Stuck in the Loop: Unwinding RWAs
In DeFi, a leveraged position can be built in a single block but a tokenised RWA can take days to unwind, because the underlying still settles off-chain. This piece maps who absorbs that gap, how they're paid, and what breaks when everyone exits at once.
In DeFi, a leveraged position can be built and unwound atomically, inside a single block. The deposit clears, the borrow confirms, the swap executes, all at once. That simultaneity is the point: there is no window in which you are left holding a position you have only half-constructed. It's what makes looping viable.
Tokenised real-world assets look like they should inherit this. The token usually is a derivative of an ERC-20, so any money market can list it as collateral, any vault can accept it as a deposit, any strategy can route through it. And on the way in, it mostly behaves that way - but only for as long as there is on-chain inventory to buy from. The moment depth runs out, entry stops being atomic too, because the underlying only mints against an off-chain order that settles later.
The breakage is structural on the way out. The token exists on-chain, the asset it represents does not. Redemption touches a clearing system that settles T+1 at the floor and, in practice, slower - often 2 to 3 business days before cash is back.
The result is asymmetric composability. A position is cheap to build and expensive to dismantle: opening can be atomic while inventory lasts, but closing may mean redeeming the underlying and waiting days, paying borrowing costs and carrying directional exposure throughout. Hence money markets stay conservative on RWAs, secondary markets trade at persistent discounts to NAV, and liquidators price a fixed discount against a variable delay.
Whoever closes either gap is warehousing that delay - fronting the inventory that lets a position open before the underlying mints, or the cash that lets it close before the underlying redeems. Either way, they are selling the user immediacy and keeping the duration risk: a call on the way in, a put on the way out, written across the same T+1-or-worse gap. The premium is the spread on entry and the discount to NAV on exit. The danger is that everyone exercises at once, in the one state of the world where sourcing the other side is hardest.
We'll look at who writes these facilities, how they're paid, and what happens when the option goes in the money all at once.
- From junior tranche to redemption layer
DeFi already has mature machinery for absorbing credit risk. As established previously on our piece Tranching in DeFi, a shared underlying can be split into senior and junior claims, with losses attaching first to the junior so that the senior is protected up to a threshold. The junior earns a higher yield in exchange for underwriting a possible loss.
The same logic of stratifying who absorbs what can be applied to a different dimension of risk. Instead of credit losses, the risk being absorbed is the gap between when a user wants out and when the underlying can deliver.
Just as a junior tranche protects the senior from impairment in the underlying, a redemption layer protects users from the redemption delay and NAV risk of the underlying. The asset redeems slowly, and the buffer stands in front of it, absorbing exit pressure on behalf of the users upstream. The user sees instant redemption despite the underlying continuing to settle on its own schedule. Whoever provides the capital is compensated the same way a junior earns a spread over the senior: the subordinated layer is being paid to take the risk.
- Who pays the mismatch
Every tokenised RWA protocol that offers exit faster than the underlying settlement cycle is assigning the holder role to someone else. Without someone to willingly absorb the timing gap, the synthetic cannot be unwound on a timeline that lending markets, vaults, or leveraged strategies can underwrite, which means it cannot be composed into the rest of the DeFi at any meaningful scale.
The candidates fall into three groups according to how they are exposed.
3.1 Credit Facilities
In theory, exit pressure could be externalised to a secondary market where users sell the RWA against another counterparty rather than redeeming it directly against the issuer. In practice, RWAs are typically KYC'ed, which restricts who can hold the token and keeps secondary market depth thin. What emerges instead is a credit facility model where market makers and liquidity providers front cash at a defined cost to users needing to close their loops, recovering the capital when the underlying settles against the issuer. They underwrite the duration of the settlement cycle and the risk of withdrawal at the issuer level.
These providers enter voluntarily, price their participation explicitly, and can exit the role by withdrawing capital when the premium no longer compensates the risk. Under this role, we mainly find market makers and AMM liquidity providers.
The market maker provides credit facilities through bilateral arrangements with the issuer or specific protocols, fronting cash on demand and recovering when the underlying clears, while the AMM liquidity provider posts paired inventory into a pool, providing a thin secondary market. They earn swap fees on trades and accumulate RWA inventory at a discount when exit pressure imbalances the pool, which they can later redeem against the issuer. The KYC constraint limits both the LP and the user base, so pool depth is typically small and AMM-based exit is not the most common way to exit. Most issuers that rely on it pair it with another mechanism.
