QuillAudits

Tokenization 101

RWA Tokenization: Token Standards, Market Data and Audit Readiness

Built for institutions and funded startups that are tokenizing real-world assets. Pick an asset, pick a chain, and get the standard with the receipts.

Get an audit
$0Tokenized RWA on-chain
0Asset holders
+0%YoY growth

Source: rwa.xyz, 2026-08-14 · Last updated 2026-08-14

Step 1

What do you want to tokenize?

Pick the asset class you already have. Market size is context, not a recommendation. Selecting a card unlocks the next steps.

What comes next

Select an asset class above to unlock the full flow.

Step 2

Choose your chain

See custody, fees, tooling, and institutional acceptance for each chain.

Step 3

Pick a standard

Ranked recommendations with adoption, risks, incidents, and vendor fit.

Step 4

Choose a vault

ERC-4626, ERC-7540, ERC-7575, SEP-56, or XLS-65 for yield-bearing shares — or skip it.

Step 5

Map regulation

Jurisdiction-specific exemptions, action plan, and TA/BD/ATS reality check.

Audit readiness

How audit-ready is your design?

Eight questions. About 90 seconds. Shareable result.

What Tokenization 101 recommends

A static, crawler-readable summary of the interactive wizard. Each card picks the dominant chain and the top standards for the asset class, plus the key audit trade-off. Updated 2026-08-14 from rwa.xyz.

Which token standard fits tokenized us treasuries & money markets?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-7518 (DyCIST) as an alternative.$16.24B tokenized. Dominant chain: Ethereum (43%). Liquidity vault: ERC-4626 (Tokenized Vaults). Low-hanging fruit for institutions: established issuers, clear custody, and the largest liquid on-chain market. Start here if you want a regulated money-market or treasury product.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-7518 (DyCIST)

Complex security tokens that need semi-fungible partitions within one contract: real-estate floors, fund share classes, or tranched private credit.

Watch out: Early-stage tooling and wallet support; voucher model relies on issuer-operated off-chain infrastructure; final EIP status and cross-chain interop still maturing.

Audit angle: Large for a young standard: partition engine, voucher validation, forced-transfer/freeze logic, ERC-1155 base, and migration paths between partitions. Fewer auditors and tooling than ERC-3643/1400.

ERC-7943 (uRWA - Universal RWA Interface)

Issuers that want a standardized interface for freeze, forced-transfer, and eligibility checks across ERC-20/721/1155 RWA tokens.

Watch out: It only defines interfaces, not a full compliance engine; the policy stack and access control remain issuer-specific.

Audit angle: Small interface surface, but enforcement logic, freeze mappings, and forced-transfer access controls are high-risk

Which token standard fits tokenized private credit?

Short answer: Provenance Native Markers on Provenance.$7.26B tokenized. Dominant chain: Provenance. Best if you already originate loans or receivables. Tokenization turns an illiquid book into a tradable asset, but valuation and servicer risk are central.

Provenance Native MarkersTop pick

Institutional lenders securitizing massive off-chain loan books.

Watch out: A specialized, institutional-first walled garden rather than a public retail DeFi environment.

Audit angle: Minimal. Logic is handled by the Cosmos SDK modules rather than isolated smart contracts.

Which token standard fits tokenized commodities & gold?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-721 / ERC-1155 as an alternative.$4.96B tokenized. Dominant chain: Ethereum (93%). Liquidity vault: ERC-4626 (Tokenized Vaults). Gold and agricultural tokens work when you have secure physical custody or a trusted refiner/issuer. This is a custody and attestation problem more than a token problem.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-721 / ERC-1155

Whole unique assets: a deed, an invoice, a single loan as collateral.

Watch out: Illiquid, needs a fractionalization layer for distribution, valuation oracle problem.

Audit angle: Small token surface; risk concentrates in the legal structure, not the contract.

ERC-7765 (Privileged NFTs tied to RWA)

Whole unique assets where ownership is a tokenized title or entitlement that triggers real-world fulfillment.

Watch out: Off-chain fulfillment is issuer-dependent; no universal settlement layer, and privilege state can diverge from legal ownership.

Audit angle: Moderate; privilege validation, replay prevention, and off-chain fulfillment coordination need audit

Which token standard fits tokenized stocks & etfs?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-20 + ERC-8056 (Scaled UI Amounts) as an alternative.$2.50B tokenized. Dominant chain: Ethereum (36.2%). Liquidity vault: ERC-4626 (Tokenized Vaults). Tokenized equities require broker-dealer, transfer-agent, and market-structure licenses in most jurisdictions. Only choose this if you already have or can partner with a regulated entity.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-20 + ERC-8056 (Scaled UI Amounts)

Tokenized equities/ETFs that need corporate-action handling with a plain, composable ERC-20 interface.

Watch out: Draft extension: integrations that ignore uiMultiplier() show wrong amounts after splits. Token conveys economic exposure, not shareholder rights.

Audit angle: Small: ERC-20 plus multiplier logic; integrators must read uiMultiplier() or UI amounts break after corporate actions.

ERC-7943 (uRWA - Universal RWA Interface)

Issuers that want a standardized interface for freeze, forced-transfer, and eligibility checks across ERC-20/721/1155 RWA tokens.

Watch out: It only defines interfaces, not a full compliance engine; the policy stack and access control remain issuer-specific.

Audit angle: Small interface surface, but enforcement logic, freeze mappings, and forced-transfer access controls are high-risk

Which token standard fits tokenized institutional & alternative funds?

