How tokenized U.S. Treasuries, BlackRock, Ethereum, and institutional capital are turning Real-World Assets (RWAs) into the fastest-growing segment of digital finance.
The Real-World Assets (RWA) market has become the fastest-growing sector of digital finance. While much of the cryptocurrency market struggled through 2025 and early 2026, tokenized U.S. Treasuries, credit markets, commodities, and equities continued attracting billions of dollars from institutional investors. The question is no longer whether tokenization will reshape global finance — but how quickly it will happen.
Disclaimer: This content is for educational and informational purposes only and does not constitute financial, investment, or professional advice. We do not recommend any buying, selling, or holding of digital assets.
All views are the author’s own. Digital assets involve high risk and volatility, and readers should conduct their own research before making any decisions.
This report is not sponsored by any mentioned companies.
Business Model Analysis
The project operates in the RWA (Real World Assets) sector, focusing on the tokenization of real-world assets and the infrastructure for private credit and on-chain financing of real-world assets.
Value proposition: Centrifuge provides infrastructure that enables companies, credit funds, and institutions to tokenize real-world assets and raise capital through blockchain-based lending markets.
Moat (competitive advantage): The key strength lies in its infrastructure-first positioning in private credit tokenization, long-standing presence in DeFi, and deep integration with institutional partners and lending protocols. This creates high barriers to entry and makes Centrifuge less dependent on retail demand cycles.
Business rating: 8.8/10.
Financial Metrics
The project’s financial condition demonstrates strong scaling in core metrics:
TVL growth: Increased by more than 2.5x year-over-year, indicating expanding adoption of tokenized credit assets.
Revenue growth: Increased nearly 4x, which is a key indicator of real economic activity and protocol sustainability.
User and transaction activity: Declined, but this is not critical due to the B2B infrastructure nature of the protocol, where value is driven by capital volume rather than user count.
Financial rating: 8.6/10
Tokenomics
This is the most controversial aspect of the project.
Issue: The CFG token has weak connection to the protocol’s economic performance. There is no buyback or revenue-sharing mechanism, meaning protocol revenue does not directly translate into token value.
Distribution: Approximately 50% of the total supply is still not in circulation, creating ongoing unlock pressure. Inflation is relatively low (~3%), which partially offsets dilution risk.
Tokenomics rating: 6.4/10
Valuation
The current market valuation of Centrifuge appears moderate relative to the scale of its business and the assets flowing through its ecosystem. Market capitalization is significantly lower than TVL, which may indicate a relatively conservative market pricing compared to other competitors in the RWA sector.
However, the key question is not whether the token looks cheap today, but whether it is capable of capturing future economic growth of the underlying business. Due to the lack of a clear value capture mechanism, estimating the intrinsic value of CFG remains difficult. As a result, even a potentially undervalued asset can stay undervalued for a prolonged period without a strong fundamental catalyst.
If the protocol continues to grow revenues and the token gains a stronger economic role within the ecosystem, the current valuation could become attractive. For now, however, the market is appropriately applying a discount due to uncertainty in tokenomics.
Valuation Score: 7.8/10
Final Review
What is positive (✅):
Real business with a proven operating model.
One of the pioneers in private credit and RWA tokenization.
Strong growth in TVL, treasury, and revenue.
Strong institutional partnerships.
Large long-term potential of the asset tokenization market.
Main concerns (🔴):
Absence of revenue-sharing or buyback mechanisms.
Weak link between business success and token value.
Difficulty in determining CFG intrinsic value.
Increasing competition in the RWA sector.
Dependence on broader adoption of real-world asset tokenization.
Answers to key questions:
Would I own the business outright?
Yes. The business solves a real problem, operates in a large market, and has a proven infrastructure model with high entry barriers.
Would I buy the token under current economics?
Rather no. The token is not sufficiently involved in capturing the business’s economic value, so the investment case is more expectation-driven than fundamentally anchored.
What would need to change for an A+ rating?