Symbiotic enables exit through an RFQ with Liquid Lane, the launch product of its Instant Liquidity infrastructure on Symbiotic V2, with Midas as its first issuer. What makes it distinct is that the capital settling redemptions is not a market maker's own balance sheet but a shared, curator-managed vault: LPs deposit into Symbiotic vaults that earn base yield in lending markets like Morpho and Aave between redemptions, and that capital is drawn only when a redemption is filled. The flow runs through an on-chain RFQ - a holder requests an exit, registered market makers bid to price the redemption discount, and the winning bid settles atomically, with the cash pulled from the vault rather than fronted by the maker. The maker takes on the RWA and earns the spread without committing its own capital, then either holds the position and bears the duration itself or redeems it against the issuer over the standard settlement cycle. Because one vault services many RWA types from a common capital base, Liquid Lane is as much a shared-liquidity layer as a credit facility: the curator, not the maker, decides which issuers to support and at what risk parameters.
3.2 Liquidity Buffers
Buffer-based designs absorb redemption flow against dedicated capital before the underlying settlement cycle is touched. The capital paying for the mismatch is committed to a specific module with explicit terms, in contrast to the on-demand credit facilities described above where capital can be withdrawn at any time. This is the most common architecture in production today, not because it is necessarily cheaper but because it provides committed liquidity that does not depend on external counterparties continuing to participate. Credit facilities can widen spreads or withdraw under stress; buffers cannot.
Buffers honour redemptions instantly up to a defined cap, after which the architecture degrades, making pending redemptions either fall back into the underlying settlement cycle (T+X against the issuer) or wait for the buffer to be replenished.
They are divided into two forms depending on whether the buffer serves for a single product or for several.
3.2.1 Shared liquidity (Midas Staked Liquidity)
The buffer is capitalised by external depositors who commit stablecoins into a dedicated module and earn a yield in exchange for absorbing the duration gap between user redemption and the underlying settlement cycle. Midas Staked Liquidity (mSL) functions as a shared liquidity layer that provides atomic redemptions across Midas's mTokens. When a user requests instant redemption of any mToken, mSL extends a stablecoin loan to the issuer, who pays the user immediately and repays mSL once the underlying redemption against the issuer's portfolio clears.
The structure protects mSL depositors against credit risk on the underlying. The mSL loan is senior to mToken holders' equity, which means depositors only incur losses if the underlying portfolio's total asset value declines by more than the loan exposure before the loan is repaid. Because the loan is small relative to the portfolio it sits against, the mToken equity beneath it would have to be almost entirely wiped out within a single settlement cycle before a depositor took any loss - a remote scenario.
The capital is therefore absorbing duration risk but is structurally protected from credit risk.
3.2.2 Isolated liquidity
The buffer is capitalised by the RWA issuer itself, holding stablecoins on its own balance sheet to honour redemptions against the RWA token. When a user requests instant redemption, the issuer pays out from this reserve directly, then redeems the corresponding portion of the underlying portfolio against its custodian during the native settlement cycle to replenish the reserve. The mechanic is operationally simpler because there is no separate module, no external depositors to compensate, and no loan to repay; the buffer is just a portion of the issuer's own treasury held in stablecoin form rather than deployed into the yield-generating asset.
OpenEden's TBILL Vault operates this way, holding up to 5% of total asset value as on-chain USDC reserve specifically for redemption service. Any request that exceeds the buffer falls back into a FIFO queue that takes one to two business days to clear against the underlying T-bill settlement.
The actor paying is the protocol itself. The put is partially priced through an instant redemption fee charged to users (5bps on subscription and redemption, plus 0.3% p.a.), but the bulk of the cost is absorbed as opportunity cost on the issuer's side, since stablecoins held in reserve cannot be invested in the underlying yield-generating asset. The fee covers part of the spread but if it's too big, it does not fully compensate the issuer for the foregone yield.
We return to the structural tradeoff between these two forms in 5., once the full set of actors is on the table.
3.3 Users
When none of the above is in place, redemption defaults to the underlying settlement cycle. The user requests redemption, the tokens are locked, and the user waits for the off-chain settlement to clear. Most RWA vaults across DeFi operate this way, including Veda, Upshift, and many of the pre-buffer Midas mToken implementations. The capital paying for the mismatch is the user's time.
