How fast institutional allocators want to exit tokenized assets
Ivan Postavskyy, Centrifuge
Moment at 36:21Episode 2 · Ghost Town Markets: Building Secondary Liquidity for Real-World Assets
Blockchain Infrastructure for RWA Issuers & Tokenization Platforms
In short
An RWA issuer puts real-world assets on-chain as permissioned tokens backed by KYC compliance, Proof-of-Reserve, and a compliant secondary market so investors can hold them with the self-custody and transparency they expect. Built on mainnet, owned by you.
Reviewed by Diego Torres, Offer Owner at ProtofireLast reviewed: August 2026
98%
lower fees on Swarm Markets, the DEX we built the trading core for
7,000+
KYC-verified users on Swarm Markets
50+
trading pairs on Swarm Markets
100%
KYC coverage on Swarm Markets, run by Swarm
Trusted by teams building on-chain
An RWA issuer puts real-world assets (US treasuries, private credit, real estate, commodities, or fund shares) on-chain as tokens that investors can hold, trade, and redeem. RWA tokenization is the engineering behind that: the permissioned token, the compliance rules, the price and reserve oracles, the vault that processes subscriptions and redemptions, and the secondary market where the token finds liquidity.
Most RWA programs stall before they close a real institutional allocator: compliance enforced off-chain that investors distrust, KYC that gates signup but not every transfer, and no liquid secondary exit once the asset is live. Protofire builds the full stack that resolves each layer.
We deliver tokenized-securities infrastructure that runs on mainnet today: the contracts, compliance layer, oracles, vaults, and protection that you own, rather than a tokenization SaaS you rent. We have shipped 250+ projects since 2016 across 60+ networks and 95+ protocols, so the standards we recommend for your assets are ones we have deployed.
If you are the CTO or engineering lead responsible for delivering the on-chain product, the CFO or compliance officer who needs a structure institutional allocators will accept, or the founder closing the gap between pilot and committed capital, this page maps the parts of the RWA stack and what we deliver for each; the deep dives live on our service pages, and this is the route in.
The six-layer RWA issuance stack
Every layer an issuer needs to tokenize, distribute, and protect a real-world asset: what we deliver for each.
01
Permissioned token contracts
ERC-3643 security tokens with an on-chain identity registry and compliance rules that enforce every transfer.
02
Compliance and KYC layer
Multi-tier investor registry and jurisdiction-aware transfer restrictions built into the contracts at issuance, not bolted on after mint.
03
Vaults (ERC-4626/7540)
NAV-aware subscription and redemption infrastructure for fund shares, private credit, and tokenized treasuries with queued async settlement.
04
Oracles and Proof-of-Reserve
NAV and price feeds plus Chainlink Proof-of-Reserve attesting on-chain that custody matches supply.
05
Secondary liquidity (dOTC)
KYC-gated peer-to-peer OTC block trading so holders can exit without routing large RWA blocks through public venues.
06
Risk protection (RWArmor)
Parametric cover for redemption freezes, custody failure, and NAV deviation, paid automatically on objective on-chain triggers.
01
What are permissioned tokens for tokenized securities (ERC-3643)?
A tokenized security is not an ERC-20 you can send to anyone. It is a permissioned token: transfers are allowed only between verified, eligible wallets, and the rules travel with the token. The industry standard for this is ERC-3643 (T-REX): an on-chain identity registry plus a compliance contract that checks every transfer against KYC status, jurisdiction, holding limits, and lock-ups before it settles.
We implement permissioned issuance on this model: a token contract bound to an investor registry, configurable transfer restrictions, and an upgrade path your compliance team controls. The alternative, bolting compliance onto a plain token after mint, is the failure mode tokenization platforms hit most often, because there is no enforcement layer once the asset is live.
We build the enforcement in at issuance, so "who can hold this, under what conditions, and for how long" is answered in code rather than in a spreadsheet. Start with our tokenization infrastructure service.
