Skip to content
Fuga Labs
Scope an engagement
Sector preset

RWA issuers

For tokenised instruments whose control plane decides who owns what, without ever moving value.

Scope an engagement Every sector preset
PresetonboardRwaDetectors in play8Boundaries declared3Refusals at onboarding0

How this sector loses money.

A tokenised instrument has a control plane most monitoring never looks at. The agent role that can force a transfer, the identity registry that decides who is allowed to hold, the compliance module that can be swapped. None of those move value when they change. All of them decide who owns what afterwards.

Answered by
  • 8Deterministic rules

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardRwa(platform, config) 6 configured
  1. 01Token contract, identity registry and compliance module monitored together
  2. 02Control-plane change detection across all three, not just the token
  3. 03Agent-role grants, forced recovery and coercion-campaign patterns
  4. 04Bulk identity registration, which is what an onboarding attack looks like
  5. 05NAV and exchange-rate integrity against declared sources
  6. 06Authority surface: admin changes and upgrade diffs on every component
Detectors in play
  • rules.rwa-control-plane-change
  • rules.rwa-agent-granted
  • rules.rwa-forced-recovery
  • rules.rwa-coercion-campaign
  • rules.rwa-bulk-identity-registration
  • rules.rate-integrity
  • rules.admin-authority-change
  • rules.upgrade-implementation-diff

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Custody of the underlying instrument sits with a regulated custodian, off chain.
Closed by Closed by attested NAV plus the reserve lane: the custodian signs, Fuga Labs measures the on-chain leg under proof of control, and a stale or contradicted attestation raises a CRITICAL rather than passing quietly.
The edge Forced recovery is a legitimate power that is indistinguishable from its abuse.
Closed by Closed by treating it as an event class in its own right. Every forced recovery and agent grant is detected, attributed and written to the hash-chained audit export, so a legitimate use leaves the same evidence trail as an illegitimate one.
The edge ERC-1400 partitioned instruments are not the T-REX shape.
Closed by Closed per deployment during onboarding. The ERC-3643 control plane is modelled natively; a partitioned instrument is modelled against its actual structure before anything goes live, rather than being forced into a preset that does not fit it.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Three contracts enrolled as one control plane: the token, the identity registry and the compliance module. A partitioned instrument is modelled against its actual structure rather than forced into the T-REX shape.

  2. Step 2

    Detect

    The events that decide ownership move no value, so they are watched on their own terms: agent grants, forced recovery, bulk identity registration, and a compliance module swapped out from under the token.

  3. Step 3

    Prevent

    Nothing here is armed to reverse a transfer, and it should not be. What ships is evidence: every forced recovery and agent grant written to the audit export.

What runs underneath.

The hash-chained export does the work here: a control plane that decides ownership needs a record somebody can replay, not a dashboard.

The base under all eleven presets

Scope RWA issuers coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset