Institutional Infrastructure for Tokenized Real-World Assets

• What is RWA Tokens?
• Three Modules
• Market Context
• Architecture Overview — Nine Layers
• Cross-Layer Communication Protocol
• Layer 1: Solana Blockchain Foundation
• Layer 2: Security Enforcement — 42 Transfer Hook Controls
• Layer 3: Global Unified CEDEX Liquidity Pool
• Layer 4: Custom AMM Engine (CPMM)
• Layer 5: CEDEX — Compliant Exchange for Digital Securities
• Layer 6: Oracle Network
• Layer 7: Protocol Governance
• Layer 8: Wallet Infrastructure
• Layer 9: Predictive AI Module
• Module 2: Real Estate Tokens
• Module 3: CORECM Tokens
• Why Not Ethereum? Why Not L2?
• Why Not Raydium / Orca / Jupiter?
• Security Architecture
• Codebase Composition
• Repository Structure
• Tech Stack
• Regulatory Framework
• Performance Specifications
• Roadmap
• Getting Started
• Documentation
• References
• License

RWA Tokens is a purpose-built, nine-layer Solana Mainnet-Beta infrastructure platform that tokenizes real-world assets across three asset classes — global equities, commercial real estate, and mineral and hydrocarbon project interests — under a single SEC Category 1 Model B compliance backbone.

All three modules are production-ready and available for issuer onboarding today: Module 1: ST22 Digital Securities (global equities), Module 2: Real Estate Tokens (commercial real estate), and Module 3: CORECM Tokens (mineral, oil, and gas project interests). Module 1 reaches general availability for live trading on CEDEX at Q3 2026; Modules 2 and 3 onboard issuers under the same nine-layer framework on the same timeline.

Each tokenized instrument represents direct beneficial ownership in an underlying asset held in qualified custody by Empire Stock Transfer, an SEC §17A-registered transfer agent. Instruments operate within the Category 1 Model B architecture defined by SEC Release No. 33-11412 (March 17, 2026) and the January 28, 2026 Joint Staff Statement on Tokenized Securities from the Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets.

The core insight: compliance enforcement in traditional markets is expensive because it requires human intermediaries at every step. When compliance is embedded in the token transfer primitive itself — enforced mathematically at the moment of every transfer by immutable smart contract code — the marginal cost of compliance per transaction approaches zero. This cost structure makes institutional-grade securities compliance viable across asset classes that traditional finance cannot service economically.

Transfer initiated → Token-2022 program → Transfer Hook CPI →
  42 controls validated (<10ms) → ANY failure = atomic revert (Error 6xxx) →
  ALL pass = transfer executes + immutable audit trail written on-chain

Operated by Groovy Company, Inc. (OTC: GROO, CIK 1499275, Wyoming domiciled). Headquartered in Atlanta, Georgia. Wyoming law governs all RWA Tokens documents.

All three modules share the same nine-layer architecture, the same Empire Stock Transfer custody framework, the same 42 Transfer Hook compliance controls, and the same CEDEX trading venue. Module-specific differences are isolated to the underlying instrument, the custody artifact, and the oracle feed driving price discovery.

Equities scope note. Module 1 production deployment onboards OTC microcap issuers under the Empire Stock Transfer custody arrangement at general availability in Q3 2026. Expansion to NASDAQ, NYSE, AMEX, TSX, LSE, and other listing venues is sequenced through 2026–2028 and is gated on transfer agent onboarding for each issuer's existing transfer agent of record. The protocol architecture is venue-agnostic; production rollout is sequenced by the regulatory and operational onboarding cadence per venue.

The institutional infrastructure for tokenized real-world assets converged on a viable architecture across four market events in the twelve months preceding RWA Tokens' launch:

Combined U.S. addressable market across the three modules: equities (global listed and OTC), commercial real estate ($11T U.S. CRE), and global mineral and hydrocarbon reserves ($4T) — totaling $15T+ institutional addressable market.

