Go where the liquidity, custody, and auditors already are.
Most token papers treat the chain section as a branding exercise. We treat it as an engineering decision with a paper trail. Chain selection follows liquidity and custody, not narrative , and we say out loud where they are not.
One canonical asset. One canonical supply.
$NPKN is issued once, on Ethereum L1. Everything else is a spoke: a burn-and-mint representation whose supply nets to zero against the hub. No wrapped tokens, no lock-and-mint bridges holding honeypots, no ambiguity about where the real thing lives.
One canonical asset with one canonical supply, issued once. ERC-3643 (T-REX) is the consolidated institutional standard: $32B+ tokenized across 200+ deployments and 180+ jurisdictions, DTCC ComposerX integration, and native settlement on the BaFin-licensed 21X exchange. Every transfer runs through an on-chain eligibility check : enforced in the token itself, not promised in a PDF.
56%+ of tokenized RWA value lives here
Burn-and-mint spokes · supply nets to zero against the hub · no wrapped-token honeypots
Base
Burn-and-mint via ERC-7802 hooks (the crosschain interface that ships in OpenZeppelin v5.5+) with Chainlink CCIP as the transport. Sub-cent fees, and the fastest-growing RWA TVL of any network over the past 18 months. The bridge vendor lives outside the token: CCIP is an authorized caller that can be replaced without touching $NPKN itself.
Honest note: Base's sequencer is centralized: acceptable for a distribution spoke, never for the hub.
XRPL mainnet
A native MPT issuance inside a Permissioned Domain, with RLUSD as the mint/redeem and settlement rail, plugging into ~$3.5B of XRPL RWA value, +$1.9B in 90-day inflows, BNY custody of RLUSD reserves, and an OCC-chartered trust bank.
Activation is gated on three published checks: XLS-66 native lending live, independent top-tier MPT custody, and Archax-scale secondary liquidity. Until then it is built, tested, and waiting. Not marketed.
Avalanche
A post-ACP-77 permissioned Avalanche L1 for the future RSX settlement layer: Napkin-appointed validators (Napkin entities, our auditor, a banking partner), Canadian-hosted for data residency, with eERC encrypted balances so even in-network participants see only their own flows.
The precedent path: Progmat migrated $2.8B of tokenized securities to a dedicated Avalanche L1; JPMorgan's Kinexys runs on a permissioned Evergreen subnet.
| Chain | Role | Why | Evidence |
|---|---|---|---|
| Ethereum L1 | Canonical hub | Deepest custody, audit, and RWA gravity | 56%+ of RWA value; ERC-3643 $32B+; DTCC ComposerX |
| Base | Retail spoke | Sub-cent fees; ERC-7802 + CCIP burn-and-mint | Fastest-growing RWA TVL over 18 months |
| XRPL mainnet | Institutional spoke | Native MPT + Permissioned Domains + RLUSD rail | ~$3.5B RWA; +$1.9B 90-day inflows; BNY, OCC charter |
| Avalanche | Future RSX L1 | Post-ACP-77 permissioned settlement, eERC privacy | Progmat $2.8B; JPM Kinexys; Intain $5.5B |
| Plume | Watchlist | RWA-native L2, too young for canonical issuance | ~$400M TVL; 190k+ RWA holders; BMA Class M |
Zero DEX volume, ~168 active developers against Ethereum's ~8,448, flagship launch dApps at zero TVL. A roughly 24,000-to-1 miss against its own ecosystem projections. We do not deploy there, and we say so in print, because the reasoning generalizes: institutional demand found XRPL through its native primitives and skipped the EVM layer entirely. A chain decision made for narrative alignment rather than measured liquidity is how treasuries get stranded.
Immutable core. Modular periphery.
The token contract itself is not upgradeable: holders should never have to trust that an admin key will not rewrite the asset they hold. Everything that legitimately needs to evolve lives in swappable modules behind interfaces: behind a Safe multisig and a 48-hour timelock, publicly visible for two days before it can execute.
ERC-3643 permissioned token, full ERC-20 interface preserved. OpenZeppelin Contracts v5, Solidity ^0.8.26, built and tested in Foundry. The asset you hold cannot be rewritten.
Compliance module
Jurisdiction rules change; the module swaps.
Engine module
Milestone steps activate; the constants do not move.
Oracle adapter
Feeds get upgraded; the token never does.
Module swaps: Safe multisig + 48h timelock · Emergency pause: security council, no timelock. An incident does not wait 48 hours
Three calls. No discretionary hand on the valve.
attestNAV()The attestation lands
The oracle adapter receives an auditor-attested NAV and consolidated-FCF figure from the Chainlink feed. The Engine's share of attested FCF arrives at the current milestone percentage: 20/30/40, constants keyed to cumulative attested FCF, not admin-settable parameters.
buybackAndBurn()The buyback leg
An independent execution agent triggers the pre-committed formula, enforced on-chain: TWAP-referenced pricing, daily volume caps, reverts inside blackout windows. Purchased tokens are burned in the same transaction. Every burn an event, every event traceable to a published wallet.
openTenderWindow()The tender leg
Quarterly, a Dutch-auction tender opens, funded by the Engine's tender allocation and floored at the discount-bounded attested NAV. Holders tender; the auction clears; the contract settles.
The machine refuses to price anything against a number it cannot trust.
If the NAV feed goes stale or deviates outside configured tolerance, a circuit breaker freezes NAV-dependent actions, Engine buybacks, tender pricing, primary issuance, while leaving transfers untouched. Holders can always move their tokens. Combined with the 120-day audit covenant, staleness becomes expensive for exactly one party: us.
What stops someone from forking us?
It deserves a real answer. SushiSwap forked Uniswap v2 in September 2020 and pulled roughly $810M (about 55% of Uniswap's liquidity) in a single day. It won, decisively, for about two weeks. Then it lost the decade: by 2025–26 its TVL sat 98.7% below peak while Uniswap collected roughly $985M in fees in ten months.
Code
The machine
Nobody can fork a portfolio of real operating companies, a EUR 500M bond program, and an audited consolidation. Forks copy code. Not machines.
Priced for the destination we intend to reach.
Security spend is where token projects reveal whether they expect to exist in five years. Our budget assumes we do: $250–450K all-in for security, roughly 7–9 months from spec freeze to unrestricted mainnet.
Two firms, second on frozen code
Invariants, proven
Immunefi, live before the token
Coverage, fuzzing, clean deploys
| Phase | Scope | Duration | Exit gate |
|---|---|---|---|
| Testnet | Full system on Sepolia + Base Sepolia, CCIP lanes, mock NAV feeds | 4–6 weeks | Complete issue-fulfill-claim and pause-upgrade drills pass |
| Audit window | Audit 1, remediation, audit 2 on frozen code, public competition | 10–14 weeks | All criticals and highs resolved and re-reviewed |
| Guarded mainnet | Supply cap, per-epoch issuance caps, per-address limits, allowlist-first | 4–8 weeks | Clean month of monitoring; post-deploy audit of live bytecode |
| Cap removal | Staged raises of caps and CCIP rate limits | 4+ weeks | Each raise follows a clean prior period |
The bug bounty goes live before the token does. The caps come off after the audits: never before.
An engineering decision with a paper trail.
Section 7 documents every chain choice, every contract boundary, and every gate on the launch path, with the evidence attached.