The strength of vanilla redemption is that it does not require any subordinated capital and cannot be exhausted under stress. Its weakness is that it is less composable, because money markets are reluctant to list collateral whose exit timing is unbounded, which also means that assets redeeming under these conditions are less capital efficient as you can’t leverage your exposure dynamically.
The mismatch between on-chain demand and off-chain settlement does not disappear under any of these designs. It is shifted, repriced, or distributed, but the underlying asset still mints and redeems on its original schedule regardless of what the buffer layer does. What changes across designs is who holds the duration risk in the interim, on which side, and at what price.
4 Looping and Liquidation Infrastructure
The actors so far are the primitives - credit facilities, buffers, and users - sorted by how their capital is exposed. This section moves up a layer, to the products that assemble those primitives into usable leverage and liquidation infrastructure. None introduces a new way of absorbing the gap: infiniFi is a credit facility wired into the liquidation path, 3F's bridge facilitators are credit facilities wired into the looping path, and the integrators 3F routes to are redemption buffers by another name. What is new is not the mechanism but the packaging - the duration risk is bundled into a one-click product the end user never has to assemble.
4.1 Liquidation Infrastructure
The liquidation function is what makes these protocols load-bearing for the broader composability of RWAs.
Usually, a liquidator captures the discount and immediately tries to convert the collateral, in secondary markets or against the issuer's buffer if the collateral is an RWA, because their business model depends on not holding the position. That works for small liquidations, where buffer capacity and secondary market depth are sufficient to absorb the flow, but at larger sizes the buffer may be hit and secondary market depth may not be enough, widening spreads and making the liquidation unprofitable.
infiniFi can act as the counterparty in this case, not as a liquidator in the conventional sense but as a credit facility against the collateral. The protocol operates as an on-chain fractional reserve, taking deposits in stablecoins, issuing iUSD as the base claim, and offering two tranches: siUSD as the senior liquid tranche and liUSD as the junior locked tranche. The deposits form a shared reserve that the protocol deploys across different yield strategies, including liquid money markets, longer-duration DeFi positions, and RWAs. Because the locked tranche already warehouses assets with slow exits, stepping in as the credit facility for a liquidated RWA is operationally coherent with what the protocol already does: the capital fronting the purchase comes from the shared reserve, the collateral is routed into the locked tranche, and the position is held until the underlying redeems against the issuer at par.
The discount captured at purchase flows back to depositors, and both tranches share in it. liUSD holders take the bulk, since they underwrite the duration and credit risk on the position. siUSD holders also earn a portion - more than their baseline money-market yield, but less than a pure pro-rata split would give them - because they trade some of that upside for unconditional liquidity. The loss waterfall runs the other way: siUSD sits senior to liUSD and stays protected unless the RWA actually impairs.
Functionally this looks like liquidation from the perspective of the lending market, but mechanically it is a credit facility where infiniFi advances capital against an asset it expects to redeem at par on a known schedule, and prices the duration risk into the discount it accepts. The execution requires preset rules around which RWAs the protocol will buy, the discount it demands, per-issuer caps, and integrations with lending markets that route liquidations to it automatically.
In addition, Symbiotic's Liquid Lane fills the same liquidation backstop from its shared vault rather than a single balance sheet: RedStone Settle routes atomic lending-market liquidations into it, and 3F and Keyring plug it in as a fast-exit path for liquidated leverage positions. The same competitive RFQ that prices early exits also prices liquidations, which means the marginal buyer a lending market relies on can be a shared, curated capital layer rather than a dedicated liquidator.
This is a piece of infrastructure that no holder of the RWA interacts with directly. The user who took the leveraged position only sees the lending market liquidate them, and the lending market sees a counterparty willing to purchase the collateral.
4.2 Leveraged Exposure
Building a leveraged RWA position requires repeating the borrow-swap-redeposit loop several times against an asset whose underlying mints off-chain on its native settlement cycle. When on-chain inventory is insufficient to fill each leg in a single block, the loop has to be built sequentially, waiting for the underlying to mint between each iteration. Building a 5x position on a T+1 RWA takes around 20 loops, roughly 20 days to enter and another 20 to unwind, which makes the strategy unviable in practice for most users.