┌──────────────────────────────────────────────────────────────────────────────┐
│                     RWA TOKENS — NINE-LAYER STACK                           │
├──────┬──────────────────────────┬────────────────────────────────────────────┤
│  L9  │ Predictive AI Module     │ EDGAR NLP · IDOS scoring · XGBoost ML     │
│  L8  │ Wallet Infrastructure    │ iOS/Android native · Ledger/Trezor HW     │
│  L7  │ Protocol Governance      │ Multi-sig · 48h timelock · on-chain vote  │
│  L6  │ Oracle Network           │ Empire Ed25519 · OFAC · AML · TWAP · EDGAR│
│  L5  │ CEDEX Exchange           │ cedex.market · Web2 matching + Web3 settle│
│  L4  │ Custom AMM Engine        │ CPMM (x × y = k) · u128 overflow-safe    │
│  L3  │ Global Unified Liquidity │ Protocol-owned · LP burned · permanent    │
│  L2  │ Security Enforcement     │ 42 Transfer Hook controls · atomic · CPI  │
│  L1  │ Solana Foundation        │ PoH + Tower BFT · 65K TPS · ~400ms blocks │
└──────┴──────────────────────────┴────────────────────────────────────────────┘

Design philosophy: Strict separation of concerns. Each layer handles a distinct responsibility and communicates with adjacent layers through well-defined interfaces. Securities compliance enforcement occurs at Layer 2, the lowest programmable layer, ensuring no higher-layer component can bypass, override, or selectively apply the 42 Transfer Hook security controls. A change to Layer 4 (AMM) cannot affect Layer 2 (Security Enforcement) — compliance is structurally isolated from trading mechanics.

No layer is repurposed from general DeFi infrastructure. Each was purpose-built for tokenized real-world assets.

Inter-layer communication follows strict directional protocols ensuring data integrity and separation of responsibilities:

                    ┌─────────────────────┐
                    │  Layer 9: AI Module  │
                    │  Layer 8: Wallet     │
                    │  Layer 5: CEDEX      │
                    └─────────┬───────────┘
                              │ ▼ Downward (Request Flow)
                    ┌─────────┴───────────┐
                    │  Layer 2: Security   │◄──── Layer 6: Oracle Feeds
                    │  Enforcement         │      (Empire, OFAC, AML, TWAP)
                    └─────────┬───────────┘
                              │ ▼ Settlement
                    ┌─────────┴───────────┐
                    │  Layer 1: Solana     │
                    └─────────┬───────────┘
                              │ ▲ Upward (Response Flow)
                              │   Confirmations propagate back through
                              │   L2 → L6 → L5/L8 with audit trail
                              │   written at each layer transition

• Downward (Request Flow): Actions at L9/L8/L5 flow downward through L2 for Transfer Hook verification, drawing oracle data from L6, before settling on L1. No higher-layer action reaches L1 without passing through L2 compliance.
• Upward (Response Flow): Settlement confirmations propagate from L1 through L2 compliance acknowledgement, L6 oracle confirmation, into user-facing interfaces at L5/L8. Full on-chain audit trail at each transition.
• Oracle Feeds (L6 → L2): Empire custody data, OFAC/SDN updates, AML risk scores, TWAP price feeds flow directly from L6 to L2. This is the only external data channel influencing compliance decisions — it does not pass through the application layer. Manipulating oracle inputs requires compromising Empire Stock Transfer's custody system directly, not RWA Tokens' software.
• Governance Writes (L7 → L2/L3/L4): Passed proposals write to parameter configurations via 48-hour timelock. This is the only cross-layer write path not triggered by a token transfer. Governance cannot write to immutable Transfer Hook logic — only adjustable parameters within hard-coded bounds.
• Horizontal: Components within each layer communicate via internal APIs. No horizontal communication crosses layer boundaries.

Selected for a single decisive criterion: SPL Token-2022 Transfer Hook support. No other production blockchain provides native, atomic compliance enforcement at the token transfer primitive. Performance advantages reinforce the selection but are secondary to the compliance architecture capability.

The most critical innovation. The only layer that cannot be disabled, upgraded, or worked around by any participant — including Groovy Company, Inc. itself. Every ST22 token transfer must pass all 42 controls. No admin override. No whitelist bypass.

