Tokenize Real-World Assets on Ethereum in 3 Hours

// Personal note: Learned this architecture after SEC Staff Accounting Bulletin 121
pragma solidity 0.8.20;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/AccessControl.sol";

contract RWAToken is ERC20, AccessControl {
    bytes32 public constant COMPLIANCE_ROLE = keccak256("COMPLIANCE_ROLE");
    bytes32 public constant ISSUER_ROLE = keccak256("ISSUER_ROLE");
    
    // KYC registry - stores approved addresses
    mapping(address => bool) public kycVerified;
    
    // Transfer restrictions by jurisdiction
    mapping(address => string) public investorJurisdiction;
    mapping(string => bool) public allowedJurisdictions;
    
    // Watch out: Must emit events for off-chain compliance monitoring
    event KYCStatusChanged(address indexed investor, bool status);
    event TransferRestricted(address indexed from, address indexed to, string reason);
    
    constructor(
        string memory name,
        string memory symbol,
        address complianceOfficer
    ) ERC20(name, symbol) {
        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _grantRole(COMPLIANCE_ROLE, complianceOfficer);
        _grantRole(ISSUER_ROLE, msg.sender);
        
        // Initialize with US-only for this example
        allowedJurisdictions["US"] = true;
    }
    
    function verifyKYC(address investor, string memory jurisdiction) 
        external 
        onlyRole(COMPLIANCE_ROLE) 
    {
        require(allowedJurisdictions[jurisdiction], "Jurisdiction not allowed");
        kycVerified[investor] = true;
        investorJurisdiction[investor] = jurisdiction;
        emit KYCStatusChanged(investor, true);
    }
    
    function _beforeTokenTransfer(
        address from,
        address to,
        uint256 amount
    ) internal virtual override {
        super._beforeTokenTransfer(from, to, amount);
        
        // Skip checks for minting
        if (from == address(0)) return;
        
        // Enforce KYC on both parties
        if (!kycVerified[to]) {
            emit TransferRestricted(from, to, "Recipient not KYC verified");
            revert("Recipient must be KYC verified");
        }
        
        if (!kycVerified[from]) {
            emit TransferRestricted(from, to, "Sender not KYC verified");
            revert("Sender must be KYC verified");
        }
    }
    
    function mint(address to, uint256 amount) external onlyRole(ISSUER_ROLE) {
        require(kycVerified[to], "Cannot mint to non-KYC address");
        _mint(to, amount);
    }
}

// Personal note: After working with 3 oracle providers, Chainlink had the best uptime for TradFi assets
pragma solidity 0.8.20;

import "@chainlink/contracts/src/v0.8/interfaces/AggregatorV3Interface.sol";

contract RWAPriceOracle {
    AggregatorV3Interface internal priceFeed;
    
    // Fallback price if oracle fails (set by governance)
    uint256 public fallbackPrice;
    uint256 public lastOracleUpdate;
    uint256 public constant STALENESS_THRESHOLD = 1 hours;
    
    event PriceUpdated(uint256 price, uint256 timestamp);
    event FallbackActivated(string reason);
    
    constructor(address _priceFeed) {
        priceFeed = AggregatorV3Interface(_priceFeed);
    }
    
    function getLatestPrice() public view returns (uint256) {
        try priceFeed.latestRoundData() returns (
            uint80 roundID,
            int256 price,
            uint256 startedAt,
            uint256 updatedAt,
            uint80 answeredInRound
        ) {
            require(price > 0, "Invalid price from oracle");
            require(updatedAt > block.timestamp - STALENESS_THRESHOLD, "Stale price");
            
            // Watch out: Chainlink prices have 8 decimals, normalize to 18
            return uint256(price) * 10**10;
        } catch {
            require(fallbackPrice > 0, "No fallback price set");
            return fallbackPrice;
        }
    }
    
    function getTokenValue(uint256 tokenAmount) external view returns (uint256) {
        uint256 price = getLatestPrice();
        // Assuming token has 18 decimals
        return (tokenAmount * price) / 10**18;
    }
}

// Personal note: This pattern came from 6 months of back-and-forth with DeFi protocols and lawyers
pragma solidity 0.8.20;

interface IERC20 {
    function transfer(address to, uint256 amount) external returns (bool);
    function transferFrom(address from, address to, uint256 amount) external returns (bool);
    function balanceOf(address account) external view returns (uint256);
}

contract RWADeFiGateway {
    address public immutable rwaToken;
    address public immutable complianceOfficer;
    