3F is a one-click leverage protocol for asynchronous assets, built on the premise that the most efficient way to handle operational complexity is to outsource it to specialised actors. Those actors are called bridge facilitators, who front the capital to build the loop strategy and handle the exit queues when the underlying settlement is too long.
On entry, bridge facilitators provide the full up-front capital needed to assemble a leveraged position in a single execution. A user wanting to build a 5x leverage position on $1m can do it thanks to bridge facilitators that supply the remaining $4m, so the full $5m RWA position is created at once and refinanced through Morpho. In that way, total construction time drops from one settlement cycle per loop - around 20 for a 5x position - to a single N (the RWA still needs to be minted), regardless of target leverage. This logic also applies for the unwinding, as the bridge facilitators front the $4m needed to repay the Morpho loan, releasing the full collateral in a single redemption, then the RWA is redeemed against the issuer, and the proceeds repay the bridge, making the total unwind time a single settlement cycle (N).
The facilitator is paid through 3F's funding layer, which splits the capital it fronts into a principal claim and a yield claim. It funds against a signed offer fixing an expected return, receiving principal tokens 1:1 with its capital plus yield tokens representing that return; when the position is unwound and the loan repaid, it redeems both - principal back, plus the agreed spread as its fee for fronting capital across the settlement cycle. The principal leg is what carries the risk: if the underlying redeems below par it absorbs the shortfall before any yield is paid, so the facilitator is underwriting duration and impairment, not earning a riskless spread.
While bridge facilitators solve the looping problem on both entry and exit, the underlying settlement cycle (N) itself can still be too long. For shorter-duration RWAs like tokenised Treasuries this is rarely a concern, but for quarterly-redemption products a single settlement cycle can stretch to months. Apollo's tokenised credit fund (ACRED, and its Anemoy-issued counterpart ACRDX) is the clearest case: the underlying interval fund offers redemptions only once a quarter and is capped at 5% of the fund per period, so a holder who misses a window - or is one of many queuing for the same one - can wait months to exit through the underlying.
To bypass this, 3F externalises that waiting time to specialised liquidity integrators that absorb the duration risk and pay the user instantly. The pricing depends on the asset duration and the risk of principal impairment. For short-duration RWAs the redemption can happen essentially at par through integrators like Multiliquid that offer atomic swaps, while longer-duration RWAs carry an explicit discount that reflects the duration risk the integrator absorbs. Fission for example charges around 3.34% for ACRED and 3.47% for ACRDX. Either way, the user can choose between waiting one settlement cycle to unwind at par through the bridge facilitators, or exit immediately through an integrator at whatever cost the asset's duration implies.
Both bridge facilitators and liquidity integrators only serve users within 3F's vaults. A user who built a leveraged RWA position outside 3F cannot retroactively benefit from the atomicity that 3F provides. The protocol is critical infrastructure for users who choose to loop their RWAs through them, but it does not provide a generic exit mechanism for the asset.
5. Shared vs Isolated Liquidity Buffer
We met both forms in 3.2, Midas's mSL as the shared case, OpenEden's reserve as the isolated case.
The choice between consolidated and isolated buffer capital is the most critical decision in buffer architecture. It dictates maintenance costs, resilience, and composability.
While consolidated modules offer efficiency, they introduce implicit cross-asset exposure for lenders. Conversely, isolated buffers ensure independent liquidity and exit behaviour, shielding individual products from the risks of neighbouring assets.
5.1 The case for pooling
Pooling works because redemption flows across products are not perfectly correlated. When several assets draw on one buffer, the capital needed to cover them is smaller than the sum of the buffers each would need alone, since aggregate volatility grows more slowly than the sum of the individual volatilities. That efficiency shows up three ways: depositors earn more, because a lower reserve ratio is spread over a larger base; the issuer carries less idle capital, because one buffer serves many products; and anyone underwriting the asset has a single exit mechanism to model rather than one failure mode per product.
The catch is that efficiency is entirely a function of that independence. If a stress event couples flows that looked uncorrelated in normal conditions, everyone redeeming at once, the pooled buffer can be too small precisely when it is most needed.
5.2 The case for isolation
Isolation makes the opposite trade. Each product is backed by its own dedicated capital, so its behaviour doesn't depend on any assumption about how it correlates with its neighbours and stays the same regardless of what they're doing. That buys three things: adequacy is easy to check, since a buffer is sized against one product rather than a modelled aggregate; a redemption crisis in one asset can't drain the capital backing another; and adding a new product changes nothing about the redemption mechanics or risk of the existing ones.