Implementation of value-capture mechanisms (such as buybacks or revenue sharing), continued sustainable revenue growth, increased share of institutional clients, and completion of major token unlock phases.
Canton solves counterparty privacy by abolishing the global view and quietly breaks how banks operate, audit, and substantiate their books. A three-layer open-source stack for the institutions inheriting that trade-off.
Billions of dollars of tokenized repo, collateral, and fund flows are migrating to the Canton Network precisely because of one design decision: there is no global state. Each validator holds contract data only for its hosted parties. A bank’s competitors cannot see its positions ; the confidentiality property public chains could never deliver to regulated finance.
Here is what receives far less attention: that same design decision means the bank cannot see everything about itself either, and neither can its auditor.
On a transparent chain, every node is an unbounded observer ; global state is re-derivable by anyone, which is why public-chain audit tooling works at all. Canton deliberately breaks this. Every institution on the network becomes a bounded observer: it sees only the contracts disclosed to its parties. Objective ledger reality does not exist by default; it emerges from the overlap of many partial views.
That is not a bug to be patched. It is the product. But it creates three distinct institutional problems that arrive at three different desks : treasury, risk, and audit and the tooling ecosystem has largely ignored all three. Over the past months I built an open-source reference stack, one repository per problem, all operationalizing the Synchronization Debt framework I published earlier this year. This article walks through the problem, why existing tooling cannot solve it, and how the three layers fit together.
1. The Problem: Privacy Is a Protocol Property, and It Cuts Inward
When a global bank deploys Canton, it solves external fragmentation ; no counterparty sees what it shouldn’t ; but imports three internal consequences:
The operating consequence. Canton’s need-to-know model doesn’t stop at the firm’s perimeter. An FX desk operating as one PartyID may see wholesale stablecoin inventory update immediately while the repo desk, operating as a second PartyID, is still materializing collateral events from the sequencer. The balance sheet is economically unified; the operational view is asymmetric. One desk sees liquidity as available, another sees the same liquidity as pending and treasury quietly reinstates the manual buffers DLT was supposed to eliminate.
The epistemic consequence. BCBS 239 and ordinary substantiation work require an institution to identify which reported figures it can support independently. On a partitioned ledger, that boundary is structural, not procedural. Some figures are re-derivable from the party’s own Active Contract Set. Some depend on counterparty-asserted values. Some reference records the party cannot see at all. Most institutions on Canton today cannot tell you which of their reported numbers falls into which bucket.
The audit consequence. On a transparent chain, an external auditor queries a public node and independently re-derives client balances: repeatable, cheap, defensible. On Canton there is no public node to confirm against, and a bounded party cannot prove portfolio completeness from its own partition. The fallback is exactly what DLT promised to retire: manual extracts, screenshots, and confirmation letters.
Three consequences, one root cause: the institution is a bounded observer of a ledger designed not to be seen.
2. The Current Solutions
The existing response set, across vendors and internal teams, looks like this:
Explorers and analytics platforms (CantonScan, Coin Metrics, The Tie) describe visible network activity. They answer “what happened” within the data available to them.
Manual treasury buffers. Group treasury absorbs partition divergence by holding excess liquidity and applying discretionary haircuts : the pre-DLT operating model reimposed on a DLT.
Manual audit preparation. Operations teams assemble per-position extracts, and auditors fall back on ISA 505-style confirmation letters for anything the client’s view cannot support.
Trust by default. For figures that depend on counterparty inputs, institutions simply book the asserted value, with the dependency undocumented.
3. Why the Current Solutions Fail
Explorers answer the wrong question. “What happened in the visible data” is not “what can this party prove happened.” No explorer computes the boundary between locally derivable claims, counterparty-dependent claims, and records outside one party’s view ; because on a transparent chain that boundary doesn’t exist, and the tooling pattern was never rebuilt for a ledger where it does.
