Source-linked AI summary
RWA-PoB: A Credential-Based Proof-of-Backing Framework for Tokenized U.S. Treasury Products
Rischan Mafrur, Gun Gun Febrianza, Sean Foley
TL;DR
Aggregate proof of reserves does not establish whether off-chain Treasury assets are legally eligible, unencumbered, consistently valued, or liquid enough for redemptions. RWA-PoB binds five-role institutional claims to a canonical EIP-712 snapshot and applies backing and liquidity policies, rejecting an encumbered state and queueing a stressed redemption while retaining key off-chain trust assumptions.
Problem
Aggregate reserve coverage does not establish the legal eligibility, encumbrance status, valuation consistency, or redemption-horizon availability of off-chain assets.
Method
RWA-PoB uses five-role approval of a canonical signed snapshot and separate BCR and RLC policies to govern token issuance and redemption.
Results
In controlled evaluation, RWA-PoB rejected an encumbered-assets state accepted by aggregate PoR and queued a stressed redemption despite adequate overall backing.
Takeaways & Limitations
The prototype demonstrates the intended policy and accounting behaviour for attributable institutional claims without replacing custodians, auditors, legal agreements, or institutional trust.
Takeaways & Limitations
RWA-PoB authenticates signed claims but does not independently prove off-chain asset existence, ownership, completeness, valuation, legal status, or settlement finality.
Abstract
from arXiv · showhide
Proof of reserves (PoR) can improve transparency for tokenized assets, but aggregate reserve coverage does not establish whether off-chain assets are legally eligible, unencumbered, consistently valued, or sufficiently liquid for redemptions. We propose RWA-PoB, a credential-based proof-of-backing framework for tokenized U.S. Treasury products. Five authorised institutional roles approve a canonical EIP-712 snapshot containing reserve, liability, liquidity, and policy information. The framework evaluates backing adequacy through the Backing Coverage Ratio (BCR) and short-term redemption capacity through the Redemption Liquidity Coverage (RLC). The Solidity prototype couples the policy controller to an ERC-20 token. Successful issuance atomically increases token supply and recorded liabilities by the corresponding USD-denominated liability. A redemption request burns tokens while reclassifying the corresponding obligation as pending. The obligation is reduced only after an authorised settlement-role account confirms payment. We evaluate the framework against a simplified aggregate PoR baseline using USDY-calibrated liabilities and deterministic synthetic reserve scenarios. Both approaches permit issuance in the valid state, but RWA-PoB rejects an encumbered-assets state with a BCR of 96.3408%, below the experimental 105% threshold. Under liquidity stress, it classifies the proposed redemption as queued because the post-request RLC falls to 39.9999%. RWA-PoB authenticates the attribution and integrity of institutional claims but does not independently prove the existence, ownership, or condition of off-chain assets. The prototype, test suite, datasets, and replication scripts are available at https://github.com/rischanlab/PoB.
1 Introduction
Aggregate proof of reserves can improve transparency but does not establish the legal eligibility, encumbrance status, valuation consistency, or redemption liquidity of off-chain assets. RWA-PoB addresses this gap by binding role-specific institutional claims to a canonical state and applying separate backing and liquidity policies to token operations.
- Aggregate reserve comparisons do not establish solvency, liquidity, or enforceable token-holder claims over reported assets.
- Off-chain assets may be improperly owned, encumbered, unsettled, incorrectly valued, or unavailable within the promised redemption period.
- Publicly documented systems do not consistently bind custody, eligibility, encumbrance, valuation, settlement, liabilities, and liquidity claims to one reporting state.
- RWA-PoB uses identified institutional roles and a canonical snapshot to translate attributable claims into on-chain minting and redemption controls.
- BCR measures risk-adjusted eligible reserves against total liabilities, while RLC measures liquid assets against redemption obligations within the applicable horizon.
- The prototype atomically couples issuance with liability recording and redemption burning with pending-liability reclassification until authorised settlement confirmation.