02
KYC, investor registry, and on-chain compliance
Compliance is the part institutional capital checks first. We build KYC/KYB gating, multi-tier permissioning, investor registries, and jurisdiction-aware transfer rules into the token and vault layer, not as an off-chain gate that the contracts ignore. For Swarm Markets, a BaFin-licensed DEX at launch where only KYC-verified wallets can trade, we built the DEX core and subgraph underneath Swarm's own permissioning layer (detail below).
For fund and credit products, our VaultOS module set (P1-P5) adds post-issuance distribution control, transfer-restriction enforcement, and an investor registry that stays authoritative after the asset is minted. The result is that an allocator's risk committee can see exactly which addresses are eligible, how redemptions are controlled, and how the rules are enforced.
Those are the questions that otherwise stall an onboarding for months. Compliance overlays and jurisdiction templates are configurable per asset class.
03
How do tokenized funds and credit vaults work (ERC-4626 / ERC-7540)?
A token represents the asset; a vault runs it. For tokenized fund shares, private-credit pools, and tokenized treasuries, we build vaults on the ERC-4626 standard, and on ERC-7540 where subscriptions and redemptions are asynchronous. That is the realistic case for funds and credit, where entry and exit are not instant and need NAV-aware settlement, role separation, and queued redemptions at institutional quality.
Our VaultOS infrastructure gives the issuer a client-owned control plane: governance, policy, approvals, and redemption controls, with design partners across RWA platforms, custodians, and allocators. For dollar products, we deliver a full ERC-4626 yield-bearing stablecoin stack: a vault, yield-strategy connectors (Aave/Compound lending, Lido/Rocket Pool staking, or tokenized T-bills via Ondo/Mountain Protocol), a liquidation bot, a subgraph, and Safe governance.
A tokenized T-bill or money-market product gets its on-chain distribution layer without a four-to-six-month greenfield build. Start with our tokenized vault infrastructure or yield-bearing stablecoin service.
05
A compliant secondary market for tokenized RWAs (dOTC)
Issuance is half the problem; the other half is liquidity. Large RWA blocks do not belong on a public DEX, where they create slippage, signaling, and MEV exposure, and where pooled tokens become an attractive single target for an attack. dOTC is our decentralized OTC product: a peer-to-peer secondary market with KYC-gated, multi-tier permissioned access, built so RWA holders and market makers meet without forcing flow through public venues.
It supports tokenized RWAs such as AAPL, TSLA, NVDA, and T-Bonds plus 50+ more, with an embeddable widget designed to be discoverable by AI, and a reward mechanism intended to pay liquidity providers a competitive on-chain yield for keeping live bid/ask offers. It is built around Swarm Markets' tokenized-RWA inventory.
The design goal is a complement to public liquidity infrastructure, not a replacement: private execution with on-chain settlement and permissioning. Start with our RWA decentralized OTC service.
06
Parametric protection for tokenized RWAs (RWArmor)
The objection that loses the most term sheets is "what happens if something goes wrong operationally?" Audits cover code; they do not cover redemption freezes, custody or SPV breakdown, NAV deviation, or distribution failures. RWArmor, our parametric protection layer, is live on Atomica, the permissionless insurance marketplace Protofire DAO built and operates in production with live coverage programs, including LandX.
It pays out automatically when predefined, objective triggers fire, verified by multi-oracle consensus (UMA, Kleros, and custom adapters) rather than a manual claims process. With LandX it insured 841 hectares and 660,000 kg of crops against loss, and it has validated coverage on $500K of initial loans through Atomica.
The team behind it is not first-time at this: Renat Khasanshyn co-founded Etherisc, the first decentralized insurance protocol on Ethereum (2017). For an issuer, protection is the structural answer that converts a hesitant institutional allocator into a committed one. Start with our RWA insurance service.
07
How we built it: Swarm Markets (tokenized equities)
Swarm Markets came to us to put regulated financial products on-chain without giving up the core DeFi properties: self-custody, on-chain transparency, and networked liquidity.
Our approach. We built the DEX core, an AMM forked from Balancer's audited weighted-pool contracts, and the subgraph data layer the trading interface reads from, and we contributed to dOTC, Swarm's OTC venue for large trades. The fork passed a pre-launch audit by Pessimistic.