Short answer: Permissioned ERC-20 on Ethereum, with ERC-3643 (T-REX) as an alternative.$2.50B tokenized. Dominant chain: Ethereum (50%). Liquidity vault: ERC-4626 (Tokenized Vaults). Private equity, hedge, and active fund tokens are niche but high value. The main bottleneck is fund-administrator and transfer-agent integration, not the token contract.

Permissioned ERC-20Top pick

Maximum DeFi distribution and composability. The pattern nearly all live treasury AUM chose.

Watch out: Compliance is enforced off-chain or at mint/redeem edges. Secondary transfers between allowlisted wallets are hard to restrict granularly on-chain.

Audit angle: Small per contract, but bespoke per issuer. Every issuer writes their own restriction logic, so audits do not transfer between projects.

ERC-3643 (T-REX)

Private-market securities where the regulator wants transfer restrictions provable and enforced on-chain.

Watch out: Investor onboarding friction and weak DeFi composability: pools and wallets must themselves pass identity checks.

Audit angle: Large: token + compliance modules + identity registry all in scope. Well-trodden reference implementation (Tokeny T-REX, OpenZeppelin co-developing next version).

ERC-1400 / ERC-1404

Partition-heavy structures (Reg D vs Reg S tranches) on legacy infrastructure.

Watch out: Draft status and shrinking mindshare. Choosing it in 2026 needs a specific reason.

Audit angle: Fragmented spec, multiple sub-standards; declining auditor familiarity for new work.

Which token standard fits tokenized real estate?

Short answer: ERC-3643 (T-REX) on Ethereum, with ERC-1400 / ERC-1404 as an alternative.$224M tokenized. Dominant chain: Ethereum. Liquidity vault: ERC-4626 (Tokenized Vaults). Fragmented and undercounted. Success depends on local property law, SPV structuring, and on/off-ramp rails. Tokenization is the easy part; legal and operational plumbing is not.

ERC-3643 (T-REX)Top pick

Private-market securities where the regulator wants transfer restrictions provable and enforced on-chain.

Watch out: Investor onboarding friction and weak DeFi composability: pools and wallets must themselves pass identity checks.

Audit angle: Large: token + compliance modules + identity registry all in scope. Well-trodden reference implementation (Tokeny T-REX, OpenZeppelin co-developing next version).

ERC-1400 / ERC-1404

Partition-heavy structures (Reg D vs Reg S tranches) on legacy infrastructure.

Watch out: Draft status and shrinking mindshare. Choosing it in 2026 needs a specific reason.

Audit angle: Fragmented spec, multiple sub-standards; declining auditor familiarity for new work.

ERC-721 / ERC-1155

Whole unique assets: a deed, an invoice, a single loan as collateral.

Watch out: Illiquid, needs a fractionalization layer for distribution, valuation oracle problem.

Audit angle: Small token surface; risk concentrates in the legal structure, not the contract.

Frequently asked questions

Answers that match the structured data on this page.

What is real-world asset (RWA) tokenization?+

RWA tokenization is the process of issuing blockchain tokens that represent ownership of off-chain assets such as US Treasuries, private credit, commodities, equities, funds, and real estate. As of August 2026, tokenized US Treasuries alone total $16.24B (up ~120% YoY) and tokenized private credit $7.26B.

Which token standard should I use for tokenizing real-world assets?+

It depends on the asset and the compliance model. ERC-3643 (T-REX) is the leading permissioned standard for regulated securities. ERC-4626 is the standard for yield-bearing vault tokens. ERC-1400 covers partitioned security tokens, and permissioned ERC-20 wrappers are common for treasuries and money-market products.

What is ERC-3643?+

ERC-3643 (the T-REX protocol) is an open Ethereum standard for permissioned tokens. It binds token transfers to onchain identity (ONCHAINID) and compliance rules, so only eligible, verified investors can hold or transfer the token. It is widely used for tokenized securities and institutional RWA issuance.

What is ERC-4626?+

ERC-4626 is the tokenized vault standard: a common interface for deposit/withdraw vaults that issue yield-bearing shares. It is common in tokenized treasury and private-credit products. Its known audit hot spots include share-price inflation attacks and rounding/donation vectors.

How big is the tokenized RWA market in 2026?+

As of August 14, 2026: US Treasuries $16.24B, private credit $7.26B, commodities/gold $4.96B, tokenized stocks and ETFs $2.50B, alternative funds ~$2.50B, real estate $224M, and stablecoins $297.91B, based on rwa.xyz and primary issuer disclosures.

Do tokenized RWA contracts need a security audit?+

Yes. RWA tokens combine standard smart-contract risk with compliance logic, oracle dependencies, and offchain asset attestations. Several regulators expect demonstrable technology risk controls. An audit covering the token standard implementation, compliance modules, and oracle/redemption paths is baseline for institutional issuance.

What are the most common security failures in RWA tokenization?+

Documented RWA incidents (2022-2026, $106M+ in tracked losses) cluster into borrower defaults surfacing onchain, ERC-4626 share-price inflation, flash-loan attacks, governance exploits, liquidity mismatches, and oracle/price manipulation.

Should we build our own tokenization stack or buy a white-label platform?+

Buy when regulatory infrastructure is the bottleneck: white-label platforms deliver in weeks at roughly $10K-50K setup plus SaaS fees. Build when tokenization itself is your product or you need custom compliance logic. A common middle path is building the token layer on open standards like ERC-3643 while buying regulated-entity services.