This EIP proposes the Universal RWA (uRWA) standard, a set of interfaces for tokenized Real World Assets (RWAs) such as securities, real estate, commodities, or other physical/financial assets on the blockchain.
Real World Assets often require regulatory compliance features not found in standard tokens, including the ability to freeze assets, perform enforcement transfers for legal compliance, and restrict transfers to authorized users. The uRWA standard extends common token standards like ERC-20, ERC-721 or ERC-1155 by introducing essential compliance functions while remaining minimal and not opinionated about specific implementation details.
This enables DeFi protocols and applications to interact with tokenized real-world assets in a standardized way, knowing they can check transfer permissions, whether users are allowed to interact, handle frozen assets appropriately, and integrate with compliant RWA tokens regardless of the underlying asset type or internal compliance logic. It also adopts ERC-165 for introspection.
Real World Assets (RWAs) represent a significant opportunity to bridge traditional finance and decentralized finance (DeFi). By tokenizing assets like real estate, corporate bonds, commodities, art, or securities, we can unlock benefits such as fractional ownership, programmable compliance, enhanced liquidity through secondary markets for traditionally illiquid assets and integration with decentralized protocols.
However, tokenizing real world assets introduces regulatory requirements often absent in purely digital assets, such as allowlists for users, transfer restrictions, asset freezing, or law enforcement rules. Existing token standards like ERC-20, ERC-721 and ERC-1155 lack the inherent structure to address these compliance needs directly within the standard itself.
Attempts at defining universal RWA standards historically imposed unnecessary complexity and gas overhead for simpler use cases that do not require the full spectrum of features like granular role-based access control, mandatory on-chain whitelisting, specific on-chain identity solutions, or metadata handling solutions mandated by the standard.
Additionally, the broad spectrum of RWA classes inherently suggests the need to move away from a one-size-fits-all solution. With the purpose in mind of defining an EIP for it, a minimalistic approach, unopinionated features list, and maximally compatible design should be kept in mind.
The uRWA standard seeks a more refined balance by defining an essential interface, establishing a common ground for interaction regarding compliance and control, without dictating the underlying implementation mechanisms. This allows core token implementations to remain lean while providing standard functions for RWA-specific interactions.
The final goal is to build composable DeFi around RWAs, providing the same interface when dealing with compliance and regulation.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 and RFC 8174.
The following defines the standard interfaces for an ERC-7943 token contract, which MUST extend from one base token interface such as ERC-20, ERC-721 or ERC-1155:
canTransact, canTransfer and getFrozenTokensThese provide views into the implementing contract's compliance, transfer policy logic and freezing status. These functions:
msg.sender).canTransfer
amount being transferred doesn't exceed the unfrozen amount (which is the difference between the current balance and the frozen balance).canTransact check on the from and to parameters. An important documentation note is that ERC-3643 doesn't perform a canTransact check within canTransfer as required.canTransact or anything else that requires privileged actors.getFrozenTokens will return the absolute frozen amount, which MAY exceed the account's current balance. In ERC-721 tokens, it MAY return true even if the account does not hold the token.forcedTransferThis function provides a standard mechanism for forcing a transfer from a from to a to address. The function:
from to to either by transferring or burning from from and minting to to.ForcedTransfer event.canTransfer checks. If this happens, it MUST unfreeze the assets first and emit a Frozen event before the underlying base token transfer event reflecting the change. Having the unfrozen amount changed before the actual transfer is critical for tokens that might be susceptible to reentrancy attacks doing external checks on recipients as it is the case for ERC-721 and ERC-1155 tokens.canTransact check on the to parameter to ensure compliance.canTransfer checks.setFrozenTokensIt provides a way to freeze or unfreeze assets held by a specific account. This is useful for temporary lock mechanisms. This function:
Frozen event.The contract MUST implement the ERC-165 supportsInterface function and MUST return true for the bytes4 value (representing the interfaceId):
0x29388973 for the fungible interface.0xa8fdc849 for the non-fungible interface.0x5627c61a for the multi token interface.Implementations of these interfaces MUST implement the necessary functions of their chosen base standard (e.g., ERC-20 for the fungible interface, ERC-721 for the non fungible interface and ERC-1155 for the multi token interface) and MUST also restrict access to sensitive functions like forcedTransfer and setFrozenTokens using an appropriate access control mechanism (e.g., onlyOwner, Role-Based Access Control). The specific mechanism is NOT mandated by this interface standard.
Implementations MUST ensure their transfer methods exhibit the following behavior:
transfer, transferFrom, safeTransferFrom, etc.) MUST NOT succeed in cases in which canTransfer or canTransact would return false for either one or both from and to addresses.mint functions) MUST NOT succeed for accounts where canTransact on the recipient would return false. In permissioned contexts (e.g., authorized minting by privileged roles), minting SHOULD respect canTransact checks on the recipient, though implementations MAY bypass these checks when necessary for operational or compliance reasons.burn functions) MUST respect canTransfer check, MUST respect the canTransact check on the token holder and MUST NOT allow burning more assets than the unfrozen amount. In permissioned contexts (e.g., authorized burning by privileged roles), burning MAY NOT be restricted by canTransfer or canTransact checks on the token holder and MAY burn more assets than the unfrozen amount, in which case the contract MUST update the frozen status accordingly and emit a Frozen event before the underlying base token transfer event.The ERC7943CannotTransact/ERC7943CannotTransfer errors CAN be used as a general revert mechanism whenever internal calls to canTransact/canTransfer return false. They MAY NOT be used or MAY be replaced by more specific errors depending on the custom checks performed inside those calls.
