# RWA Security Audit Checklist

**Version:** 1.0

Format: Solodit-compatible checklist with category, subcategory, ID, question, description, remediation, references, and tags.

Canonical machine-readable version: [`RWA_CHECKLIST.json`](rwa-security-checklist-v1.0.json)

## RWA On-Chain Features

Checks that the implementation preserves the identity, backing, eligibility, value, lifecycle, and economic rights of the represented asset.

### Asset identity, terms, and lifecycle

RWA-specific review checks for asset identity, terms, and lifecycle.

- [ ] **RWA-AST-01: Is each token bound to the correct asset, tranche, and series?**
  - Description: Minting, transfer, cash-flow, redemption, cancellation, and burning must use the exact asset identifier and terms represented by the token.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Create multiple series with different assets and maturities. Exercise every lifecycle path against nonzero identifiers and prove that one series cannot consume or unlock another.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L334)
  - Tags: RWA, Asset identity, terms, and lifecycle

- [ ] **RWA-AST-02: Does the protocol enforce an explicit asset lifecycle state machine?**
  - Description: Define allowed transitions among configured, subscribed, issued, active, matured, impaired, defaulted, canceled, and redeemed states.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Build a transition matrix and test every prohibited transition, including claim before settlement, issue after cancellation, transfer after final redemption, and ordinary redemption after default.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-05-01-IPNFT.md#L115)
  - Tags: RWA, Asset identity, terms, and lifecycle

- [ ] **RWA-AST-03: Can token supply ever exceed eligible backing?**
  - Description: Mint only against an approved asset, accepted settlement event, and current reserve attestation. Enforce `issued supply <= eligible reserves`, the intended circulating or lifetime cap, and correct treatment of burns, encumbrances, defaults, and write-offs.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Attempt issuance with a fake asset, stale or duplicate reserve proof, invalid signature, duplicate settlement reference, encumbered reserve, and a burn followed by reminting. Reconcile supply to eligible backing after every path.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L33), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L59), [Reference 3](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-10-01-Florence%20Finance.md#L9), [Reference 4](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Asset identity, terms, and lifecycle

- [ ] **RWA-AST-04: Are fixed economic terms snapshotted when an asset is issued?**
  - Description: Coupon, spread, fee, maturity, seniority, conversion method, and default terms must be stored per asset or tranche when intended to be fixed.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Issue a position, change every global parameter, and prove the outstanding position retains its agreed economics unless its governing terms permit a change.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L139), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L205)
  - Tags: RWA, Asset identity, terms, and lifecycle

### Subscription, issuance, and redemption

RWA-specific review checks for subscription, issuance, and redemption.

- [ ] **RWA-ISS-01: Are the payer, investor, beneficiary, and recipient bound correctly?**
  - Description: A subscription or repayment must not let a caller consume another account's allowance or redirect the resulting RWA claim.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Separate caller, payer, investor-of-record, and recipient accounts, then mutate each in direct and signed flows.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L9)
  - Tags: RWA, Subscription, issuance, and redemption

- [ ] **RWA-ISS-02: Can donation or rounding manipulation cause unfair or zero-share issuance?**
  - Description: Initial and later subscriptions must receive a fair, nonzero claim on backing, including when assets arrive outside the intended deposit path.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Test one-unit initialization, direct donation, prefunding, decimal mismatches, and a victim subscription after manipulated NAV.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Kann/2025-01-19-RWA.md#L31), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L37)
  - Tags: RWA, Subscription, issuance, and redemption

- [ ] **RWA-ISS-03: Are claims and redemptions independent of execution order?**
  - Description: Per-investor balances and aggregate distribution denominators must move together so payout does not depend on claimant order and residual value cannot become trapped.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Permute claims among several investors, include partial claims, and compare total paid plus residual against an independent model.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L9)
  - Tags: RWA, Subscription, issuance, and redemption

- [ ] **RWA-ISS-04: Does every failed or paused redemption retain a recoverable exit path?**
  - Description: Pause, unavailable liquidity, insolvency, failed adapters, and blocked settlement recipients must lead to a documented pending, escrow, refund, reroute, or recovery state.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Interrupt every dependency and activate each emergency state between request, settlement, and claim.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L134), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Cyfrin/2023-11-20-cyfrin-mode-earnm.md#L77)
  - Tags: RWA, Subscription, issuance, and redemption

- [ ] **RWA-ISS-05: Do wrappers preserve the identity of the economic beneficiary?**
  - Description: Coupon, yield, rebates, voting rights, and ownership attribution must follow the investor or registered beneficial owner rather than an intermediate wrapper.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Compare direct ownership with every supported vault, wrapper, nominee, and aggregator path.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L290)
  - Tags: RWA, Subscription, issuance, and redemption

### Investor eligibility and transfer restrictions

RWA-specific review checks for investor eligibility and transfer restrictions.