The cost is redundancy. Each product funds a buffer sized for its own worst case, so across products whose stress events aren't perfectly correlated, the issuer or its depositors pay for capacity that mostly sits idle. The isolated buffer buys predictability with foregone yield in exactly the regimes where the predictability is least valuable.
6. RWA Composability
For an RWA to be composable as collateral, the lending market and the liquidator have to be aligned on what exit looks like.
In a lending market where the collateral can be used to borrow different assets, the LTV and the liquidation parameters are based on assumptions about how fast and at what discount the collateral can be converted; the liquidator decides whether to take the liquidation based on whether those parameters give them a profitable path to exit.
An RWA with a deep buffer and reliable liquidators can support a high LTV but one with an unreliable conversion path forces the lending market either to set a conservative LTV or not to list them as liquidations may not clear in time. The aggregate effect of this caution shows up in the data: only around 10% of tokenized RWAs are currently used as DeFi collateral.
A different architecture exists when the borrower side is consolidated. 3F operates a Morpho market where it is the sole borrower, which lets the protocol enable pre-liquidation and set the liquidation LTV higher than a standard market could support. Lenders gain comfort from 3F imposing a max leverage cap at the protocol level and rebalancing positions whenever the LTV deviates by 25 bps from target. Borrowers gain comfort from pre-liquidation triggering around 98% LTV, which lets a user run 10x leverage without being liquidated by a small move.
The discount the liquidator demands is the price of the duration risk the liquidator has to absorb between the moment of liquidation and the moment they can dispose of the collateral. This means that the liquidation discount is a proxy for the depth of the market and the reliability of the buffer that the liquidator uses to dispose of the collateral.
Every lending market that lists an RWA inherits its full exit infrastructure, whether or not it priced the inheritance correctly. The buffer the issuer chose to size becomes a parameter of the lending market's solvency without the lending market having any direct control over it, which is the externality that the rest of the stack is currently underpricing.
7. What breaks at Scale
Every architecture above works under the assumption that someone will absorb the duration risk for a premium. That assumption is behavioural, and it is weakest exactly when it matters most - the moment redemptions correlate. This is the state the opening described as the option going in the money all at once, and it is where each design is actually tested.
While liquidity buffers effectively manage routine redemptions, they remain entirely unproven against extreme, long-tail events. A systemic crisis - marked by cascading bank runs and correlated liquidity drains - will trigger unpredictable demand shocks that standard calibrations fail to anticipate. On-chain, this vulnerability is severely compounded by stale oracle feeds and delayed network updates, creating a chaotic window for MEV searchers and arbitrageurs to aggressively exploit collapsing collateral books. Ultimately, if these buffers fail to absorb such unprecedented pressure, the foundational guarantee of instant asset redemption completely collapses.
Lenders accept lower yield than the underlying because the liquidation LTV protects them from collateral losses, but that protection is only real if liquidations clear on time and unwind liquidity exists. Today much of the borrow yield is funded by external incentives like Merkl campaigns or points boosts that can bootstrap a market but cannot prove sustainability, as inorganic incentives often attract mercenary capital. Additionally, the lender-side becomes even less straightforward in shared-pool money markets. In isolated markets, lenders underwrite a specific collateral/borrow pair. But in multi-collateral systems, lenders may be indirectly exposed to the risk of other assets in the pool, making the appropriate lender rate harder to price and weakening the case for accepting a discounted return.
Money markets operate on the assumption that a liquidation will clear atomically, but the underlying RWA cannot honour that timing by itself, as it needs an instant redemption layer that absorbs the settlement gap on the liquidator's behalf or a liquidator willing to wait the settlement cycle. When that layer is correctly designed, the liquidator can convert the collateral within a window that justifies the discount they priced, and the market clears. When this layer doesn’t exist liquidations stop being economically attractive, which will eventually lead into bad debt for the money market.
8. Conclusions
All architectures examined work well under the assumption that someone is willing to absorb the duration gap between on-chain demand and off-chain settlement, in exchange for a premium that compensates the underwriter for that risk. What remains are the questions the system has not yet answered, and that determine whether the architectures hold up when tested at scale or in adverse scenarios like big losses on the collateral book.
