QuillAudits

Tokenization 101

RWA Tokenization: Token Standards, Market Data and Audit Readiness

Built for institutions and funded startups that are tokenizing real-world assets. Pick an asset, pick a chain, and get the standard with the receipts.

Get an audit
What breaksBuild vs Buy
$0Tokenized RWA on-chain
0Asset holders
+0%YoY growth

Source: rwa.xyz, 2026-08-14 · Last updated 2026-08-14

Step 1

What do you want to tokenize?

Pick the asset class you already have. Market size is context, not a recommendation. Selecting a card unlocks the next steps.

What comes next

Select an asset class above to unlock the full flow.

Step 2

Choose your chain

See custody, fees, tooling, and institutional acceptance for each chain.

Step 3

Pick a standard

Ranked recommendations with adoption, risks, incidents, and vendor fit.

Step 4

Map regulation

Jurisdiction-specific exemptions, action plan, and TA/BD/ATS reality check.

Audit readiness

How audit-ready is your design?

Eight questions. About 90 seconds. Shareable result.

What Tokenization 101 recommends

A static, crawler-readable summary of the interactive wizard. Each card picks the dominant chain and the top standards for the asset class, plus the key audit trade-off. Updated 2026-08-14 from rwa.xyz.

Which token standard fits tokenized us treasuries & money markets?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-4626 (Tokenized Vaults) as an alternative.$16.24B tokenized. Dominant chain: Ethereum (43%). Low-hanging fruit for institutions: established issuers, clear custody, and the largest liquid on-chain market. Start here if you want a regulated money-market or treasury product.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-4626 (Tokenized Vaults)

Making an RWA yield product composable: lending collateral, oracles, integrations for free.

Watch out: Inflation-attack class bugs; the synchronous model does not fit fund subscription/redemption windows or NAV cycles—use ERC-7540 for async flows.

Audit angle: Known vulnerability class: share-price inflation attacks. Standardized accounting cuts integration audit cost.

ERC-7518 (DyCIST)

Complex security tokens that need semi-fungible partitions within one contract: real-estate floors, fund share classes, or tranched private credit.

Watch out: Early-stage tooling and wallet support; voucher model relies on issuer-operated off-chain infrastructure; final EIP status and cross-chain interop still maturing.

Audit angle: Large for a young standard: partition engine, voucher validation, forced-transfer/freeze logic, ERC-1155 base, and migration paths between partitions. Fewer auditors and tooling than ERC-3643/1400.

Which token standard fits tokenized private credit?

Short answer: Provenance Native Markers on Provenance.$7.26B tokenized. Dominant chain: Provenance. Best if you already originate loans or receivables. Tokenization turns an illiquid book into a tradable asset, but valuation and servicer risk are central.

Provenance Native MarkersTop pick

Institutional lenders securitizing massive off-chain loan books.

Watch out: A specialized, institutional-first walled garden rather than a public retail DeFi environment.

Audit angle: Minimal. Logic is handled by the Cosmos SDK modules rather than isolated smart contracts.

Which token standard fits tokenized commodities & gold?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-721 / ERC-1155 as an alternative.$4.96B tokenized. Dominant chain: Ethereum (93%). Gold and agricultural tokens work when you have secure physical custody or a trusted refiner/issuer. This is a custody and attestation problem more than a token problem.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-721 / ERC-1155

Whole unique assets: a deed, an invoice, a single loan as collateral.

Watch out: Illiquid, needs a fractionalization layer for distribution, valuation oracle problem.

Audit angle: Small token surface; risk concentrates in the legal structure, not the contract.

ERC-7765 (Privileged NFTs tied to RWA)

Whole unique assets where ownership is a tokenized title or entitlement that triggers real-world fulfillment.

Watch out: Off-chain fulfillment is issuer-dependent; no universal settlement layer, and privilege state can diverge from legal ownership.

Audit angle: Moderate; privilege validation, replay prevention, and off-chain fulfillment coordination need audit

Which token standard fits tokenized stocks & etfs?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-7943 (uRWA - Universal RWA Interface) as an alternative.$2.50B tokenized. Dominant chain: Ethereum (36.2%). Tokenized equities require broker-dealer, transfer-agent, and market-structure licenses in most jurisdictions. Only choose this if you already have or can partner with a regulated entity.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-7943 (uRWA - Universal RWA Interface)

Issuers that want a standardized interface for freeze, forced-transfer, and eligibility checks across ERC-20/721/1155 RWA tokens.

Watch out: It only defines interfaces, not a full compliance engine; the policy stack and access control remain issuer-specific.

Audit angle: Small interface surface, but enforcement logic, freeze mappings, and forced-transfer access controls are high-risk

ERC-7765 (Privileged NFTs tied to RWA)

Whole unique assets where ownership is a tokenized title or entitlement that triggers real-world fulfillment.

Watch out: Off-chain fulfillment is issuer-dependent; no universal settlement layer, and privilege state can diverge from legal ownership.

Audit angle: Moderate; privilege validation, replay prevention, and off-chain fulfillment coordination need audit

Which token standard fits tokenized institutional & alternative funds?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-4626 (Tokenized Vaults) as an alternative.$2.50B tokenized. Dominant chain: Ethereum (50%). Private equity, hedge, and active fund tokens are niche but high value. The main bottleneck is fund-administrator and transfer-agent integration, not the token contract.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-4626 (Tokenized Vaults)

Making an RWA yield product composable: lending collateral, oracles, integrations for free.