Buffers convert an information problem into a capital cost. Every basis point of liquidity held against partition divergence is synchronization debt: capital that is expensive because financial state cannot be trusted at the same time by every system that must act on it. The buffer hides the problem from the dashboard and moves it onto the balance sheet.
Manual substantiation doesn’t scale and doesn’t reproduce. A screenshot is not reproducible evidence. A confirmation letter compiled by hand each close doesn’t get cheaper with volume. As tokenized books grow, the audit workflow grows linearly with them: the hidden tax on capital, paid at every reporting date.
Undocumented trust is the dangerous one. A figure booked from a counterparty assertion, with no register recording that dependency, is a substantiation gap that surfaces at the worst possible moment: during an audit finding, a dispute, or a counterparty failure.
The common failure is that all four responses treat the bounded-observer boundary as an inconvenience to be worked around. It should be treated as a first-class object: measured, classified, and turned into evidence.
4. The Framework: Operate, Know, Prove
If the boundary is structural, the institutional response needs three layers, in order:
Layer 1 -Operate. Measure the divergence between the institution’s own partitions in real time, and gate capital movement on it. The core quantity is the synchronization delta, ΔS : the spread between the most- and least-materialized partition offsets, rolled up with reconciliation delay, trapped capital, settlement latency, failure rate, and manual-intervention cost into a Synchronization Debt Index.
Layer 2 -Know. Compute the epistemic boundary of one party’s view: which contracts are visible, which referenced records are not, and which configured claims are locally derivable versus trust-dependent versus invisible.
Layer 3 -Prove. Convert that boundary into reproducible, hash-verified evidence an external auditor can consume , replacing screenshots and ad-hoc confirmation compilation with structured substantiation.
Each layer answers a different desk’s question. Together they turn “we deployed a privacy-preserving ledger” into “we can operate it at full capital velocity, we know what we can prove, and we can hand the auditor a reproducible pack.”
5. The Build: Three Repositories, One Thesis
All three are open source (MIT), Python or TypeScript, and deliberately read-only : no transaction submission, no signing, no ledger mutation paths. Each operationalizes the Synchronization Debt thesis at a different layer.
A multi-tenant synchronization state engine for Canton deployments. A TypeScript orchestration engine ingests partition state vectors, computes ΔS = O_max − O_min across business-line PartyIDs, and emits ALM-ready routing directives on a three-state verdict: OPTIMAL (full-velocity capital routing), DEGRADED (haircut applied), HALT (block movement, escalate to risk). The repo ships production Canton topology configurations, a DTI/ISO 24165 schema registry, stress scenarios (simulate:fx-stress, simulate:repo-crunch), and a single-file interactive dashboard for real-time synchronization-debt monitoring.
Reducibility classification : labels each configured claim locally_derivable, trust_required, or invisible from the role and dependencies of its inputs.
Consensus distance : Jaccard distance between party contract sets; exact in simulation, an explicitly labeled lower bound live, because one party can never retrieve a counterparty’s undisclosed contract set.
In the bundled bilateral-repo simulation, Bank A’s view resolves to 66.7% visibility coverage: its repo notional is locally derivable, the collateral mark is trust-required, and downstream collateral use is invisible ; with a consensus distance of 0.333 to its counterparty. Three numbers that no explorer produces, and exactly the decomposition BCBS 239 substantiation needs.
One command turns that boundary into an auditor-consumable evidence pack: a hash-manifested directory containing a position register, an assertion-by-figure evidence map, a gap register of records beyond the party’s view, a structured counterparty-confirmation worklist, and a print-ready summary — every artifact SHA-256 hashed in MANIFEST.json, integrity-checkable with proofpack verify.
Each reported figure is classified into one of four evidence classes:
SELF_EVIDENT : re-derivable from contracts the subject party signed.
OBSERVED : visible, but without independent authority over upstream state transitions.
TRUST_REQUIRED : dependent on a counterparty-asserted value; these rows compile automatically into a ready-to-send ISA 505-style confirmation worklist.