- The evaluation uses a simplified aggregate PoR baseline, USDY-calibrated liabilities, deterministic reserve scenarios, and controller and integration tests.
2 Literature Review
The literature provides reserve disclosure, oracle delivery, credential, accounting, and regulated-token components, but not a unified product-level backing specification. RWA-PoB integrates role-assigned evidence, common reporting state, separate backing and liquidity metrics, and token accounting controls for tokenized Treasury products.
- Prior reserve-assurance research distinguishes assets, liabilities, reserves, and solvency, showing that aggregate snapshots are incomplete measures of financial resilience.
- Double-Helix reconciles on-chain and off-chain accounting but targets exchanges and custodial platforms rather than specific tokenized securities.
- RWA-PoB extends integrated reserve assurance to product-level backing and liquidity controls through a common signed snapshot of role-specific claims.
- RWA tokenization creates evidence problems because signatures, commitments, and proofs cannot independently establish custody, encumbrance, settlement finality, or enforceable interests.
- ERC-3643, ERC-7943, and verifiable credentials provide identity, compliance, administrative, and exchange components but do not define reserve eligibility, backing adequacy, or redemption-liquidity assessment.
- The methodological gap is integrating role-assigned evidence, a common reporting state, separate backing and liquidity evaluation, and atomic token transitions.
3 Comparison with Existing Systems
RWA-PoB is positioned as a complementary evidence and policy framework rather than a replacement for attestations, oracle infrastructure, or issuer controls. Its distinctive contribution is combining attributable claims into a time-consistent state that governs backing and liquidity decisions.
- The comparison distinguishes document-based attestations, Chainlink infrastructure, USDY’s operating product, and RWA-PoB’s evidence-and-policy framework.
- Document-based attestations can report independently reviewed assets and liabilities, but their scope varies from aggregate balances to maturity, custody, and reconciliation information.
- Chainlink can deliver reserve information and block issuance when collateral is insufficient, while deployment assurance depends on selected sources, methodology, configuration, and update policy.
- USDY combines daily third-party attestations, legal and institutional protections, asset-eligibility restrictions, and unfulfilled-redemption liabilities retained until completion.
- RWA-PoB requires authorised claims to share an epoch and valuation cut-off and checks completeness, validity, freshness, revocation, and replay before token operations.
- BCR evaluates risk-adjusted reserves against obligations, whereas RLC evaluates conversion capacity within a redemption horizon; the accepted snapshot controls issuance and redemption disposition.
- RWA-PoB combines these inputs into one time-consistent snapshot and makes snapshot acceptance an explicit condition for on-chain actions.
4 System Scope and Trust Model
The framework targets fungible claims on short-duration Treasury portfolios and relies on digitally signed, time-bounded evidence from five institutional roles. Its controls authenticate and coordinate claims but do not establish off-chain truth, and governance and signer availability remain important boundaries.
- The scope covers fungible claims on short-duration U.S. Treasury securities, cash, and cash equivalents, while excluding long-duration bonds, equities, and other RWA classes.
- The framework converts token quantities into USD liabilities using an authenticated redemption price or net asset value; the prototype evaluates the special case P_red^t = 1.
- Issuance is permissioned to the issuer role, redemption requests are open to holders with sufficient balances, and regulated-token compliance controls are not implemented.
- Five required roles sign the same canonical snapshot, while the controller verifies authorisation, signatures, timing, epochs, policy consistency, liability continuity, replay protection, and revocation.
- Roles are assigned responsibility for holdings, liabilities, valuation, and legal eligibility, but the contract does not restrict each signer to particular snapshot fields.
- Digital signatures establish statement origin and integrity, not the truth of contents, leaving the framework dependent on institutional honesty, contracts, oversight, and enforcement.
- Five-role approval can prevent acceptance of an invalid state but may reduce availability when a required signer is unavailable or refuses to sign.