Watch out: Inflation-attack class bugs; the synchronous model does not fit fund subscription/redemption windows or NAV cycles—use ERC-7540 for async flows.

Audit angle: Known vulnerability class: share-price inflation attacks. Standardized accounting cuts integration audit cost.

ERC-3643 (T-REX)

Private-market securities where the regulator wants transfer restrictions provable and enforced on-chain.

Watch out: Investor onboarding friction and weak DeFi composability: pools and wallets must themselves pass identity checks.

Audit angle: Large: token + compliance modules + identity registry all in scope. Well-trodden reference implementation (Tokeny T-REX, OpenZeppelin co-developing next version).

Which token standard fits tokenized real estate?

Short answer: ERC-3643 (T-REX) on Ethereum, with ERC-1400 / ERC-1404 as an alternative.$224M tokenized. Dominant chain: Ethereum. Fragmented and undercounted. Success depends on local property law, SPV structuring, and on/off-ramp rails. Tokenization is the easy part; legal and operational plumbing is not.

ERC-3643 (T-REX)Top pick

Private-market securities where the regulator wants transfer restrictions provable and enforced on-chain.

Watch out: Investor onboarding friction and weak DeFi composability: pools and wallets must themselves pass identity checks.

Audit angle: Large: token + compliance modules + identity registry all in scope. Well-trodden reference implementation (Tokeny T-REX, OpenZeppelin co-developing next version).

ERC-1400 / ERC-1404

Partition-heavy structures (Reg D vs Reg S tranches) on legacy infrastructure.

Watch out: Draft status and shrinking mindshare. Choosing it in 2026 needs a specific reason.

Audit angle: Fragmented spec, multiple sub-standards; declining auditor familiarity for new work.

ERC-721 / ERC-1155

Whole unique assets: a deed, an invoice, a single loan as collateral.

Watch out: Illiquid, needs a fractionalization layer for distribution, valuation oracle problem.

Audit angle: Small token surface; risk concentrates in the legal structure, not the contract.

Frequently asked questions

Answers that match the structured data on this page.

What is real-world asset (RWA) tokenization?+

RWA tokenization is the process of issuing blockchain tokens that represent ownership of off-chain assets such as US Treasuries, private credit, commodities, equities, funds, and real estate. As of August 2026, tokenized US Treasuries alone total $16.24B (up ~120% YoY) and tokenized private credit $7.26B, per rwa.xyz and issuer disclosures.

Which token standard should I use for tokenizing real-world assets?+

It depends on the asset and the compliance model. ERC-3643 (T-REX) is the leading permissioned standard for regulated securities, enforcing onchain identity and transfer restrictions. ERC-4626 is the standard for yield-bearing vault tokens. ERC-1400 covers partitioned security tokens, and permissioned ERC-20 wrappers are common for treasuries and money-market products. QuillAudits' Tokenization 101 tool matches asset class and chain to the appropriate standard.

What is ERC-3643?+

ERC-3643 (the T-REX protocol) is an open Ethereum standard for permissioned tokens. It binds token transfers to onchain identity (ONCHAINID) and compliance rules, so only eligible, verified investors can hold or transfer the token. It is widely used for tokenized securities and institutional RWA issuance, and avoids the lock-in of proprietary transfer registries.

What is ERC-4626?+

ERC-4626 is the tokenized vault standard: a common interface for deposit/withdraw vaults that issue yield-bearing shares. It is common in tokenized treasury and private-credit products. Its known audit hot spots include share-price inflation (first-depositor) attacks and rounding/donation vectors, which have caused real losses in RWA protocols.

How big is the tokenized RWA market in 2026?+

As of August 14, 2026: US Treasuries $16.24B, private credit $7.26B, commodities/gold $4.96B, tokenized stocks and ETFs $2.50B, alternative funds ~$2.50B, real estate $224M, and stablecoins $297.91B, based on rwa.xyz and primary issuer disclosures.

Should we build our own tokenization stack or buy a white-label platform?+

Buy when regulatory infrastructure (KYC, transfer-agent records, investor portals) is the bottleneck: white-label platforms deliver in weeks at roughly $10K-50K setup plus SaaS or basis-point fees. Build when tokenization itself is your product or you need custom compliance logic or chain flexibility. A common middle path is building the token layer on open standards like ERC-3643 while buying regulated-entity services. Avoid proprietary registry lock-in.

What are the most common security failures in RWA tokenization?+

Documented RWA incidents (2022-2026, $106M+ in tracked losses) cluster into borrower defaults surfacing onchain, ERC-4626 share-price inflation, flash-loan attacks, governance exploits, liquidity mismatches, and oracle/price manipulation. QuillAudits maintains a curated incident database mapped to asset class and token standard.

Do tokenized RWA contracts need a security audit?+

Yes. RWA tokens combine standard smart-contract risk with compliance logic, oracle dependencies, and offchain asset attestations, and several regulators (DFSA, MAS Project Guardian, Swiss DLT Act regimes, SFC circulars) expect demonstrable technology risk controls. An audit covering the token standard implementation, compliance modules, and oracle/redemption paths is baseline for institutional issuance.