How to analyze any RWA in 30 minutes

Before you start: pin the number down (minutes 0 to 3)

Every analysis starts with a number someone else quoted, and most numbers in this market are ambiguous. A figure means nothing until four things are attached to it: which size of the market it counts, which date it was read, which source it came from, and which unit it uses.

The size question is the most common trap. RWA.xyz splits the market into distributed assets, which investors can hold and move themselves, and represented assets, which only use a chain as a record. On 10 September 2026 the first was about 39 bn USD and the second about 387 bn USD. A headline about a 400 bn USD tokenization market is mostly a closed bank network, not something anyone can buy.

The source question comes next. Sources form a ladder, and each step down knows less about what its own number means.

The offering document is the legal text that sells the product: prospectus, private placement memorandum or terms of issue. It binds the issuer. Below it come regulator filings, then the issuer's announcements, then dashboards, then sites that repeat dashboards. Even the dashboard level is not self-consistent: on 3 September 2026, RWA.xyz showed 68,647 more total holders on one page than on another.

Step 1: read the offering document (minutes 3 to 13)

Ten minutes with the offering document answers five questions, in this order. The first answer decides how much the others matter.

1. Who can buy and how you get out. BUIDL is sold only to qualified purchasers, with a 5 mn USD minimum, under Rule 506(c) and Section 3(c)(7). Redemptions settle same day or next day. Tokens can move only between wallets on the issuer's whitelist.
2. How the issuer can change the terms or end the product. This is the clause that decided the largest wind-down so far (see the warning below). Find it and note the notice period, or write "not disclosed".
3. What you legally own. A BUIDL holder owns shares of a fund in the British Virgin Islands, not Treasury bills. The ownership record is the transfer agent's register: an analysis of the offering memorandum by Steakhouse Financial (April 2024) found that the register wins if it disagrees with the chain. Do not assume the same rule for every fund: BlackRock's OnChain Shares, filed on 8 May 2026, make the on-chain record plus an off-chain identity file the official register, so step 3 means reading each fund's own documents.
4. Who does what. BlackRock manages the fund, BNY Mellon is custodian and administrator, PwC audits it, and Securitize is transfer agent and placement agent.
5. What it costs. The main share class charges 50 bps a year; on Aptos, Avalanche and Polygon it is 20 bps, because those chains' foundations agreed in November 2024 to pay BlackRock a quarterly fee (CoinDesk).

BUIDL scores well on this step because its roles are named. Many products do not. Count the answers you had to mark "not disclosed". More than four means the product cannot be measured, however good its marketing.

Step 2: read the contract, upgrade power first (minutes 13 to 20)

A regulated token carries powers that a plain crypto token does not: freezing a wallet, moving tokens out of it, pausing all transfers. The law requires some of them. The question is who holds them and whether they have ever been used.

Read in a fixed order, because the first answer can cancel all the others.

First, who can replace the code. If one key can swap the contract's logic, every other answer is temporary. Second, list the functions that can move someone else's balance, such as seize or forcedTransfer. Third, find who holds those roles today. Fourth, check the event history for whether they were ever used.

The author ran this on BUIDL's Ethereum contract on 4 September 2026. A single externally owned account, meaning one private key rather than a multisig, owns the proxy and can replace the whole implementation in one transaction, with no timelock. The seize function requires the transfer-agent role. From March 2024 to that date, the contract emitted zero Seize events and more than 1,000 Issue events.

One more check changes the picture. On 4 and 5 September 2026, Ethereum held only about 11% of BUIDL's supply across the four chains read, with Solana the largest. An Ethereum-only reading describes a minority of the product, and "not evaluated" is the honest answer for the other chains. Ondo's OUSG is the useful contrast: it has no seize function at all, and its admin roles sit on multisigs with thresholds such as 4 of 7.

Deep dive Doing the contract read yourself

Look up the token address on a block explorer. If it is a proxy, read the implementation address from the standard EIP-1967 storage slot, then read the proxy's admin or owner. If the owner is a Safe multisig, call getThreshold() and getOwners() to get "X of Y". List every function that is not view or pure, and mark the ones that touch other people's balances. For roles based on OpenZeppelin's AccessControl, scan RoleGranted and RoleRevoked events from deployment and confirm with hasRole(). Finally, count Seize, Pause and Burn events. Public nodes limit how many blocks one log query can cover, so a long history may need thousands of requests. Record that limit rather than writing "zero".

Step 3: check the price feed and the reserves (minutes 20 to 24)

A tokenized fund's price is its net asset value (NAV), computed off-chain by the administrator and carried on-chain by an oracle. A lending market that accepts the token trusts that feed. For BUIDL, RedStone publishes a daily NAV feed for Securitize with a 24-hour heartbeat, and Chronicle provides a separate proof that the assets exist.

Freshness takes one call. Ask the feed's contract for latestRoundData() and read updatedAt, the time of the last update. An old feed does not raise an error; it returns the last value with its true, old timestamp. When the author read eight NAV feeds on 4 September 2026, one of them, for Superstate's USCC, was 225 days old, and one for Apollo's ACRED had never been written at all.

Then check what backs the reserves. Attestation is an accountant's check of one narrow claim at one moment, usually that tokens are covered by assets. Audit means an examination of a full period of accounts. BUIDL has an annual fund audit by PwC. Many products offer only monthly attestations, which is weaker and should be noted.

Step 4: test whether anyone uses it (minutes 24 to 28)

Three quick ratios show whether the product is a market or a register. They come from What works, what doesn't.

Turnover is yearly transfer volume divided by the asset's value. It overstates real trading, because on-chain volume also counts tokens created and redeemed. On Securitize, the platform that issues BUIDL, turnover was about 1.4× a year in August 2026. Tokenized gold, by comparison, ran at about 71×.

The active-address ratio compares wallets that did something in 30 days with wallets that hold. On Securitize, 61 of 1,872 holders were active in a month, about 3%. Below 5% means the product is held, not used.

DeFi use asks whether other protocols accept the token. BUIDL does better here than most: Sky's Spark allocated 500 mn USD to it in 2025, half of its first 1 bn USD tokenized Treasury allocation, and Securitize funds serve as collateral on Aave Horizon. RWAs in DeFi has the full numbers.

Step 5: red flags and the verdict (minutes 28 to 30)

The last two minutes go to a scorecard. Thirteen questions cover everything above, each with a place to look and a time budget.

Some findings should stop the analysis on their own:

• No named transfer agent or custodian. You cannot tell who owns what in a failure.
• One private key can replace the code. Every other protection is temporary.
• A stale or never-written price feed behind a lending market.
• A fee waiver with no firm end date. The yield you see is not the yield you will get.
• Redemption limited to a small share per quarter for a token sold as liquid.
• More than four "not disclosed" answers. The product cannot be measured.

The BUIDL verdict, as of September 2026: a well-documented fund with named, regulated parties and a real institutional client base, sold as a register rather than a market. Its main weakness is key management: one key controls the code on Ethereum, and most of the supply sits on chains that were not fully read.

What to watch next

• Your own product's documents: whether the issuer publishes the offering document at all. More products now link it from their websites, and the ones that do not are telling you something.
• Multichain supply: which chains hold most of a product's tokens. The largest share is where the permission read matters most.
• Oracle heartbeats: whether lending markets that accept RWA collateral start checking feed age on-chain, which would reduce the risk from stale NAV.
• RWA.xyz definitions: changes to how the dashboard counts holders and assets. A category can jump or fall overnight when a definition changes.
• The DTC tokenization service: if it launches in October 2026, a new kind of product will need the same teardown, with a US depository as the register.