In general, the standard prioritizes error specificity, meaning that specific errors such as ERC7943InsufficientUnfrozenBalance SHOULD be thrown when applicable. The ERC7943InsufficientUnfrozenBalance error SHOULD be triggered when a transfer is attempted from account with an amount less than or equal to its balance, but greater than its unfrozen balance or with a tokenId which is currently frozen. If the amount is greater than the whole balance or the tokenId is not owned by the account, unrelated from the frozen amount, more specific errors from the base standard SHOULD be used instead.
forcedTransfer, setFrozenTokens, canTransact, canTransfer, getFrozenTokens) and associated events/errors needed for common RWA compliance and control patterns, avoiding mandated complexity or opinionated features. The reason to introduce specific errors (ERC7943CannotTransact, ERC7943CannotTransfer and ERC7943InsufficientUnfrozenBalance) is to provide completeness with the introduced functionalities (canTransact, canTransfer and getFrozenTokens). As dictated in the specifications, error specificity is prioritized, leaving space for implementations to accommodate more explicit errors. Regarding the events Frozen and ForcedTransfer, the reason for their existence is to signal uncommon transfers (like in forcedTransfer) but also to help off-chain indexers to correctly keep track and account for asset seizures and freezing. As mentioned in the specifications, special attention should be paid to the order in which these events are emitted in relation to the base token contract events.canTransact, canTransfer, getFrozenTokens) for compliance checks without dictating how those checks are implemented internally by the token contract. This allows diverse compliance strategies.forcedTransfer and setFrozenTokens as standard functions, acknowledging their importance for regulatory enforcement in the RWA space, distinct from standard transfers. Mandates access control for this sensitive function. To maintain a lean EIP, a single setFrozenTokens function (which overwrites the frozen asset quantity) and one Frozen event were favored over distinct freeze/unfreeze functions and events.As an example, an AMM pool or a lending protocol can integrate with ERC-7943 based ERC-20 tokens by calling canTransact or canTransfer to handle these assets in a compliant manner. Enforcement actions like forcedTransfer and setFrozenTokens can either be called by third party entities or be integrated by external protocols to allow for automated and programmable compliance. Users can then expand these tokens with additional features to fit the specific needs of individual asset types, either with on-chain identity systems, historical balances tracking for dividend distributions, semi-fungibility with token metadata, and other custom functionalities.
While this ERC provides the necessary primitives for regulated assets, any additional feature can be added through extensions. Few examples:
setFrozenTokens a valid legal proof must be provided and attached to the call, the contract can have a function that batches operations like:setFrozenTokens function overwrites the absolute frozen amount and given the fact that the standard allows for multiple privileged accounts, some race-conditions might happen. If that's the case, one can build an extension function that works with expected values of amounts frozen, like:Alternatively, another solution can be using delta amounts:
Note These helpers reduce accidental overwrites and expand in functionalities but do not prevent same-block conflicting updates or mempool ordering races by different privileged actors.
multicall patterns similar to the one defined in ERC-6357 so that a mix of the given primitives with additional features can be batched in one transaction:The naming conventions in this ERC were carefully chosen to establish clarity and semantic consistency within the broader RWA ecosystem while maintaining neutrality and broad applicability.
forcedTransfer: This term was selected for its neutrality. While names like confiscation, revocation, or recovery describe specific motivations, forcedTransfer purely denotes the direct action of transferring assets, irrespective of the underlying reason. forcedTransfer was preferred over forceTransfer to maintain backward compatibility with ERC-3643.canTransfer: This name was preferred over isTransferAllowed for consistency with established RWA standards including ERC-3643 and ERC-7518. This alignment promotes interoperability and reduces cognitive overhead when working across different RWA tokens.setFrozenTokens / getFrozenTokens: These names were chosen for managing transfer restrictions and align with ERC-3643 naming patterns. Frozen was also selected for its general applicability to both fungible (amount-based) and non-fungible (status-based) assets, as terms like amount or asset(s) might not be universally fitting.ERC7943InsufficientUnfrozenBalance: Discussions around insufficient being similar to unavailable arose, where unavailable might have better suggested a temporal condition like a freezing status. However, the term available/unavailable was also overlapping with frozen/unfrozen creating more confusion and duality. Finally, coupling insufficient with the specified unfrozen balance better represents the domain, prefix and subject of the error, according to ERC-6093 guidelines.This EIP defines a new interface standard and does not alter existing ones like ERC-20, ERC-721 and ERC-1155. Standard wallets and explorers can interact with the base token functionality of implementing contracts, subject to the rules enforced by that contract's implementation of canTransact, canTransfer and getFrozenTokens functions. Full support for the ERC-7943 functions requires explicit integration.
Reference implementations of uRWA for ERC-20, ERC-721 and ERC-1155 token implementations is provided in assets folder. They use the OpenZeppelin library and include an account whitelist and enumerable role-based access control. These examples are provided for educational purposes only and are not audited.
forcedTransfer and setFrozenTokens: The security of the mechanism chosen by the implementer to restrict access to these functions is paramount. Unauthorized access could lead to asset theft. Secure patterns (multisig, timelocks) are highly recommended.setFrozenTokens function: The setFrozenTokens function might be susceptible to front-running, similar to the approve function of the ERC-20. If the suggestion of allowing freezing more than what an account owns is not followed, a front-run might be an incentive to an account to avoid any attempt of freezing its balance. Additional features to gradually increment or decrement the frozen status CAN be considered for implementation.Copyright and related rights waived via CC0.