User initiates transfer (wallet, DEX, or programmatic call)
  → Token-2022 program receives transfer instruction
  → Token-2022 invokes Transfer Hook via CPI (Cross-Program Invocation)
  → Transfer Hook validates against all 42 security controls (<10ms)
  → ANY control fails → Transaction REJECTED (atomic rollback, Error 6xxx)
  → ALL controls pass → Transfer executes + immutable audit trail written

Critical Property: The Transfer Hook cannot be removed after mint creation. Once an ST22 token is minted with the protocol's Transfer Hook, every transfer for its entire existence is validated against all 42 controls. This is an SPL Token-2022 standard property — the hook program address is permanently stored in the mint account.

use anchor_lang::prelude::*;

#[program]
pub mod rwa_tokens_transfer_hook {
    use super::*;

    pub fn transfer_hook(ctx: Context<TransferHook>, amount: u64) -> Result<()> {
        let config = &ctx.accounts.config;

        // ── SEQUENTIAL: Custody + Identity (must pass before any trade logic) ──

        // Controls 1-6: Empire Stock Transfer custody verification (Ed25519 signed)
        verify_custody_backing(&ctx.accounts.custody_oracle, amount)?;    // Error 6001
        verify_1to1_ratio(&ctx.accounts.mint_supply, &ctx.accounts.custody_oracle)?;
        verify_empire_status(&ctx.accounts.empire_status_oracle)?;
        verify_custody_signature(&ctx.accounts.custody_oracle)?;          // Ed25519
        verify_mint_authority_locked(&ctx.accounts.mint)?;
        verify_backup_custody_oracle(&ctx.accounts.backup_oracle)?;

        // Controls 7-14: Investor eligibility (Empire-verified)
        check_kyc_status(&ctx.accounts.sender, config)?;                  // Error 6002
        check_kyc_status(&ctx.accounts.receiver, config)?;
        check_kyb_entity(&ctx.accounts.receiver, config)?;
        check_accreditation(&ctx.accounts.receiver, config)?;             // Error 6003

        // Controls 8-10: OFAC sanctions screening (three-layer)
        check_ofac_sender(&ctx.accounts.sender, config)?;                 // Exact match
        check_ofac_receiver(&ctx.accounts.receiver, config)?;             // Fuzzy entity
        check_ofac_oracle_freshness(&ctx.accounts.ofac_oracle)?;          // 2-hop cluster

        // Control 11: AML risk scoring
        check_aml_risk(ctx.accounts.aml_oracle.sender_score)?;
        // Disposition: 0-30 approve | 31-70 enhanced review | 71-100 reject

        // Control 24: Holding period enforcement
        enforce_holding_period(&ctx.accounts.holding_period_account)?;    // Error 6024
        // Rule 144: 6 months (US / Reg D) | Reg S: 12 months (non-US)

        // ── PARALLEL: Market integrity controls ─────────────────────────────

        check_wallet_limit(amount, config)?;          // Controls 15-19: 4.99% max
        check_price_impact(amount, config)?;          // Control 25: 2% max vs TWAP
        check_volume_halt(amount, config)?;           // Control 27: 30% daily/wallet
        check_circuit_breaker(config)?;               // Control 28: >10% in 5 min
        validate_cei_pattern(&ctx.accounts)?;         // Controls 29-35: reentrancy
        enforce_arithmetic_safety(amount)?;           // Controls 16-19: u128 overflow

        // ── PROTECTIVE + GOVERNANCE: Controls 35-42 ─────────────────────────

        check_protective_conversion_triggers(&ctx)?;  // Controls 35-38
        write_compliance_audit_trail(&ctx)?;           // Controls 39-41
        check_regulatory_freeze(&ctx.accounts.freeze_authority)?; // Control 42

        // ── EMIT: Immutable on-chain compliance record ──────────────────────

        emit!(TransferValidated {
            mint:      ctx.accounts.mint.key(),
            from:      ctx.accounts.source.key(),
            to:        ctx.accounts.destination.key(),
            amount,
            timestamp: Clock::get()?.unix_timestamp,
            all_controls_passed: true,
        });

        Ok(())
    }
}

Transfer Hook upgrade authority: 5-of-9 multi-sig with geographically distributed key holders. All upgrades require 24-hour timelock (cancellable via governance). Upgrades cannot remove the 42 controls — any upgrade weakening protections requires 66.67% governance supermajority + account schema compatibility attestation.

