A Price From the Future Cost $23.75M: 5 Checks Before Your Tokenised RWA Launches

TL;DR — Quick Summary

• A tokenised real-world asset can be fully compliant and still pay out on a price nobody should have accepted. The token checks who may hold it. What it is worth comes from a price someone signs off chain.
• Reject price reports dated in the future, and reports older than your limit. In July 2026, a validly signed report from the future priced Bitcoin at $5,000 and 23.75M USDC left a vault in about five minutes. In our demo, the same trick took 23.75% of the vault.
• Check every redemption against the age of the NAV and a second reference. In our demo, a NAV stuck at $1.00 for three days paid 1,000,000 for shares worth 920,000.
• Run compliance on every transfer path, wrappers included. In our demo, a wallet the token refused to send to ended up holding 50,000 through a wrapper.
• Put agent powers (forced transfer, freeze, mint) behind a multisig, a timelock and a cap, and settle async redemptions at the next NAV, not the one known at request time.

Introduction

How a tokenised fund works

1. A price from tomorrow: reports accepted from the future

The demo

1// contracts/src/PerpVault.sol
2function _verify(Report calldata r, bytes calldata sig) internal view {
3    bytes32 d = MessageHashUtils.toEthSignedMessageHash(keccak256(abi.encode(r.price, r.ts)));
4    if (ECDSA.recover(d, sig) != reporter) revert BadSignature();
5    _checkTime(r.ts);
6}
7
8/// Vulnerable: no time check at all.
9function _checkTime(uint64) internal view virtual {}

1vault holds 240,000 tUSDC (LP liquidity)
2signed report: BTC $5,000 · ts = now + 2h
3$ attacker → open(1,000 tUSDC, 5x long, that report)
4  ✓ opened 1 BTC at $5,000
5$ attacker → close(fresh report: BTC $62,000)
6vault 240,000 → 183,000 (-23.75%)
7VAULT -23.75% · ATTACKER +57,000 tUSDC

The fix

1// contracts/src/PerpVaultFixed.sol
2uint256 public constant MAX_AGE = 60; // seconds
3
4function _checkTime(uint64 ts) internal view override {
5    if (ts > block.timestamp || block.timestamp - ts > MAX_AGE) revert FutureReport();
6}

1vault holds 240,000 tUSDC (LP liquidity)
2signed report: BTC $5,000 · ts = now + 2h
3$ attacker → open(1,000 tUSDC, 5x long, that report)
4  ✗ reverted: FutureReport
5vault 240,000 → 240,000 (0.00%)
6VAULT UNCHANGED · 240,000 tUSDC

2. Yesterday's NAV, today's cash: redemptions at a stale NAV

The demo

1// contracts/src/RedemptionVault.sol
2function redeem(uint256 amount) external {
3    uint256 nav = _nav();
4    shares.transferFrom(msg.sender, address(this), amount);
5    usdc.transfer(msg.sender, amount * nav / 1e18);
6}
7
8/// Vulnerable: trusts the feed blindly.
9function _nav() internal view virtual returns (uint256) {
10    return feed.nav();
11}

1NAV feed: $1.00 · updated 3 days ago
2reference NAV: $0.92
3$ redeemer → redeem(1,000,000 shares)
4  paid 1,000,000 tUSDC · fair 920,000
5OVERPAID 80,000 tUSDC (+8.70%)

The fix

1// contracts/src/RedemptionVaultFixed.sol
2function _nav() internal view override returns (uint256 nav) {
3    nav = feed.nav();
4    uint256 r = ref.nav();
5    if (block.timestamp - feed.updatedAt() > 1 days) revert StaleNAV();
6    if ((nav > r ? nav - r : r - nav) * 100 > r * 2) revert StaleNAV();
7}

1NAV feed: $1.00 · updated 3 days ago
2reference NAV: $0.92
3$ redeemer → redeem(1,000,000 shares)
4  ✗ reverted: StaleNAV
5NOTHING PAID · shares kept 1,000,000

Tokenising a fund, credit or equities? Send us the design before you launch. We will tell you where it breaks, and what it would take to make it safe. Request a design review →

3. KYC checked, side door open: a wrapper that skips compliance

The demo

1// contracts/src/Wrapper.sol
2function wrap(uint256 amount) external {
3    token.transferFrom(msg.sender, address(this), amount);
4    _mint(msg.sender, amount);
5}

