Version 1.0 · 34 controls · 3 security layers

RWA Security Checklist

Review the on-chain invariants, off-chain junctions, and continuous controls that keep tokenized assets aligned with their real-world backing.

Review progress

0 of 34 reviewed

0%
Download JSON Download Markdown

RWA On-Chain Features

Checks that the implementation preserves the identity, backing, eligibility, value, lifecycle, and economic rights of the represented asset.

Asset identity, terms, and lifecycle

0 of 4 reviewed

  • Is each token bound to the correct asset, tranche, and series?

    RWA-AST-01Asset identity, terms, and lifecycle

  • Does the protocol enforce an explicit asset lifecycle state machine?

    RWA-AST-02Asset identity, terms, and lifecycle

  • Can token supply ever exceed eligible backing?

    RWA-AST-03Asset identity, terms, and lifecycle

  • Are fixed economic terms snapshotted when an asset is issued?

    RWA-AST-04Asset identity, terms, and lifecycle

Subscription, issuance, and redemption

0 of 5 reviewed

  • Are the payer, investor, beneficiary, and recipient bound correctly?

    RWA-ISS-01Subscription, issuance, and redemption

  • Can donation or rounding manipulation cause unfair or zero-share issuance?

    RWA-ISS-02Subscription, issuance, and redemption

  • Are claims and redemptions independent of execution order?

    RWA-ISS-03Subscription, issuance, and redemption

  • Does every failed or paused redemption retain a recoverable exit path?

    RWA-ISS-04Subscription, issuance, and redemption

  • Do wrappers preserve the identity of the economic beneficiary?

    RWA-ISS-05Subscription, issuance, and redemption

Investor eligibility and transfer restrictions

0 of 4 reviewed

  • Is investor eligibility enforced at every ownership transition?

    RWA-CMP-01Investor eligibility and transfer restrictions

  • Does compliance state support its complete operational lifecycle?

    RWA-CMP-02Investor eligibility and transfer restrictions

  • Are compliance changes handled safely during pending operations?

    RWA-CMP-03Investor eligibility and transfer restrictions

  • Are freezes, seizures, recoveries, and forced transfers constrained and reconciled?

    RWA-CMP-04Investor eligibility and transfer restrictions

NAV, pricing, and valuation state

0 of 5 reviewed

  • Are all financial units normalized exactly once?

    RWA-VAL-01NAV, pricing, and valuation state

  • Are invalid, stale, and future-dated valuation inputs rejected?

    RWA-VAL-02NAV, pricing, and valuation state

  • Do economic calculations use a coherent valuation timestamp?

    RWA-VAL-03NAV, pricing, and valuation state

  • Are manual valuation changes bounded and prevented from repricing history?

    RWA-VAL-04NAV, pricing, and valuation state

  • Is rounding conservative and explicit at every economic boundary?

    RWA-VAL-05NAV, pricing, and valuation state

Cash flows, servicing, maturity, and default

0 of 7 reviewed

  • Are cash flows allocated using checkpointed economic ownership?

    RWA-CF-01Cash flows, servicing, maturity, and default

  • Are performance fees charged only on new economic gains?

    RWA-CF-02Cash flows, servicing, maturity, and default

  • Do incentives reflect remaining duration, contribution, and risk?

    RWA-CF-03Cash flows, servicing, maturity, and default

  • Are maturity, delinquency, grace period, and default timing enforced consistently?

    RWA-CF-04Cash flows, servicing, maturity, and default

  • Are impairment, bad debt, and recoveries allocated consistently?

    RWA-CF-05Cash flows, servicing, maturity, and default

  • Do solvency-protecting exits remain executable during emergencies?

    RWA-CF-06Cash flows, servicing, maturity, and default

  • Do leverage and redemption promises reflect actual asset liquidity?

    RWA-CF-07Cash flows, servicing, maturity, and default

RWA Junction

Checks the boundary where reserves, settlement, servicing, legal rights, and other off-chain facts enter contract state.

Contract-to-real-world reconciliation

0 of 5 reviewed

  • Is token supply reconciled to an authenticated reserve and ownership register?

    RWA-REC-01Contract-to-real-world reconciliation

  • Does every off-chain settlement instruction have an idempotent identity?

    RWA-REC-02Contract-to-real-world reconciliation

  • Can servicing, default, correction, and recovery updates be represented safely?

    RWA-REC-03Contract-to-real-world reconciliation

  • Does contract behavior remain aligned with enforceable holder rights?

    RWA-REC-04Contract-to-real-world reconciliation

  • Has the complete off-chain writer pipeline been included in the security boundary?

    RWA-REC-05Contract-to-real-world reconciliation

Continuous RWA Assurance

Checks invariants and privileged changes that can drift after a point-in-time security audit.

Continuous RWA assurance

0 of 4 reviewed

  • Is issued and claimable supply monitored against eligible reserves?

    RWA-MON-01Continuous RWA assurance

  • Are NAV freshness and economic deviation monitored as conditions change?

    RWA-MON-02Continuous RWA assurance

  • Are all privileged and configuration changes monitored as they occur?

    RWA-MON-03Continuous RWA assurance

  • Are redemption capacity and hidden impairment monitored over time?

    RWA-MON-04Continuous RWA assurance

RWA security depends on more than correct token logic. Contract state must remain aligned with backing, ownership, valuation, servicing, and redemption reality across every lifecycle transition.

Scope the controls that apply to your protocol, expand each item for concrete review guidance and evidence, and use the checklist to prepare and support a security review. It is not a substitute for a full audit.

Start here

Ready to secure your project?

Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.

No commitment required · Typical audits start within 1–2 weeks

Get Free Pre-Assessmentaudits@codespect.xyz