[{"data":1,"prerenderedAt":20},["ShallowReactive",2],{"blog-detail:forced-transfer-is-not-a-backdoor-how-should-we-audit-legitimate-bypass-in-rwa-protocols-d1c885":3},{"category":4,"article":5},null,{"slug":6,"category":7,"categoryLabel":8,"subcategoryLabel":9,"authorName":10,"title":11,"excerpt":12,"contentHtml":13,"coverUrl":14,"publishedAt":15,"updatedAt":16,"readTime":17,"cover":14,"hasCover":18,"coverAlt":19},"forced-transfer-is-not-a-backdoor-how-should-we-audit-legitimate-bypass-in-rwa-protocols-d1c885","research","Research","Industry Research","Olivia","Forced Transfer Is Not a Backdoor: How Should We Audit “Legitimate Bypass” in RWA Protocols?","In traditional crypto security reviews, seeing that an admin can move user funds is usually an immediate centralization red flag. In RWA systems, however, that conclusion does not always hold.","\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">In traditional crypto security reviews, seeing that an \u003Cstrong>admin can move user funds\u003C\u002Fstrong> is usually an immediate centralization red flag. In RWA systems, however, that conclusion does not always hold.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">ERC-7943 explicitly defines capabilities such as \u003Cstrong>forcedTransfer()\u003C\u002Fstrong>, \u003Cstrong>setFrozenTokens()\u003C\u002Fstrong>, \u003Cstrong>canSend()\u003C\u002Fstrong>, \u003Cstrong>canReceive()\u003C\u002Fstrong>, and \u003Cstrong>canTransfer()\u003C\u002Fstrong>. Freezing, forced transfer, and asset recovery are not necessarily hidden backdoors added by an implementation team; they may be explicit requirements of a regulated-token specification.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">This is a class of RWA risk that ScaleBit believes deserves a different audit model. When an “exception” is part of the specification itself, the security question is no longer whether the exception exists. The real question is:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">If a privileged path is intentionally allowed to bypass certain rules, which invariants may legitimately diverge—and which invariants must remain non-bypassable?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-18\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-18\">1. Forced Transfer Creates a Second Legitimate State Machine\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A conventional token transfer roughly follows one semantic path:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Holder Authorization → Transfer Conditions → Balance \u002F Ownership Transition\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">An RWA token may expose another equally legitimate path:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Privileged Authority → Enforcement Conditions → Balance \u002F Ownership Transition\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Both modify the same asset state, but they do not necessarily share the same preconditions.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Under some ERC-7943 permission models, for example, \u003Cstrong>forcedTransfer() \u003C\u002Fstrong>may legitimately bypass the normal \u003Cstrong>canTransfer() \u003C\u002Fstrong>path. But permission to bypass one transfer restriction does not imply that every other safety property may disappear with it.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A more useful review model is therefore to separate invariants into two categories:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-14\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-14\">\u003Cimg alt=\"111111\" src=\"\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002Fdcb1b043cd8bb17a50493540a8389b51.jpg\" style=\"width: 414.6pt\">\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">An \u003Cstrong>onlyRole(AGENT) \u003C\u002Fstrong>check tells us who may enter the privileged path.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">It does not tell us:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Which security properties must still hold after that privileged state transition completes?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Privileged-path security is therefore not about eliminating semantic differences between normal and enforcement flows. It is about ensuring that:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Semantic divergence is strictly limited to what the specification actually requires.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-18\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-18\">2. When frozen > balance Is Not an Accounting Bug\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">ERC-7943 contains a particularly counterintuitive state requirement: the frozen amount may exceed the account’s current balance.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A Solidity auditor may instinctively assume an invariant such as:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>frozen(account) ≤ balanceOf(account)\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">For a regulated token, however, that assumption may be incorrect.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Suppose an address currently holds 10 tokens, but an enforcement authority intends to restrict not only the current balance, but also future assets received by that address.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">If the system only allows:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>frozen = 10\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">and the account later receives another 90 tokens:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>balance = 100\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>frozen  = 10\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">those additional 90 tokens may become transferable.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A valid enforcement state may therefore instead be:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>balance = 10\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>frozen  = 100\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Here, frozen no longer means merely:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">the portion of the current balance that is frozen.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">It behaves more like:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>a policy constraint over both current and future asset state.\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">That distinction changes implementation-level security assumptions immediately.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">For example:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-14\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-14\">\u003Cimg alt=\"222222\" src=\"\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002Fb1d80f1cbc6a95042f39483b1e4fb03f.jpg\" style=\"width: 414.3pt\">\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">may underflow or revert whenever frozen > balance.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">If permission-query functions are also expected to remain non-reverting under valid states, the implementation must explicitly handle this case, for example:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-14\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-14\">\u003Cimg alt=\"图像2026-8-26 16.06\" src=\"\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002F0833773e6ec6954e56d93466f4f27cde.jpg\" style=\"width: 414.9pt\">\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">This illustrates an important RWA audit principle:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Do not infer invariants from variable names. Derive them from the state semantics defined by the specification.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">The same rule applies to forced-transfer ordering.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">If an ERC-721 or ERC-1155 enforcement path updates frozen accounting and also triggers a recipient callback, the relevant state should be reconciled before the external interaction. Otherwise, reentrancy may observe an intermediate state such as:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Ownership = New State\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Frozen Accounting = Old State\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">The failure here is not excessive administrative power.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">It is a violation of state consistency.