Most RWA repos stop at an ERC-20 with a whitelist. Real asset tokens need identity, transfer restrictions, and forced recovery baked into the token itself. QuillAudits' reference handbook maps the actual stack:
ERC-3643 (T-REX): permissioned transfers gated by an on-chain identity registry, so transfer reverts unless both parties hold a valid claim. Compliance lives in the token, not off-chain.ERC-4626: the vault layer for yield-bearing wrappers over the underlying asset.The hard part is the admin surface: forced transfers, freeze, and mint/burn for redemptions are power tools that widen your attack surface. Every privileged path needs its own access-control review, not a blanket
onlyOwner.Ships with Foundry code and an audit methodology.
Quillhash/Real-World-Assets-RWA
@soliditypedia