1canTransfer(alice → mallory): false
2$ alice → token.transfer(mallory, 50,000)
3  ✗ reverted: NotEligible
4$ alice → wrap(50,000) · send wrapped → mallory
5  ✓ sent
6mallory: tFUND 0 · wrapped 50,000
7canTransfer: false · YET HOLDS 50,000 WRAPPED

The fix

1// contracts/src/WrapperFixed.sol
2function _update(address from, address to, uint256 amount) internal override {
3    if (to != address(0) && !token.canTransfer(from, to)) revert NotEligible();
4    super._update(from, to, amount);
5}

1canTransfer(alice → mallory): false
2$ alice → token.transfer(mallory, 50,000)
3  ✗ reverted: NotEligible
4$ alice → wrap(50,000) · send wrapped → mallory
5  ✗ reverted: NotEligible
6mallory: tFUND 0 · wrapped 0
7BLOCKED · MALLORY HOLDS 0

4. One key, every holder: agent powers with no delay

The demo

1// contracts/src/RwaToken.sol
2/// Recovery tool (lost keys, court orders). Vulnerable: one key, instant, unlimited.
3function forcedTransfer(address from, address to, uint256 amount) public virtual {
4    if (msg.sender != agent) revert NotAgent();
5    _transfer(from, to, amount);
6}

112 holders · 1,200,000 tFUND
2agent key 0x3C44…93BC is stolen
3$ stolen key → batchForcedTransfer(12 → attacker)
4  ✓ one transaction
5holders with a balance: 12 → 0
6attacker holds 1,200,000 tFUND
71 TX · 12 HOLDERS → 0 · 1,200,000 TAKEN

The fix

1// contracts/src/RwaTokenFixed.sol
2function forcedTransfer(address from, address to, uint256 amount) public override {
3    if (msg.sender != agent) revert NotAgent();
4    if (amount > maxForced) revert OverCap();                        // capped
5    ops.push(Op(from, to, amount, block.timestamp + DELAY, false));  // queued
6    emit ForcedTransferQueued(ops.length - 1, from, to, amount, block.timestamp + DELAY); // visible
7}

112 holders · 1,200,000 tFUND
2agent key 0x3C44…93BC is stolen
3$ stolen key → batchForcedTransfer(12 → attacker)
4  ✗ reverted: OverCap · cap 1,000 per operation
5$ stolen key → forcedTransfer(1 holder, 1,000)
6  queued: 1,000 tFUND · executes in 48h · 1 event
7holders with a balance: 12 → 12
812 HOLDERS KEEP THEIR BALANCES · 1 OP QUEUED

5. Redeem early, others pay: async redemptions priced at request time

The demo

1// contracts/src/AsyncRedeem.sol
2/// Vulnerable: the price that was known when the request was made.
3function _settleNav(Request storage r) internal view virtual returns (uint256) {
4    return navAt(r.epoch);
5}

1fund: 2,000,000 shares · NAV $1.00 (epoch 0)
2$ redeemer → requestRedeem(1,000,000) at epoch 0
3loss: assets -8.00% · NAV $0.92 (epoch 1)
4$ settle(request)
5  redeemer paid 1,000,000 · fair 920,000
6  others' share: $0.84 vs NAV $0.92
7  others lose 80,000 of a 1,000,000 stake (-8.00%)
8REDEEMER +80,000 · OTHERS -80,000

The fix

1// contracts/src/AsyncRedeemFixed.sol
2function _settleNav(Request storage r) internal view override returns (uint256) {
3    if (r.epoch + 1 > epoch()) revert NotYetPriced();
4    return navAt(r.epoch + 1);
5}

1fund: 2,000,000 shares · NAV $1.00 (epoch 0)
2$ redeemer → requestRedeem(1,000,000) at epoch 0
3loss: assets -8.00% · NAV $0.92 (epoch 1)
4$ settle(request)
5  redeemer paid 920,000 · fair 920,000
6  others' share: $0.92 vs NAV $0.92
7  others lose 0 of a 1,000,000 stake (0.00%)
8PAID AT $0.92 · OTHERS LOSE 0

The checklist

1. Price reports signed by more than one key, never from the future, never older than your limit.
2. Staleness and deviation checks on every redemption.
3. Every transfer path runs compliance, wrappers included.
4. Agent powers behind a multisig, a timelock and caps.
5. Redemptions settle at the next NAV, not the one at request time.

FAQ

Glossary

Build it safely

Tokenising a fund, credit or equities? Send us the design before you launch. We will tell you where it breaks, and what it would take to make it safe. Request a design review →