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Authorization semantics may diverge. State-observation semantics still need to remain coherent.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Or more simply:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Bypass permission does not imply bypass ordering constraints.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-18\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-18\">3. Revocability Propagates Through the Composability Graph\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Forced transfer is not only a property of the token contract itself. It also changes the assumptions made by every downstream protocol that integrates the asset.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Traditional DeFi frequently relies on an implicit assumption:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Assets held by a protocol can only leave through that protocol’s own state machine.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">For a revocable RWA, this assumption no longer necessarily holds.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Consider a vault holding $10 million of an RWA token. If the issuer or enforcement authority can alter the vault’s token balance outside the vault’s own logic, then even a perfectly implemented vault may experience:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-14\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-14\">\u003Cimg alt=\"44444\" src=\"\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002Fdd3125cd0cf3468c7b224980c8c4a71c.jpg\" style=\"width: 415.2pt\">\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">For a bridge, the implication may be even more fundamental.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Suppose its backing invariant is:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>Wrapped Supply ≤ Assets Locked in Custody\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">If locked assets can leave custody through a privileged token-level path that the bridge does not control, then the bridge’s backing invariant now depends on issuer authority.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">This leads to a broader security property:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>Revocability is a composability property.\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">When a protocol integrates a revocable asset, it inherits part of the issuer’s privileged state machine.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">That does not mean revocable RWAs are unsuitable for DeFi. It means integration reviews must ask additional questions:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Who can change protocol-held balances externally?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Does internal accounting observe those changes immediately?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Does the protocol assume custody = exclusive control?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Which solvency or backing invariants depend on that assumption?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">From ScaleBit’s perspective, this is particularly important because the vulnerability may not exist in either contract independently. It may emerge from a composability assumption mismatch between the RWA token and the downstream protocol.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-18\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-18\">4. Move From Privileged Roles to a Privileged Transition Matrix\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">The previous analysis can be translated directly into a more practical review framework.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Instead of stopping at who holds AGENT_ROLE, whether that role is protected by a multisig, or whether the administrator is properly restricted, security reviews should compare the normal and enforcement paths explicitly.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A Privileged Transition Matrix can make those differences visible:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-14\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-14\">\u003Cimg alt=\"55555\" src=\"\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002F020ec4b0e64f840026ec32d0adadb41a.jpg\" style=\"width: 415.1pt\">\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">The real objective is to distinguish:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Intentional Enforcement Semantics\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">from:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">\u003Cstrong>\u003Cem>Accidental Security Bypass\u003C\u002Fem>\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Implementation note: not every privileged action needs the same delay model\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Changes that modify the rules themselves—adding enforcement authorities, upgrading compliance modules, or expanding the scope of forced transfer—generally benefit from high-friction controls such as multisigs and timelocks.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Executing an already-defined emergency freeze may require faster action, because excessive delay can itself create an escape window.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A useful principle is:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Changing authority should be slow; exercising existing authority can be fast only when the execution scope is tightly bounded.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Faster execution should therefore come with narrower limits around recipient, amount, asset, operator, and auditability.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-18\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-18\">Conclusion\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">When the exception becomes the specification, the exception needs its own security semantics.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">One of the fundamental differences between RWA systems and traditional DeFi is that behaviors considered exceptional in permissionless tokens may be explicit protocol requirements in regulated assets.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">forcedTransfer() is not necessarily a backdoor.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">frozen > balance is not necessarily an accounting bug.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Bypassing holder authorization is not necessarily an authorization vulnerability.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">The real failure occurs when:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">A privileged path bypasses an invariant that the specification never intended it to bypass.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">This is why ScaleBit believes RWA privilege reviews should not stop at:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Who has privilege?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">They should continue with:\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">What semantics does that privilege create?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Which invariants may diverge?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Which invariants must survive?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Which downstream protocols\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">silently assume they survive?\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">Once an exception path becomes part of the protocol specification, it can no longer be treated as a special admin function and reviewed in isolation.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">It is a second asset state machine—and it should be audited as one.\u003C\u002Fspan>\u003C\u002Fp>\u003Cp class=\"docx-align-justify docx-size-12\" style=\"line-height: 1.5; margin-top: 0pt; margin-bottom: 24pt\">\u003Cspan class=\"docx-size-12\">For RWA security, the goal is not to eliminate privilege at all costs. It is to ensure that every privileged action has a clear, bounded, and verifiable semantic boundary.\u003C\u002Fspan>\u003C\u002Fp>","\u002Fmedia\u002Fscalebit\u002F2026\u002F08\u002F379beee09c5161a2faf84aa2ca2a1f3b.jpg","2026-08-26T08:16:32Z","2026-08-26T16:22:17Z","7 min read",true,"Forced Transfer Is Not a Backdoor: How Should We Audit “Legitimate Bypass” in RWA Protocols? cover image",1792473986982]