ← ERC-20 + transfer restrictions │
│ │ (T-REX Token) │ │
│ └────────┬───────────┘ │
│ │ │
│ │ checks on every transfer: │
│ ▼ │
│ ┌──────────────────┐ ┌──────────────────┐ │
│ │ Identity Registry │────►│ Trusted Issuers │ │
│ │ │ │ Registry │ │
│ │ • Is sender │ │ │ │
│ │ verified? │ │ • Which issuers │ │
│ │ • Is receiver │ │ are trusted? │ │
│ │ verified? │ │ • What claims do │ │
│ │ • What claims │ │ they issue? │ │
│ │ do they hold? │ │ │ │
│ └──────────────────┘ └──────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ Compliance Module │ ← Pluggable rules engine │
│ │ │ │
│ │ Rules: │ │
│ │ ├── MaxHolderCount │ (Reg D: max 2000 holders) │
│ │ ├── CountryRestrict│ (Block sanctioned jurisdictions) │
│ │ ├── LockUpPeriod │ (12-month hold for Reg D) │
│ │ ├── MaxBalance │ (No single holder > 10%) │
│ │ ├── MinInvestment │ (Minimum $10,000 investment) │
│ │ └── DailyTransferCap│ (Max $1M transfers per day) │
│ └──────────────────┘ │
└────────────────────────────────────────────────────────────────────┘
| Network | Chain ID | Why | Used By |
|---|---|---|---|
| Ethereum | 1 | Highest security, MakerDAO RWA vaults, institutional trust | Ondo, Centrifuge, BUIDL |
| Base | 8453 | Low fees, Coinbase ecosystem, growing RWA adoption | Backed Finance |
| Polygon | 137 | Polygon ID for compliance, low fees, enterprise partnerships | RealT, various issuers |
| Avalanche | 43114 | Avalanche Evergreen subnets for institutional, permissioned | Securitize, institutional |
| Arbitrum | 42161 | Low fees, strong DeFi composability | Centrifuge, various |
| Gnosis Chain | 100 | MakerDAO integration, low fees | Centrifuge, Spark |
# 1. Deploy Identity Registry
forge script script/DeployIdentityRegistry.s.sol \
--rpc-url $BASE_RPC_URL --broadcast --verify
# 2. Deploy Compliance Module
forge script script/DeployCompliance.s.sol \
--rpc-url $BASE_RPC_URL --broadcast --verify
# 3. Deploy Security Token (ERC-3643)
forge script script/DeploySecurityToken.s.sol \
--rpc-url $BASE_RPC_URL --broadcast --verify
# 4. Deploy Dividend Distributor
forge script script/DeployDistributor.s.sol \
--rpc-url $BASE_RPC_URL --broadcast --verify
# 5. Register trusted identity issuers
cast send $IDENTITY_REGISTRY "addTrustedIssuer(address,uint256[])" \
$ISSUER_ADDRESS "[1,2,3]" \
--rpc-url $BASE_RPC_URL --private-key $PRIVATE_KEY
# 6. Whitelist initial investors
cast send $IDENTITY_REGISTRY "registerIdentity(address,address,uint16)" \
$INVESTOR $IDENTITY_CONTRACT 840 \
--rpc-url $BASE_RPC_URL --private-key $PRIVATE_KEY
# 7. Mint tokens to investors
cast send $TOKEN "mint(address,uint256)" $INVESTOR 100000e18 \
--rpc-url $BASE_RPC_URL --private-key $PRIVATE_KEY| Concept | Description |
|---|---|
| RWA (Real World Asset) | Tangible or financial asset from the traditional world tokenized on blockchain |
| Tokenization | Representing ownership of a real asset as a digital token on a blockchain |
| Security Token | Token that represents a regulated security — subject to securities law |
| ERC-3643 (T-REX) | Token standard for compliant security tokens with identity and transfer rules |
| ERC-1400 | Security token standard with partitions, document management, controller ops |
| SPV (Special Purpose Vehicle) | Legal entity created solely to own and manage a specific tokenized asset |
| Fractional Ownership | Dividing an asset into smaller units — many investors own pieces |
| NAV (Net Asset Value) | Total value of underlying assets / total token supply = price per token |
| Proof of Reserve (PoR) | Cryptographic proof that on-chain tokens are backed by off-chain reserves |
| Tranche | Slice of a credit pool with specific risk/return profile (senior/junior) |
| Waterfall | Priority order in which cash flows are distributed to tranche holders |
| First-Loss Capital | Junior tranche that absorbs losses before senior — higher risk, higher reward |
| Cap Table | Record of all shareholders, their holdings, and ownership percentages |
| Transfer Restrictions | On-chain rules that block non-compliant transfers (whitelist, lock-up, etc.) |
| Accredited Investor | Individual meeting income/net worth thresholds for private securities (Reg D) |
| Reg D / Reg S | US SEC exemptions for private placement (domestic / international) |
