Tokenized RWAs are not a single technology but a four-layer stack, and each layer introduces distinct risks. Understanding the stack is essential for evaluating whether a project is genuinely robust or merely a wrapper around a spreadsheet.

Asset layer — the underlying legal claim (a T-bill, a warehouse receipt, a mortgage note).
Legal wrapper — SPV, trust, or fund structure that isolates the asset from the issuer's balance sheet.
Token layer — the on-chain representation (ERC-20, ERC-3643, ERC-1400) with transfer restrictions.
Oracle & servicing layer — NAV feeds, coupon payments, and redemption rails.

Weakness in any layer breaks the chain of custody. A perfect smart contract on a poorly isolated SPV is still a bad asset.

Layer	Failure Mode	Mitigation
Asset	Default, fraud	Underwriting, insurance
Legal	Bankruptcy remoteness fails	True-sale opinion
Token	Permissioning bug	Audits, ERC-3643
Oracle	Stale NAV	Multi-source feeds