BEYOND_HORIZON : a visible workflow references a record outside the party’s view. A bounded observer cannot self-certify completeness; surfacing that honestly is the point.
The repo ships an auditor guide covering workpaper use, integrity verification, and ISA 500/505 framing. It produces evidence, not opinion : the audit judgment stays with the auditor, where it belongs.
6. A Worked Example: One Repo Trade, Three Seats
Take the bundled fund-tokenization scenario and run it from two seats:
The issuer’s pack shows the supply record and both holdings. Investor 1’s pack shows its own holding — and a gap register entry, because the referenced supply record lies outside its view. Identical scenario, different provable reality. That seat-dependence is the entire bounded-observer thesis compressed into two commands: on Canton, “what is true” and “what you can prove is true” are different questions, and the answer to the second depends on where you sit.
Now widen the frame to the bilateral repo. The Know layer tells Bank A that its collateral mark is trust-required. The Prove layer converts that row into a structured confirmation request instead of a booked assumption. And the Operate layer tells group treasury whether its own desks are even seeing that repo’s state at the same offset — or whether ΔS says the capital shouldn’t move yet. Three tools, one boundary, three institutional decisions made explicit.
7. Why This Approach Is Superior
Dimension Status quo The three-layer stack The boundary Worked around informally Measured, classified, documented Internal divergence Absorbed by manual liquidity buffers Computed as ΔS; capital gated by explicit verdict Substantiation Screenshots, extracts, ad-hoc letters Reproducible, SHA-256-manifested evidence packs Counterparty trust Booked silently Compiled into a structured confirmation worklist Completeness Implicitly assumed Explicitly bounded — BEYOND_HORIZON is a named class Question answered “What happened in visible data?” “What can this party operate on, know, and prove?”
The deeper argument: as regulated finance moves onto privacy-preserving infrastructure, the scarce discipline is not deployment — it is knowing, precisely, where your provable record ends. Institutions that can measure that boundary convert it into faster closes, thinner buffers, and cheaper audits. Institutions that can’t will keep paying the hidden tax on capital: buffers against divergence they don’t measure, and manual substantiation of figures they never classified.
8. Scope and Limits
All three repositories are reference implementations, stated plainly. canton-observer and canton-proofpack are simulation-first; their JSON Ledger API v2 adapters are experimental and were not verified against LocalNet in the current builds. Live payload gap detection is heuristic and can miss dependencies. Live consensus distance is a lower bound by construction. Canton-Control-Plane demonstrates the ΔS engine against simulated partition streams and scenario data. Nothing in the stack submits transactions, signs, or mutates a ledger, and nothing outputs an audit opinion, score, or pass/fail grade. The claim is architectural: the bounded-observer boundary is measurable, classifiable, and convertible into evidence — and here is working code for each step. Hardening any layer for production is engineering; the roadmaps (Daml model introspection, Participant Query Store backends, CIP-56 claim templates, MiCA reserve-reporting packs, counterparty co-signed pack exchange) are in the repos.
Closing
The industry spent a decade arguing about which chain wins. The more consequential question, for the institutions actually moving balance sheets on-chain, is which operating model minimizes the cost of coordinating financial state — and Canton’s answer trades the global view for confidentiality. That trade is worth making. But it must be managed: the boundary it creates has to be operated across, known precisely, and proven against, every reporting period.
That is what this stack is for. The code is open, the methodology is documented in each repository, and the theoretical framework is published. If you run a treasury, risk, or audit function touching Canton — or you’re building tooling for those who do — the repos are the invitation:
Vishnu Govind is a tokenomics and digital assets architect. He researches token economics and digital asset market structure at Exponential Science, holds a research affiliation with the MiCA Crypto Alliance, and builds institutional decision and settlement infrastructure under Universal Ventures. This article is the systems companion to “The Hidden Tax on Capital: How Synchronization Debt Is Forcing Global Banks to Rebuild Their Infrastructure.”
Login