    // Whitelist of approved DeFi protocols
    mapping(address => bool) public approvedProtocols;
    
    // Track which addresses can interact with DeFi
    mapping(address => bool) public defiApproved;
    
    event ProtocolApproved(address indexed protocol, bool status);
    event DeFiInteraction(address indexed user, address indexed protocol, uint256 amount);
    
    constructor(address _rwaToken, address _complianceOfficer) {
        rwaToken = _rwaToken;
        complianceOfficer = _complianceOfficer;
    }
    
    modifier onlyCompliance() {
        require(msg.sender == complianceOfficer, "Not compliance officer");
        _;
    }
    
    function approveProtocol(address protocol, bool status) 
        external 
        onlyCompliance 
    {
        approvedProtocols[protocol] = status;
        emit ProtocolApproved(protocol, status);
    }
    
    function approveDeFiAccess(address user, bool status) 
        external 
        onlyCompliance 
    {
        defiApproved[user] = status;
    }
    
    // Watch out: This lets users deposit to approved protocols only
    function depositToProtocol(
        address protocol,
        uint256 amount,
        bytes calldata data
    ) external {
        require(approvedProtocols[protocol], "Protocol not approved");
        require(defiApproved[msg.sender], "User not DeFi approved");
        
        IERC20(rwaToken).transferFrom(msg.sender, address(this), amount);
        
        // Approve protocol to take tokens
        IERC20(rwaToken).transfer(protocol, amount);
        
        emit DeFiInteraction(msg.sender, protocol, amount);
    }
    
    function withdrawFromProtocol(
        address protocol,
        uint256 amount
    ) external {
        require(approvedProtocols[protocol], "Protocol not approved");
        require(defiApproved[msg.sender], "User not DeFi approved");
        
        // In real implementation, call protocol's withdraw function
        IERC20(rwaToken).transfer(msg.sender, amount);
        
        emit DeFiInteraction(msg.sender, protocol, amount);
    }
}

// hardhat.config.js additions
// Personal note: Etherscan verification is non-negotiable for institutional adoption
module.exports = {
  solidity: "0.8.20",
  networks: {
    sepolia: {
      url: process.env.SEPOLIA_RPC_URL,
      accounts: [process.env.DEPLOYER_PRIVATE_KEY],
    },
    mainnet: {
      url: process.env.MAINNET_RPC_URL,
      accounts: [process.env.DEPLOYER_PRIVATE_KEY],
    },
  },
  etherscan: {
    apiKey: process.env.ETHERSCAN_API_KEY,
  },
};

// scripts/deploy-rwa.js
const { ethers, run } = require("hardhat");

async function main() {
  console.log("Deploying RWA system...");
  
  // Deploy token
  const RWAToken = await ethers.getContractFactory("RWAToken");
  const token = await RWAToken.deploy(
    "US Treasury 2Y Token",
    "UST2Y",
    process.env.COMPLIANCE_OFFICER_ADDRESS
  );
  await token.deployed();
  console.log(`Token deployed to: ${token.address}`);
  
  // Deploy oracle
  const RWAPriceOracle = await ethers.getContractFactory("RWAPriceOracle");
  const oracle = await RWAPriceOracle.deploy(
    process.env.CHAINLINK_FEED_ADDRESS
  );
  await oracle.deployed();
  console.log(`Oracle deployed to: ${oracle.address}`);
  
  // Deploy gateway
  const RWADeFiGateway = await ethers.getContractFactory("RWADeFiGateway");
  const gateway = await RWADeFiGateway.deploy(
    token.address,
    process.env.COMPLIANCE_OFFICER_ADDRESS
  );
  await gateway.deployed();
  console.log(`Gateway deployed to: ${gateway.address}`);
  
  // Wait for Etherscan to index
  console.log("Waiting 60 seconds before verification...");
  await new Promise(resolve => setTimeout(resolve, 60000));
  
  // Verify contracts
  await run("verify:verify", {
    address: token.address,
    constructorArguments: [
      "US Treasury 2Y Token",
      "UST2Y",
      process.env.COMPLIANCE_OFFICER_ADDRESS
    ],
  });
  
  console.log("✓ All contracts deployed and verified");
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});