- [ ] **RWA-CMP-01: Is investor eligibility enforced at every ownership transition?**
  - Description: Apply investor-status, jurisdiction, sanctions, lockup, and concentration rules to subscription, mint, transfer, wrapper deposit, redemption, forced transfer, and bridge receipt as required.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Enumerate every path that changes legal or economic ownership and attempt bypasses through routers, permits, callbacks, wrappers, and bridges.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Naman/2024-08-07-Hyacinth.md#L57)
  - Tags: RWA, Investor eligibility and transfer restrictions

- [ ] **RWA-CMP-02: Does compliance state support its complete operational lifecycle?**
  - Description: Compliance state must support authorized addition, removal, expiry, renewal, correction, and revocation without unbounded iteration or stale status.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Exercise status changes at scale and confirm the correct effective time, authority, event, and recovery path.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Naman/2024-08-07-Hyacinth.md#L57), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L208)
  - Tags: RWA, Investor eligibility and transfer restrictions

- [ ] **RWA-CMP-03: Are compliance changes handled safely during pending operations?**
  - Description: Define what happens if an investor, recipient, asset, or jurisdiction becomes restricted after initiation but before final settlement.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Change compliance state at every asynchronous boundary and prove value is refunded, escrowed, rerouted, or recoverable.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Cyfrin/2024-04-09-cyfrin-wormhole-evm-cctp-v2-1.md#L46)
  - Tags: RWA, Investor eligibility and transfer restrictions

- [ ] **RWA-CMP-04: Are freezes, seizures, recoveries, and forced transfers constrained and reconciled?**
  - Description: Administrative balance changes must preserve supply and provide enough state and events to update the ownership register without losing accrued entitlements. Treat recovery and confiscation as the same technical power and constrain it with appropriate authorization, separation, and monitoring.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Freeze, seize, burn, and force-transfer positions around record dates, maturity, default, and pending redemption. Compromise one recovery operator and prove the defined threshold, delay, limit, or response control contains the impact.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Investor eligibility and transfer restrictions

### NAV, pricing, and valuation state

RWA-specific review checks for nav, pricing, and valuation state.

- [ ] **RWA-VAL-01: Are all financial units normalized exactly once?**
  - Description: Asset quantities, oracle prices, NAV, shares, exchange rates, accrued interest, and fees must have explicit units and decimal boundaries.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Use dimensional analysis and a high-precision model across 6, 8, 12, and 18 decimal assets and feeds.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L55), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-05-01-Bloom.md#L9)
  - Tags: RWA, NAV, pricing, and valuation state

- [ ] **RWA-VAL-02: Are invalid, stale, and future-dated valuation inputs rejected?**
  - Description: Validate positive value, freshness, completed rounds, feed identity, decimals, and L2 sequencer status. Freshness must respect the asset's valuation calendar, including weekends and market holidays. Manual or signed NAV must have an effective time and expiry.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Inject zero, negative, incomplete, stale, future-dated, extreme, and wrong-asset values, plus sequencer downtime, market closure, weekend rollover, and delayed publication.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L73), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-05-01-Bloom.md#L76), [Reference 3](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-10-01-Florence%20Finance.md#L29), [Reference 4](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, NAV, pricing, and valuation state

- [ ] **RWA-VAL-03: Do economic calculations use a coherent valuation timestamp?**
  - Description: Subscription, mint, collateral, and redemption calculations must not combine a fresh component with stale cached pool or asset state.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Move the instrument value while holding each cache constant, then test value extraction in both directions.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L482), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Recon%20Audits/2025-03-22-Apollon_Report.md#L390)
  - Tags: RWA, NAV, pricing, and valuation state