- Atomic issuance and redemption controls do not cover separately issued representations, alternative token contracts, or malicious governance decisions.
5 RWA-PoB Architecture and Contribution
RWA-PoB combines five-role approval of a canonical snapshot with policy metrics and atomic token-liability accounting for Treasury-backed products. Its controller separates backing adequacy from redemption liquidity and governs issuance, redemption, and settlement transitions.
- Evidence and Institutional Roles: RWA-PoB combines five-role snapshot approval, a canonical backing snapshot, BCR- and RLC-based policy control, and atomic token-liability integration.The five required roles approve the complete snapshot, while a separate settlement role confirms subsequent redemption settlements.
- Eligible Reserves: Position eligibility requires legal and operational conditions including valid legal title, no prohibited encumbrance, and settlement finality.The experiment represents market, eligible, and liquid values alongside maturity, haircut, encumbrance, legal eligibility, and settlement-finality fields; aggregation occurs off-chain.
- Settlement Accounting: Settlement confirmation reduces pending obligations and tracked liquid assets, but the prototype does not propagate settlement into cash, eligible reserves, or gross reserves between snapshots.The settlement-role call records institutional payment confirmation rather than independently proving bank finality.
- Backing Metrics and Policy Logic: BCR measures risk-adjusted eligible reserves against total economic liabilities, while RLC measures assets convertible to settlement assets against redemption value due within a specified horizon.The prototype uses one implicit horizon, with post-request RLC including the proposed redemption in the denominator.
- Token-Liability Accounting: Issuance atomically increases token supply and recorded USD-denominated liabilities, while redemption burns tokens and moves the corresponding liability into pending-redemption liabilities.The applicable redemption price is fixed when the request is accepted, and total liabilities remain unchanged during reclassification.
- Backing Metrics and Policy Logic: A low BCR blocks further issuance, whereas a low RLC changes redemption disposition without extinguishing the investor’s claim.The controller can determine whether redemption is settled immediately or queued under the applicable liquidity condition.
6 Prototype and Evaluation
The prototype validates signed reserve-state snapshots, applies BCR and RLC policy checks, and couples token supply with liability accounting. Deterministic USDY-calibrated scenarios show that RWA-PoB rejects encumbered backing and queues redemptions under liquidity stress, while adding execution cost.
- 6.1 Prototype Implementation: The Solidity prototype validates institutional snapshots, computes BCR and RLC, authorises liability changes, records redemption dispositions, and accounts for settlement.The controller is coupled to an ERC-20 token through the RWABackedToken contract.
- 6.2 Experimental Setup: 1,043 daily USDY-related observations calibrate liabilities, while 100-position synthetic scenarios use seed 42 and thresholds of 105% for BCR and 100% for RLC.The latest observation is approximately USD 2.162 billion; experiments set P_red = 1.
- 6.2 Experimental Setup: 31 deterministic tests passed, covering snapshot validation, policy enforcement, atomic rollback, redemption and settlement bounds, and accounting invariants.The suite includes unit, integration, adversarial, model-based, scenario, and gas-generation tests.
- 6.3 Experimental Results: 96.3408% BCR caused RWA-PoB to reject encumbered-assets issuance, although the aggregate baseline accepted minting against approximately USD 2.486 billion gross reserves.The threshold was 105%, after excluding encumbered assets and including other liabilities.
- 6.3 Experimental Results: 39.9999% post-request RLC caused the controller to queue the proposed redemption under liquidity stress, while BCR remained 114.1209%.Separate integration tests confirm that a submitted redemption remains pending until settlement.
- 6.4 Execution Cost: 132,573 gas for atomic issuance was 13.35% lower than the 153,006-gas two-transaction alternative in ten controlled repetitions.Initial publication cost approximately 3.83 times baseline, and subsequent updates cost approximately 5.16–5.23 times baseline.
