Paper: RWA-PoB: A Credential-Based Proof-of-Backing Framework for Tokenized U.S. Treasury Products
Authors: Rischan Mafrur, Gun Gun Febrianza, Sean Foley
Date: 2026-08-26
Estimated Reading Time: 20-25 minutes
Proof of reserves compares aggregate assets against reported obligations and stops there. The paper argues that this comparison omits whether the assets are legally eligible, unencumbered, consistently valued and convertible within a redemption window, and proposes RWA-PoB to close that gap for tokenized U.S. Treasury products. Five institutional roles, being the custodian, the administrator, the valuation agent, the trustee or legal role, and the independent verifier, each sign one canonical EIP-712 snapshot carrying reserve, liability, liquidity and policy fields. A Solidity policy controller checks signer authorisation, epoch progression, freshness, policy consistency, liability continuity and replay protection, then applies two metrics: the Backing Coverage Ratio for backing adequacy and the Redemption Liquidity Coverage for short-horizon redemption capacity. Issuance and the matching liability increase commit in a single transaction, while a redemption request burns tokens and reclassifies the same USD value as a pending obligation that is reduced only after a settlement role confirms payment. The evaluation calibrates liabilities to approximately USD 2.162 billion of Ondo USDY obligations, generates 100 synthetic positions per scenario with seed 42, and runs 31 deterministic tests. The authors state that the framework authenticates the origin and integrity of institutional claims and does not independently prove that the off-chain assets exist.
Core insights
- Eligibility is applied before the arithmetic Each reserve position carries custody, legal title, encumbrance and settlement-finality fields, combined into an indicator that zeroes the position before any haircut is applied, so that eligible_value = eligibility_flag * (1 - haircut) * price * quantity. In the encumbered-assets scenario, gross reserves of approximately USD 2.486 billion against token obligations of approximately USD 2.162 billion still produced a Backing Coverage Ratio of 96.3408% against the experimental 105% threshold, and issuance was rejected. The aggregate proof-of-reserves baseline accepted the same state, because a gross comparison cannot represent encumbrance at all.
- Two metrics that fail in different directions The Backing Coverage Ratio divides risk-adjusted eligible reserves by total liabilities, while the Redemption Liquidity Coverage divides liquid assets by redemption value due within the horizon. A ratio below the backing threshold blocks minting outright, while liquidity coverage is tested at two points: minting checks the current value, and a redemption's disposition checks the value after the request, so a request that fails only the second is queued rather than refused and the holder's claim survives. With liquid assets reduced to 2% of token value and a proposed redemption of 5%, post-request liquidity coverage fell to 39.9999% while backing coverage held at 114.1209%, and the request was queued.
- Redemption burns first and settles later A redemption request burns the tokens and moves the same USD amount from token liabilities into pending-redemption liabilities, so that total_liabilities = token_liabilities + pending_redemptions + other_liabilities is unchanged at the moment of request. The obligation falls only when an authorised settlement role confirms payment against the specific claim. The reported prototype reduces pending liabilities and tracked liquid assets on confirmation but does not propagate the payment into cash, eligible reserves or gross reserves between snapshots, which the authors identify as incomplete relative to the framework-level accounting.
- The evidence layer has a measured price Publishing the initial signed state consumed 362,241 gas against 94,689 for the aggregate baseline, with subsequent updates running 5.16 to 5.23 times the baseline cost, a difference attributed to five signature verifications and additional storage. Atomic issuance consumed 132,573 gas against 153,006 for separate advisory authorisation followed by independent minting, or 13.35% lower across ten controlled repetitions. All figures come from local Hardhat receipts and exclude deployment, off-chain processing, oracle fees and network prices.
- Safety is purchased with liveness Acceptance requires one valid signature from each of the five mandatory roles over the same digest, so an honest signer can prevent a state it judges invalid, and an unavailable or withholding signer can halt issuance and queue every redemption. The 105% and 100% thresholds are experimental placeholders with no calibration against redemption flow, valuation volatility or any regulatory requirement. The prototype also fixes the redemption price at one, so designs whose net asset value accumulates over time are not exercised by the reported results.
RWA-PoB converts token supply from an issuer decision into a function of the accepted snapshot. Minting is permitted only when coverage measured after the mint still clears the threshold, so that post_mint_BCR = eligible_reserves / (liabilities + new_liability) and the check binds on eligible reserves rather than gross ones. Supply can therefore expand only while eligible reserves grow ahead of obligations, and the encumbered-assets scenario is precisely the case where the two numerators diverge: the same portfolio supports issuance under a gross comparison and blocks it under an eligibility-weighted one. Subscriptions usually arrive in waves, so the operational question is whether eligibility can be re-established fast enough to serve one, because a mint blocked at the moment of demand does not disappear; it comes back later as a claim on the same reserves.
On the redemption side the framework separates two questions that a single collateralisation ratio combines. A holder facing a queued request retains the full claim and loses only immediacy. That separation has a direct consequence for how a queue should be priced: the paper classifies a request as instant or queued but does not order the queue, allocate partial settlement across competing claims, or attach any compensation to waiting (which is where a queue stops being a scheduling device and becomes a haircut nobody priced). If two holders request redemption in the same epoch and liquid assets cover one of them, what determines which claim settles first, and does the answer create an incentive to request early in every epoch regardless of need?
The liveness cost of five-role approval is the most consequential economic property in the framework, and it is not a failure mode that the metrics report. A snapshot that cannot be refreshed becomes stale, a stale snapshot is not fresh, and issuance stops while every redemption receives a queue disposition. The condition that makes the framework safe against a single dishonest attestor is the same condition that lets a single unavailable attestor freeze the product. The paper acknowledges this and proposes threshold signatures as future work, but the reported prototype requires all five, so the availability of the least reliable institutional counterparty sets the availability of the token.
Threshold calibration is left open in a way that matters for anyone considering the framework in production. The backing threshold of 105% and the liquidity threshold of 100% are described as experimental, and the evaluation uses a single latest observation from a 1,043-day liability series rather than the series itself. What either threshold costs when set wrong is not measured, because measuring it requires the longitudinal simulation with stochastic redemption flow that the authors list as future work.
The framework's own limiting statement is where the design boundary actually sits. Signature verification establishes which authorised account approved a statement, not whether the statement is true, and the Merkle root commits to position records without establishing that those records are complete or consistent with the reported aggregates. Collusion among the five signers, omitted liabilities and defective legal arrangements remain outside what the contract can detect. The practical value is therefore attribution: a materially false state becomes a signed and time-stamped record of which institution approved it, which changes the cost of misreporting without removing the possibility.
The paper supplies a reproducible policy layer with an explicit trust model, three scenarios, 31 deterministic tests, and gas measurements for snapshot publication and issuance. It does not supply evidence that the framework behaves well against real portfolios, real redemption flow, or an adversary who controls a signer. The aggregate baseline is described as simplified and cannot represent encumbrance or redemption liquidity by construction, so the reported divergence between the two models is arithmetic rather than empirical. I would want one measurement before treating any of it as calibrated: how often the eligibility-weighted ratio would have blocked issuance on a real Treasury portfolio nobody would have called undercollateralised.