- [ ] **RWA-VAL-04: Are manual valuation changes bounded and prevented from repricing history?**
  - Description: Manual NAV or spread updates must be observable, time-bounded, capped per update, and unable to rewrite settled economics. Use peg ceilings or deviation guards where product semantics permit, and cross-check against a real secondary market where one exists.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Attempt extreme, stale, future-dated, backdated, and retroactive updates. Breach the deviation bound and diverge the official value from each available market reference.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L139), [Reference 2](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, NAV, pricing, and valuation state

- [ ] **RWA-VAL-05: Is rounding conservative and explicit at every economic boundary?**
  - Description: Rounding and minimum amounts must be explicit for issuance, redemption, LTV, interest, fees, and pro-rata distributions. Dust must have a defined owner.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Differential-test boundary values, repeated small operations, and all decimal combinations against exact arithmetic.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Kann/2025-01-19-RWA.md#L31), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L71)
  - Tags: RWA, NAV, pricing, and valuation state

### Cash flows, servicing, maturity, and default

RWA-specific review checks for cash flows, servicing, maturity, and default.

- [ ] **RWA-CF-01: Are cash flows allocated using checkpointed economic ownership?**
  - Description: Coupon, rent, interest, and other distributions must accrue over the correct record period, not to temporary capital present only at update time.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Transfer or flash-deposit immediately before and after accrual, record dates, and payment updates.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L194)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-02: Are performance fees charged only on new economic gains?**
  - Description: A high-water mark or equivalent must prevent charging the same recovered value twice after impairment or NAV decline.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Simulate gain, loss, recovery, deposits, partial redemption, and fee crystallization in different orders.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L525)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-03: Do incentives reflect remaining duration, contribution, and risk?**
  - Description: Rewards must account for time to maturity, expected cash flow, impairment, and capital contribution.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Compare identical nominal positions acquired across the maturity range, especially immediately before maturity or a record date.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/0x52/2024-09-22-stUSDCxBloom.md#L557)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-04: Are maturity, delinquency, grace period, and default timing enforced consistently?**
  - Description: Repayment, late fees, liquidation, redemption, and recovery must use one explicit time model and prevent early liquidation or perpetual late repayment.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Test every boundary timestamp, delayed servicing updates, late repayment, early liquidation, grace expiry, and timestamp tolerance.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L9), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L229)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-05: Are impairment, bad debt, and recoveries allocated consistently?**
  - Description: Default recognition, collateral proceeds, reserves, write-downs, and recoveries must update all holders and tranches consistently. Defaulted parties must not receive rewards for newly created debt.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Batch defaults, remove collateral, alter ordering, and compare loss and recovery allocation across seniority levels.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Recon%20Audits/2025-03-22-Apollon_Report.md#L436), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Hans/2023-07-13-Meta.md#L624)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-06: Do solvency-protecting exits remain executable during emergencies?**
  - Description: Emergency controls must not disable the only mechanism that realizes collateral, contains bad debt, or preserves a valid investor exit.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Enter impaired, undercollateralized, paused, and recovery states, then execute the documented protective paths.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Pashov%20Audit%20Group/2023-04-01-Florence%20Finance.md#L134), [Reference 2](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Recon%20Audits/2025-03-22-Apollon_Report.md#L1460)
  - Tags: RWA, Cash flows, servicing, maturity, and default

- [ ] **RWA-CF-07: Do leverage and redemption promises reflect actual asset liquidity?**
  - Description: Collateral factors, liquidation assumptions, redemption frequency, and withdrawal promises must reflect the liquid reserve buffer, settlement latency, market hours, asset sale time, gates, and concentration of the backing portfolio.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Model simultaneous redemptions and liquidations after a NAV shock. Exhaust the liquid buffer, close the market, delay settlement, and estimate loss before slow collateral can actually be sold or redeemed.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Cash flows, servicing, maturity, and default

## RWA Junction

Checks the boundary where reserves, settlement, servicing, legal rights, and other off-chain facts enter contract state.

### Contract-to-real-world reconciliation

RWA-specific review checks for contract-to-real-world reconciliation.