The defining infrastructure innovation. Every issuer that onboards inherits an immediately functional secondary market — no per-issuer liquidity sourcing, no bonding curve bootstrapping, no dependency on external market makers.

Why this matters: Traditional per-issuer pools fail at scale because each token requires dedicated capital and thin markets can never justify the depth. A shared pool means issuer #500 gets the same liquidity depth as issuer #1. The pool only grows, across every issuer and every trade, permanently. Real Estate Tokens (Module 2) and CORECM Tokens (Module 3) draw against the same Global Unified Pool when activated.

Every major Solana DEX — Raydium, Orca, Jupiter, Meteora — was built before SPL Token-2022 Transfer Hooks existed. Their swap programs call the original SPL Token Program directly, bypassing Transfer Hooks at trade execution. This is a fundamental architectural incompatibility. A custom AMM is the only path to compliant secondary trading.

Implements x × y = k against the Global Unified CEDEX Liquidity Pool:

x = USDC reserve     y = ST22 token reserve     k = constant product invariant
fee = 5% (500 bps) applied BEFORE invariant calculation — k grows with every trade

Example: Buy ST22 with 10 USDC from pool with 100 USDC / 1,000,000 tokens (k = 100M)

  10 USDC input → 5% fee → 9.5 USDC effective
  new_x = 109.5 USDC
  new_y = 100,000,000 / 109.5 = 913,242 tokens
  tokens_out = 1,000,000 - 913,242 = 86,758
  k_after = 109.5 × 913,242 ≥ 100,000,000 ✓

Max u64 = 2⁶⁴ − 1 ≈ 18.4 × 10¹⁸. Multiplying two max u64 reserves requires 128 bits. All intermediate calculations use u128 with checked arithmetic — no unchecked operations in the swap path:

pub fn calculate_output_amount(
    input_amount: u64, input_reserve: u64,
    output_reserve: u64, fee_bps: u16,       // 500 = 5%
) -> Result<SwapResult> {
    let fee_multiplier = (10_000 - fee_bps as u64) as u128;
    let input_with_fee = (input_amount as u128)
        .checked_mul(fee_multiplier).ok_or(SwapError::Overflow)?;

    let numerator = input_with_fee
        .checked_mul(output_reserve as u128).ok_or(SwapError::Overflow)?;
    let denominator = (input_reserve as u128)
        .checked_mul(10_000).ok_or(SwapError::Overflow)?
        .checked_add(input_with_fee).ok_or(SwapError::Overflow)?;

    // Round DOWN — always favor the pool (prevents rounding attacks)
    let output_amount = numerator
        .checked_div(denominator).ok_or(SwapError::ZeroDivision)? as u64;

    Ok(SwapResult { output_amount, fee_collected: /* ... */ })
}

cedex.market — the only trading venue where SPL Token-2022 Transfer Hook compliance is preserved on every trade.

Atomicity: If compliance passes but execution fails (slippage, deadline, insufficient balance), the entire transaction reverts. No partial state changes. No fee collected without a trade executing.

pub const MAX_PRICE_IMPACT_BPS: u16 = 200; // 2% maximum per transaction

pub fn check_price_impact(trade: &SwapParams, twap: u64, price: u64) -> Result<()> {
    let deviation_bps = ((price as i64 - twap as i64).abs() as u64)
        .checked_mul(10_000).ok_or(CedexError::Overflow)? / twap;
    require!(deviation_bps <= MAX_PRICE_IMPACT_BPS as u64,
        CedexError::PriceImpactExceeded); // Error 6006
    Ok(())
}

Jito Block Engine private transaction submission — transactions not visible in public mempool, eliminating frontrunning and sandwich attack vectors. Transfer Hook price impact controls (2% max) + TWAP deviation checks further eliminate MEV extraction economics.

Real-time data backbone feeding every Transfer Hook compliance decision. L6 feeds L2 directly — oracle data drives compliance without passing through the application stack. An oracle failure is a compliance failure.

Custody is the only hard fail-safe (reject all transfers). All others degrade gracefully on cached data. A stale AML score creates manageable risk. A custody discrepancy threatens the foundational 1:1 backing guarantee.