Swarm kept the license and ran its own KYC and permissioning layer, so every user and asset was verified before trading, while our contracts handled pricing, pooled liquidity, and settlement underneath.
The outcome. Swarm DEX launched under BaFin licenses, and Swarm describes it as the first decentralized exchange supporting both crypto and tokenized real-world assets. Swarm Markets reports transaction fees about 98% lower than before (from $5-10 to $0.05-0.10), 7,000+ KYC-verified users, and 50+ trading pairs, including tokenized Apple (AAPL) and Tesla (TSLA) stock, at 100% KYC coverage.
Our part was the on-chain trading core underneath a regulated tokenized-securities venue, shipped to mainnet. Read the full case study: Swarm Markets DEX.
08
An engineering team that owns the RWA stack since 2016
Protofire has shipped 250+ projects since 2016 across 60+ networks and 95+ protocols. We deployed Safe on 120+ EVM networks, where it secures $2B+. We are a core contributor to Chainlink, and our indexer on The Graph ranked third by cumulative indexing rewards on its original Ethereum network (2020 to 2024).
We maintain Solhint, the open-source Solidity linter used by 1M+ developers. For finance and RWA teams specifically, we have built the on-chain products an issuer needs end to end: VaultOS for client-owned vaults, RWArmor for parametric protection (live on Atomica), and dOTC for compliant secondary liquidity.
That makes us one of the few teams that can show a shipped RWA stack rather than an advisory framework. When we recommend ERC-3643, an ERC-7540 redemption flow, or a Proof-of-Reserve design, it is because we have deployed it.
“The engineering team that owns the RWA stack on mainnet: permissioned tokens, vaults, compliance, oracles, secondary liquidity, and protection, built so you own it rather than rent it.”
Tokenized securities live on mainnet
98%lower fees on Swarm Markets, the DEX we built the trading core for
We built the DEX core and subgraph for Swarm Markets, a BaFin-licensed DEX at launch for tokenized equities and RWAs where only KYC-verified wallets can trade. Swarm Markets reports 7,000+ KYC-verified users and 50+ trading pairs, including AAPL and TSLA.
Swarm Markets DEXView project →
Billionsin reserves attested on-chain
We built and operated real-time on-chain Proof-of-Reserve reporting infrastructure at enterprise scale, the same attestation model integrated into the RWA issuance stack.
Enterprise-scale PoR
7+ networksexternal adapters, incl. Cache.gold PoR
As a core Chainlink contributor we built external adapters across 7+ networks and wired Chainlink Proof-of-Reserve, including the Cache.gold reserve attestation, into the issuance and redemption path so backing is proven on-chain rather than in a PDF.
Chainlink Proof-of-ReserveView project →
FAQ
What is an RWA issuer, and what is RWA tokenization?
An RWA issuer is an entity that originates a real-world asset (a treasury bill, a private-credit note, a property, a commodity, or a fund share) and represents ownership of it on-chain as a token that investors can hold, trade, and redeem. RWA tokenization is the full engineering stack that makes that token usable: a permissioned token contract (typically ERC-3643), a compliance and KYC layer, price and reserve oracles, a vault on ERC-4626 or ERC-7540 for subscriptions and redemptions, and a compliant secondary market for liquidity. Most of that stack is invisible until it breaks. Protofire builds and deploys it on infrastructure you own: the contracts, compliance layer, oracles, vaults, and protection. We have shipped 250+ projects since 2016 across 60+ networks and 95+ protocols, so the standards we recommend for your assets are ones we have already deployed to mainnet.
Which token standard should I use, and is it ERC-3643?