- [ ] **RWA-REC-01: Is token supply reconciled to an authenticated reserve and ownership register?**
  - Description: Define the authoritative source for issued units, eligible reserves, ownership, liens, encumbrances, burns, and pending settlements. A signed reserve proof must authenticate the source, asset, amount, effective time, nonce, and domain. Reconciliation breaks must safely constrain issuance.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Submit unsigned, incorrectly signed, stale, replayed, future-dated, late, duplicate, missing, and corrected records. Prove state can converge without creating an unbacked claim.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Contract-to-real-world reconciliation

- [ ] **RWA-REC-02: Does every off-chain settlement instruction have an idempotent identity?**
  - Description: Fiat receipts, custody movements, asset purchases, redemptions, and servicing payments must map to unique references with pending, final, rejected, and reversed outcomes.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Deliver duplicate, delayed, reordered, conflicting, and reversed instructions.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/AuditOne/2023-06-29-Coinlend.md#L33)
  - Tags: RWA, Contract-to-real-world reconciliation

- [ ] **RWA-REC-03: Can servicing, default, correction, and recovery updates be represented safely?**
  - Description: Distinguish no report from zero payment, and support corrected servicing data, impairment, default, recoveries, and servicer replacement without rewriting settled history.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Skip reporting periods, replace the servicer, correct a report, and deliver a recovery after write-down.
  - References: [Reference 1](https://github.com/solodit/solodit_content/blob/a8ab1ebc8a73b32f95040cd96d2f7e4ac2529098/reports/Recon%20Audits/2025-03-22-Apollon_Report.md#L436)
  - Tags: RWA, Contract-to-real-world reconciliation

- [ ] **RWA-REC-04: Does contract behavior remain aligned with enforceable holder rights?**
  - Description: Transfer restrictions, record dates, redemption gates, suspension rights, seniority, maturity, and remedies must match the governing product documents.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Create a term-to-code matrix and test each right at its boundary and in conflict scenarios.
  - References: Evidence gap
  - Tags: RWA, Contract-to-real-world reconciliation

- [ ] **RWA-REC-05: Has the complete off-chain writer pipeline been included in the security boundary?**
  - Description: Identify every human, bot, API, administrator, custodian, and signing key that can write reserves, NAV, prices, settlement, compliance, roles, upgrades, or mint authority. Protect each path with custody, rotation, least privilege, meaningful multisig thresholds, rate limits, and an incident runbook.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Trace data from original source to transaction submission. Compromise each component in a tabletop and technical test, including one signer in an `m-of-n` setup, and measure the maximum loss before detection and containment.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Contract-to-real-world reconciliation

## Continuous RWA Assurance

Checks invariants and privileged changes that can drift after a point-in-time security audit.

### Continuous RWA assurance

RWA-specific review checks for continuous rwa assurance.

- [ ] **RWA-MON-01: Is issued and claimable supply monitored against eligible reserves?**
  - Description: Reconcile circulating and claimable supply against fresh eligible reserves, net of liens, pending redemptions, impairment, and duplicated backing.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Alert on missing attestations, declining coverage, unexplained minting, reserve reuse, and reconciliation mismatch. Define automatic issuance constraints and human escalation thresholds.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Continuous RWA assurance

- [ ] **RWA-MON-02: Are NAV freshness and economic deviation monitored as conditions change?**
  - Description: Monitor calendar-aware freshness, future timestamps, update cadence, per-update movement, peg ceilings, and divergence from any legitimate secondary market.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Replay historical market closures and shocks, then measure alert and response time before the value can affect issuance, borrowing, liquidation, or redemption.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Continuous RWA assurance

- [ ] **RWA-MON-03: Are all privileged and configuration changes monitored as they occur?**
  - Description: Alert on role grants, signer and threshold changes, ownership transfers, upgrades, implementation changes, minting, reserve-writer changes, oracle configuration, pauses, forced transfers, and limit increases.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Reproduce each authorized change and a compromised-key sequence. Ensure alerts identify the effective authority and link the change to an approved operational record.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Continuous RWA assurance

- [ ] **RWA-MON-04: Are redemption capacity and hidden impairment monitored over time?**
  - Description: Track liquid-buffer coverage, redemption queues, settlement failures, borrower delinquency, stale servicing reports, utilization, collateral exit capacity, and unrecognized bad debt.
  - Remediation: Implement the requirement as an explicit invariant. Validate it by performing this review: Define leading indicators and escalation thresholds that activate before the dashboard remains nominally solvent while positions can no longer be closed.
  - References: [Reference 1](https://mixbytes.io/blog/the-rwa-hacks-nobody-audited-where-tokenized-assets-actually-break)
  - Tags: RWA, Continuous RWA assurance