Empire → Ed25519 attestation → every ~400ms
  ├─ supply == custodied_shares → Control 1 passes
  └─ ANY discrepancy (≥1 token) → Error 6001 → ALL transfers halt
       → Circuit breaker on affected mint
       → P0 dual notification: protocol + Empire (15-min SLA)
       → Resumes only after 2-of-3 oracle consensus

Pre-rebrand validation record: Zero custody discrepancy events across 3 beta issuers, $7M+ processed liquidity (under predecessor brand OTCM Protocol; dba cancelled May 1, 2026).

On-chain proposal/voting for adjustable parameters. 42 Transfer Hook controls are immutable — governance cannot weaken investor protections. Activation target: 2028.

What governance cannot do: Remove/weaken any of the 42 controls. Withdraw from Global Pool. Override Control 24 holding periods. Bypass custody oracle.

Even raw Solana transactions bypassing the wallet app still trigger all 42 Transfer Hook controls.

Commercial intelligence engine. Proprietary AI monitors SEC EDGAR + OTC Markets data, generating daily-refreshed IDOS (Issuer Distress and Opportunity Score) ratings for the equities universe. Module 2 and Module 3 extensions for real estate and CORECM-specific intelligence are scheduled with their respective module launches.

Data sources: SEC EDGAR (public), OTC Markets Group (public), Solana on-chain (public). No PII/PCI/PHI. Reg D, CAN-SPAM, GDPR Article 6(1)(f) compliant.

Fractional ownership of income-producing commercial real estate, tokenized on the same nine-layer architecture as Module 1.

Module 2 is production-ready against the existing nine-layer foundation and open for issuer onboarding. Pilot deal scoped: $950K net equity in an income-producing commercial property. Property appraisal oracle is the principal Module 2-specific addition to Layer 6. Empire Stock Transfer custody framework extends to Common B equity of the property-holding Nevada corporation — no new custody arrangement is required.

Tokenized royalty and project-equity instruments for mineral, oil, and gas operators on the same nine-layer architecture.

Module 3 is production-ready against the existing nine-layer foundation and open for operator onboarding. The principal Module 3-specific additions are the reserve-attestation oracle (Layer 6), the JOA-aware distribution waterfall in Layer 4, and the on-chain reserve record anchoring as a Layer 2 custody-equivalent. Operator onboarding pathways are scoped against U.S.-domiciled mineral, oil, and gas operators with international expansion sequenced thereafter.

Architectural lock-in, not contractual. External DEX swap programs call the original Token Program, bypassing all compliance controls. The token ceases to be a compliant Digital Security at first external-DEX trade.

1. No unauthorized minting without custody oracle confirmation
2. Circulating supply ≤ Empire-custodied Common B at all times
3. No fund extraction from Global Pool (LP burned, no withdrawal fn)
4. Transfer Hook always executes on every transfer (Token-2022 property)
5. 5% fee accuracy within 1 wei tolerance
6. Circuit breaker triggers if and only if threshold conditions met

~560,000 lines of original source code:

rwa-tokens/
├── programs/
│   ├── transfer-hook/              # Layer 2 — 42 controls (Rust/Anchor)
│   │   ├── src/
│   │   │   ├── lib.rs              # Entry point
│   │   │   ├── controls/
│   │   │   │   ├── custody.rs             # Controls 1-6
│   │   │   │   ├── investor.rs            # Controls 7-14
│   │   │   │   ├── position.rs            # Controls 15-19
│   │   │   │   ├── circuit_breaker.rs     # Controls 20-23
│   │   │   │   ├── holding_period.rs      # Controls 24-29
│   │   │   │   ├── sanctions.rs           # Controls 30-34
│   │   │   │   ├── protective.rs          # Controls 35-38
│   │   │   │   └── governance.rs          # Controls 39-42
│   │   │   ├── state/              # On-chain account structures
│   │   │   └── errors.rs           # Error codes 6001-6042
│   │   └── tests/
│   ├── amm/                        # Layer 4 — CPMM engine
│   ├── liquidity-pool/             # Layer 3 — Global Pool
│   └── governance/                 # Layer 7 — Multi-sig + timelock
├── cedex/                          # Layer 5
│   ├── engine/                     # Order matching + execution
│   ├── api/                        # REST/WebSocket
│   ├── settlement/                 # Solana settlement
│   └── mev-protection/             # Jito integration
├── oracle-network/                 # Layer 6
│   ├── custody/                    # Empire Ed25519 attestation
│   ├── compliance/                 # OFAC + AML
│   ├── price/                      # Pyth TWAP
│   └── edgar/                      # SEC EDGAR pipeline
├── wallet/                         # Layer 8
├── ai-module/                      # Layer 9
│   ├── idos/                       # XGBoost scoring
│   ├── edgar-nlp/                  # Filing NLP
│   ├── investor-profiling/         # Wallet behavioral
│   └── ltoe/                       # Launch timing
├── modules/                        # Module 2 (Real Estate) + Module 3 (CORECM)
│   ├── real-estate/                # Module 2 — Real Estate Tokens
│   └── corecm/                     # Module 3 — CORECM Tokens
├── sdk/                            # TypeScript SDK
├── docs/                           # Whitepaper + specs
├── audits/                         # Certora + audit reports
└── infrastructure/                 # K8s, Flux, monitoring

Rust 1.75+  ·  Solana CLI 1.18+  ·  Anchor 0.30+  ·  Node.js 20 LTS  ·  Yarn 1.22+

git clone https://github.com/groovy-company/rwa-tokens.git
cd rwa-tokens && yarn install

anchor build                    # Build all Solana programs
anchor test                     # Full test suite (localnet)

# Fuzz testing (Transfer Hook)
cd programs/transfer-hook && cargo fuzz run transfer_hook_fuzz

solana config set --url devnet
anchor deploy --provider.cluster devnet --program-name transfer_hook
anchor deploy --provider.cluster devnet --program-name amm
anchor deploy --provider.cluster devnet --program-name liquidity_pool

# Initialize mint with Transfer Hook (IRREVERSIBLE — hook cannot be removed)
ts-node sdk/scripts/init-mint.ts --network devnet

# Verify hook attachment
ts-node sdk/scripts/verify-hook.ts --network devnet --mint <MINT_ADDRESS>

import { RwaTokensClient } from '@rwa-tokens/sdk';

const client = new RwaTokensClient({ network: 'devnet' });

const hook = await client.verifyTransferHook(mintAddress);
// hook.controlsActive === 42
// hook.bypassPossible === false

const custody = await client.getCustodyAttestation(mintAddress);
// custody.ratio === 1.0 (exact 1:1 required)
// custody.ed25519Verified === true

• SEC Release No. 33-11412 (March 17, 2026) — Category 1 Model B Digital Securities
• SEC Joint Staff Statement on Tokenized Securities (January 28, 2026)
• SEC Staff Statement on Covered User Interface Providers (April 13, 2026)
• 17 CFR §§230.501–506 (Reg D) · §§230.901–905 (Reg S) · §230.144 (Rule 144)
• 17 CFR §§240.17Ad-2–17Ad-13 (Transfer Agent Rules)

• 31 U.S.C. §5311 et seq. (BSA) · 31 CFR Part 1010 · 31 CFR §§500–598 (OFAC)
• FATF Virtual Asset Guidance (2021)

• Solana Architecture · SPL Token-2022 · Transfer Hook Extension
• Anchor Framework · Wormhole NTT · ERC-3643 · Firedancer

• Chainalysis KYT · TRM Labs · Pyth Network
• Jito Block Engine · Helius RPC · Certora Prover

• Wyoming Business Corporation Act (W.S. 17-16-101 et seq.)
• Wyoming Digital Asset Statute (W.S. 34-29-101 et seq.)
• UCC Article 8, §8-102(a)(8)

Business Source License 1.1 — See LICENSE.

Core Transfer Hook security controls and compliance logic are source-available for audit and verification. Commercial deployment requires licensing agreement.

RWA Tokens — Institutional infrastructure for tokenized real-world assets.
Operated by Groovy Company, Inc. (OTC: GROO) · Wyoming domiciled · Atlanta, Georgia
rwatokens.net · cedex.market