| Lock-Up Period | Time during which tokens cannot be transferred after issuance |
| Dividend Distribution | Proportional payment of income to token holders (rent, coupons, interest) |
| Redemption | Burning tokens to receive underlying asset or cash equivalent |
| ONCHAINID | ERC-3643's identity contract — stores verifiable claims about an investor |
| KYC/AML | Know Your Customer / Anti-Money Laundering — regulatory identity verification |
A snapshot of the leading tokens in the $62B RWA ecosystem:
| Token | Project | Category | Role in Ecosystem |
|---|---|---|---|
| ONDO | Ondo Finance | Treasuries | Tokenized US Treasuries (USDY, OUSG), institutional DeFi |
| LINK | Chainlink | Infrastructure | Proof of Reserve, CCIP for cross-chain RWA, price feeds |
| MKR | MakerDAO / Sky | DeFi + RWA | RWA vaults backing DAI — largest on-chain RWA allocator |
| AAVE | Aave | DeFi + RWA | GHO stablecoin, RWA collateral markets |
| CFG | Centrifuge | Private Credit | Tokenized real-world credit pools, MakerDAO integration |
| CELO | Celo | Infrastructure | Mobile-first RWA access, natural capital backing |
| MPL | Maple Finance | Private Credit | Institutional on-chain lending — corporate credit |
| PAXG | Paxos Gold | Commodities | Gold-backed token — each token = 1 fine troy ounce |
| XAUT | Tether Gold | Commodities | Gold-backed token by Tether, London Good Delivery bars |
| RIO | Realio Network | Platform | Multi-asset tokenization platform for institutional RWAs |
| BUIDL | BlackRock (tokenized) | Treasuries | Tokenized money market fund — largest institutional RWA |
| POLYX | Polymesh | Infrastructure | Purpose-built blockchain for regulated security tokens |
| GFI | Goldfinch | Private Credit | Under-collateralized lending to real-world borrowers |
| KLIMA | KlimaDAO | Carbon Credits | On-chain carbon credit retirement and climate finance |
| WCFG | Centrifuge (wrapped) | Private Credit | Governance token for Centrifuge protocol |
Market data as of May 2026. Total RWA sector cap: ~$62B (including tokenized treasuries, stablecoins-adjacent products, and protocol tokens).
- Ondo Finance — Tokenized US Treasuries (USDY, OUSG)
- Centrifuge — Real-world asset financing on-chain
- Securitize — End-to-end security token platform
- RealT — Fractional real estate tokenization
- Backed Finance — Tokenized ETFs and bonds
- Maple Finance — Institutional on-chain credit
- Goldfinch — Decentralized credit for real-world borrowers
- ERC-3643 (T-REX) — Regulated security token standard
- ERC-1400 — Security token standard
- ERC-4626 — Tokenized vault standard
- EIP-3525 — Semi-fungible token (SFT)
- SEC Reg D — Private placement
- SEC Reg S — Offshore offerings
- EU MiCA — EU crypto regulation
- Polymesh — Purpose-built regulated asset blockchain
- Chainlink Proof of Reserve — Verifiable reserves
- Chronicle Protocol — Oracle infrastructure
- RedStone — Modular oracle for RWA data
- Foundry Book
- OpenZeppelin Contracts
- T-REX GitHub — ERC-3643 reference
- The Graph — Indexing blockchain data
- RWA.xyz — RWA market data and analytics dashboard
- DeFi Llama RWA — TVL tracking for RWA protocols
- Galaxy Digital — RWA Report — Institutional research
- Boston Consulting Group — Asset Tokenization — Market sizing
- Trail of Bits
- OpenZeppelin Defender
- Slither — Static analysis
- Certik — Security audits for RWA protocols
Contributions are welcome! Whether it's a new asset class, compliance module, or oracle integration:
- Fork the repository
- Create a feature branch (
git checkout -b feature/new-asset-class) - Follow the existing project structure
- Include comprehensive tests (unit + fuzz + invariant + compliance)
- Add a
README.mdwith architecture, legal considerations, and security analysis - Submit a pull request
High-impact contribution ideas:
- Tokenized intellectual property (patents, royalties)
- Real estate rent oracle with off-chain data attestation
- Cross-chain RWA transfer with Chainlink CCIP
- Automated regulatory reporting module
- Tax-lot tracking and capital gains calculator for RWA holders
This repository is licensed under the MIT License.
$300 trillion in real-world assets. Less than 0.02% tokenized. The opportunity is just beginning.