Detailed Instructions

Begin by scrutinizing the legal wrapper and regulatory compliance of the RWA issuer. This is foundational to understanding the enforceability of claims on the underlying asset.

• Sub-step 1: Identify the Issuer and Jurisdiction: Determine the legal entity (e.g., SPV in the Cayman Islands) and the governing law for the tokenized asset agreement.
• Sub-step 2: Review the Offering Documents: Examine the private placement memorandum, prospectus, or offering circular for details on investor rights, redemption procedures, and disclaimers.
• Sub-step 3: Assess the Custody Structure: Verify the legal separation between the custodian of the physical asset (e.g., a bank) and the protocol. Check for bankruptcy remoteness provisions.

javascriptCopy
// Example: Checking a token's legal reference in a smart contract
function getLegalDocumentHash() public view returns (bytes32) {
    // This hash should point to a publicly verifiable legal agreement
    return legalDocumentHash;
}

Tip: Look for protocols that publish legal opinion letters from reputable firms, as these detail the strength of the token's claim.

Detailed Instructions

RWAs are not natively priced on-chain. You must audit the valuation methodology and the oracle security that bridges off-chain price data.

• Sub-step 1: Understand the Appraisal Process: Determine how the underlying asset (e.g., commercial real estate, treasury bills) is valued. Is it via third-party appraisals, broker quotes, or a proprietary model? Check the frequency of re-valuation.
• Sub-step 2: Deconstruct the Oracle Stack: Identify the oracle provider (e.g., Chainlink, a custom committee). Examine the data source (e.g., Bloomberg API, custodian report) and the on-chain aggregation logic.
• Sub-step 3: Stress-Test Oracle Assumptions: Model scenarios where the oracle fails or provides stale data. Check for circuit breakers or redemption halts that trigger during significant price deviations.

solidityCopy
// Example: Simplified oracle check for a bond price feed
function getAssetPrice() public view returns (uint256) {
    require(block.timestamp - lastUpdateTimestamp < MAX_DELAY, "Stale price");
    require(price > 0, "Invalid price");
    return price;
}

Tip: Protocols using multiple, independent data attestations (e.g., two audit firms + a price feed) generally have stronger valuation security.

Detailed Instructions

The redemption mechanism is the critical link converting a digital claim into the real-world asset or cash. Its design dictates liquidity and counterparty risk.

• Sub-step 1: Map the Mint/Redeem Flow: Trace the complete lifecycle. For minting, identify the KYC/AML gateway and fund settlement (e.g., USDC transfer). For redeeming, identify the request process, timing (e.g., T+2 settlement), and off-chain actions required.
• Sub-step 2: Analyze Liquidity Provisions: Determine if redemptions are instant (via a liquidity pool) or require a delay (gate/queue). Assess the size and depth of any secondary market liquidity pools on DEXs.
• Sub-step 3: Identify Settlement Counterparties: Pinpoint the off-chain entities responsible for fulfilling redemption (e.g., a broker-dealer, the SPV's administrator). Assess their creditworthiness and operational history.

Tip: A protocol with a clear, automated settlement process documented in immutable smart contracts and serviced by regulated entities presents lower operational risk.

Detailed Instructions

Combine traditional financial risk analysis with Web3-native smart contract auditing to evaluate the protocol's resilience.

• Sub-step 1: Conduct Scenario Analysis: Model the impact of a 20-30% drop in the RWA's market value. Check loan-to-value (LTV) ratios for lending protocols and the resulting health of the protocol's equity tranche or reserve fund.
• Sub-step 2: Review Audit Reports: Examine public audit reports from firms like OpenZeppelin or Trail of Bits. Focus on findings related to privilege escalation, oracle manipulation, and redemption logic.
• Sub-step 3: Analyze Governance and Upgradeability: Determine who controls admin keys or a timelock contract (e.g., a 7-day timelock controlled by a 4-of-7 multisig). Assess the risk of malicious upgrades or asset freezes.

solidityCopy
// Example: Checking a critical parameter set by governance
function getMaxLTV() public view returns (uint256) {
    // A governance-controlled LTV ratio. A sudden increase is a risk signal.
    return maxLTVRatio;
}

Tip: Prioritize protocols that have undergone multiple audits, have a bug bounty program, and use a sufficiently long timelock for all privileged functions.