7 Regulatory and Legal Considerations
Tokenized Treasury products retain the legal character of their underlying instruments, and applicable requirements depend on product structure and jurisdiction. RWA-PoB does not determine or enforce legal compliance, while its commitments do not independently create enforceable rights.
- 7 Regulatory and Legal Considerations: Tokenized Treasury products may constitute fund interests, debt securities, security entitlements, or other contractual claims depending on their structure.Applicable requirements may include registration or exemptions, disclosure, custody, transfer restrictions, investor eligibility, and anti-money-laundering controls.
- 7 Regulatory and Legal Considerations: In the European Union, financial-instrument crypto-assets remain subject to securities-market rules rather than MiCA, while the DLT Pilot Regime covers certain supervised infrastructures.Product classification and jurisdiction must be determined before selecting legal, credential, and policy requirements.
- 7 Regulatory and Legal Considerations: RWA-PoB does not determine or enforce legal compliance, and the implemented ERC-20 permits unrestricted transfers without identity, whitelisting, freezing, or jurisdictional controls.The conceptual framework could be combined with ERC-3643 or external identity and compliance systems.
- 7 Regulatory and Legal Considerations: Document hashes and Merkle commitments establish data consistency with a commitment but do not prove truth or create legal rights.Enforceable rights must arise from applicable fund documents, security agreements, custody arrangements, and law.
8 Limitations and Future Research
RWA-PoB authenticates institutional statements but does not independently establish their economic or legal truth. Its five-role approval requirement improves safety while creating availability risk, and the evaluation remains a simplified, non-production study.
- 8 Limitations and Future Research: Signer collusion, omitted liabilities, false custody or valuation records, and defective legal arrangements may remain undetected.The system authenticates statement origin and integrity rather than independently proving the underlying claims.
- 8 Limitations and Future Research: The prototype evaluates P_red = 1, while the general framework supports a snapshot-authenticated redemption price.Variable-price conversion and conversion rounding are not implemented.
- 8 Limitations and Future Research: The experiments use one liability observation, seeded synthetic positions, one deterministic state-machine sequence, and local EVM gas measurements.They do not provide longitudinal simulation, real portfolio calibration, formal verification, independent security auditing, or production deployment evidence.
- 8 Limitations and Future Research: Future work should formalise adversary, safety, and liveness properties and evaluate them with fuzz-invariant testing, symbolic execution, threat-to-outcome matrices, and longitudinal simulations.The proposed simulations should use complete liability histories, stochastic redemption flows, and parameter sweeps.
9 Conclusion
RWA-PoB combines five-role approval of a canonical snapshot with explicit backing, liquidity, issuance, and redemption-accounting policies. Its controlled evaluation rejected an encumbered-assets state accepted by aggregate PoR, while integration tests confirmed pending-liability and settlement accounting.
- RWA-PoB combines five-role approval of a canonical snapshot with explicit backing, liquidity, issuance, and redemption-accounting policies.
- It verifies signer roles, signatures, freshness, policy consistency, liability reconciliation, and replay protection.
- It separates backing adequacy from redemption liquidity through the Backing Coverage Ratio and Redemption Liquidity Coverage.
- Redemption requests reclassify the same USD-denominated value as a pending obligation until settlement is confirmed.
- RWA-PoB rejected an encumbered-assets state that the aggregate PoR baseline accepted, while liquidity stress classified the proposed redemption as queued despite adequate overall backing.The results demonstrate the prototype’s intended policy and accounting behaviour but do not remove institutional trust or establish production readiness.
A RWA-PoB Policy-Flow Diagrams
The appendix presents two operational flows: snapshot validation with mint authorisation, and redemption classification followed by settlement confirmation.
- Figure A.1 summarises snapshot validation and mint authorisation.
- Figure A.2 shows redemption classification and subsequent settlement confirmation.
- A redemption burns q tokens while reclassifying the corresponding request-time USD liability ∆Vt(q) as pending.
- In the reported prototype, t = 1 and therefore ∆Vt(q) = q.