For tokenized securities and other permissioned assets, ERC-3643 (T-REX) is the industry standard: it pairs an on-chain identity registry with a compliance contract that enforces transfer rules (KYC status, jurisdiction, holding limits, and lock-ups) at the protocol level, so the rules travel with the token rather than being bolted on after mint. For tokenized funds, credit pools, and treasuries, the asset is instead wrapped in a vault on ERC-4626, or ERC-7540 when subscriptions and redemptions are asynchronous and need NAV-aware settlement. We implement permissioned issuance on the ERC-3643 model: a token contract bound to an investor registry, with configurable transfer restrictions and an upgrade path your compliance team controls. We pick the standard against your real constraints, which are compliance, liquidity, and custody, and the choice is rarely a single standard but a combination, which we implement end to end.
How do you handle compliance, KYC, and custody?
We build KYC/KYB gating, multi-tier permissioning, investor registries, and jurisdiction-aware transfer restrictions directly into the contracts, not as an off-chain gate the contracts ignore, plus Proof-of-Reserve and NAV oracles so backing is attested on-chain rather than asserted in a PDF. For Swarm Markets, a BaFin-licensed DEX at launch where only KYC-verified wallets can trade, we built the DEX core and subgraph underneath Swarm's own KYC and permissioning layer. For fund and credit products, our VaultOS module set adds post-issuance distribution control, transfer-restriction enforcement, and an investor registry that stays authoritative after the asset is minted. Custody and SPV arrangements integrate via data feeds compatible with that reporting. The goal is that an institutional risk committee can verify which addresses are eligible, how redemptions are controlled, and how backing is proven without taking anyone's word for it. Those are the questions that otherwise stall an onboarding for months.
How do investors get liquidity after issuance?
Through a compliant secondary market. Issuance is only half the problem; the other half is liquidity, and large RWA blocks do not belong on a public DEX, where they create slippage, signaling, and MEV exposure and become a single target for an attack. Our dOTC product is a KYC-gated, multi-tier permissioned peer-to-peer venue for tokenized RWAs (supporting assets such as AAPL, TSLA, NVDA, and T-Bonds plus 50+ more) that lets holders and market makers meet without forcing flow through public venues, with a reward mechanism designed to attract liquidity providers. It is built around Swarm Markets' tokenized-RWA inventory and settles on-chain with permissioning intact. For protection against operational risk such as redemption freezes, custody breakdown, and NAV deviation, RWArmor adds a parametric layer that pays out automatically on objective triggers, so liquidity and downside protection are addressed together.
Can a TradFi-style issuer without a crypto-native team still get help?
Yes. That is the core of this work. Most issuers and tokenization platforms we serve come from traditional finance and have a real asset and book, not a Solidity team. We guide them through the on-chain decisions (token standards, compliance and KYC, custody, oracles and Proof-of-Reserve, secondary liquidity, and protection) and then build the result with the same engineers who scoped it, so nothing is lost in a hand-off. You keep origination, underwriting, and investor relationships; we deliver the contracts, compliance layer, vaults, oracles, and the dOTC and RWArmor layers on infrastructure you own. Because we have shipped tokenized-securities infrastructure to mainnet before, including the DEX core for Swarm Markets, a BaFin-licensed DEX at launch, we can show a working stack rather than a framework, and the architecture we recommend for your assets is one we already run in production.
How long does it take and what does it cost?
It depends on scope. A focused build such as an ERC-4626 yield-bearing dollar stack (vault, yield-strategy connectors, liquidation bot, subgraph, and Safe governance) is roughly 8-13 weeks; a full issuance-to-secondary-market platform spanning permissioned tokens, compliance, vaults, oracles, and liquidity is longer. Protection-layer integration via Atomica runs about 4-8 weeks. The variables that move the timeline are the token standard, compliance and jurisdiction scope, how many vault and oracle integrations you need, and whether secondary liquidity (dOTC) and protection (RWArmor) are in scope. We scope and price each engagement on the first call and give you a fixed scope before any work starts, so there are no open-ended costs once the build begins. Most clients phase it: issuance first, then secondary liquidity and protection as the book and investor base grow.
Discussed on The Protocol Roundtable
All episodesGet a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
I accept the
Privacy PolicyI agree to receive new research announcements as well as information about Protofire services and special offers
An NDA is available from the first message and can cover anything you share. How it works