This article shows that it requires more than tokenising the underlying and listing it as collateral. It requires an entry-side actor willing to front the inventory that lets a leveraged position be built atomically when on-chain depth is insufficient, an exit-side actor willing to absorb the redemption delay, a liquidator willing to buy the collateral, and lenders willing to provide the borrow side in the first place. RWAs are only leverageable and composable to the extent that these actors are in place.
Tokenising an asset puts it on-chain. Making it composable is a separate problem.
.png)
Stuck in the Loop: Unwinding RWAs
In DeFi, a leveraged position can be built in a single block but a tokenised RWA can take days to unwind, because the underlying still settles off-chain. This piece maps who absorbs that gap, how they're paid, and what breaks when everyone exits at once.
In DeFi, a leveraged position can be built and unwound atomically, inside a single block. The deposit clears, the borrow confirms, the swap executes, all at once. That simultaneity is the point: there is no window in which you are left holding a position you have only half-constructed. It's what makes looping viable.
Tokenised real-world assets look like they should inherit this. The token usually is a derivative of an ERC-20, so any money market can list it as collateral, any vault can accept it as a deposit, any strategy can route through it. And on the way in, it mostly behaves that way - but only for as long as there is on-chain inventory to buy from. The moment depth runs out, entry stops being atomic too, because the underlying only mints against an off-chain order that settles later.
The breakage is structural on the way out. The token exists on-chain, the asset it represents does not. Redemption touches a clearing system that settles T+1 at the floor and, in practice, slower - often 2 to 3 business days before cash is back.
The result is asymmetric composability. A position is cheap to build and expensive to dismantle: opening can be atomic while inventory lasts, but closing may mean redeeming the underlying and waiting days, paying borrowing costs and carrying directional exposure throughout. Hence money markets stay conservative on RWAs, secondary markets trade at persistent discounts to NAV, and liquidators price a fixed discount against a variable delay.
Whoever closes either gap is warehousing that delay - fronting the inventory that lets a position open before the underlying mints, or the cash that lets it close before the underlying redeems. Either way, they are selling the user immediacy and keeping the duration risk: a call on the way in, a put on the way out, written across the same T+1-or-worse gap. The premium is the spread on entry and the discount to NAV on exit. The danger is that everyone exercises at once, in the one state of the world where sourcing the other side is hardest.
We'll look at who writes these facilities, how they're paid, and what happens when the option goes in the money all at once.
- From junior tranche to redemption layer
DeFi already has mature machinery for absorbing credit risk. As established previously on our piece Tranching in DeFi, a shared underlying can be split into senior and junior claims, with losses attaching first to the junior so that the senior is protected up to a threshold. The junior earns a higher yield in exchange for underwriting a possible loss.
The same logic of stratifying who absorbs what can be applied to a different dimension of risk. Instead of credit losses, the risk being absorbed is the gap between when a user wants out and when the underlying can deliver.
Just as a junior tranche protects the senior from impairment in the underlying, a redemption layer protects users from the redemption delay and NAV risk of the underlying. The asset redeems slowly, and the buffer stands in front of it, absorbing exit pressure on behalf of the users upstream. The user sees instant redemption despite the underlying continuing to settle on its own schedule. Whoever provides the capital is compensated the same way a junior earns a spread over the senior: the subordinated layer is being paid to take the risk.
- Who pays the mismatch
Every tokenised RWA protocol that offers exit faster than the underlying settlement cycle is assigning the holder role to someone else. Without someone to willingly absorb the timing gap, the synthetic cannot be unwound on a timeline that lending markets, vaults, or leveraged strategies can underwrite, which means it cannot be composed into the rest of the DeFi at any meaningful scale.
The candidates fall into three groups according to how they are exposed.
3.1 Credit Facilities
In theory, exit pressure could be externalised to a secondary market where users sell the RWA against another counterparty rather than redeeming it directly against the issuer. In practice, RWAs are typically KYC'ed, which restricts who can hold the token and keeps secondary market depth thin. What emerges instead is a credit facility model where market makers and liquidity providers front cash at a defined cost to users needing to close their loops, recovering the capital when the underlying settles against the issuer. They underwrite the duration of the settlement cycle and the risk of withdrawal at the issuer level.
These providers enter voluntarily, price their participation explicitly, and can exit the role by withdrawing capital when the premium no longer compensates the risk. Under this role, we mainly find market makers and AMM liquidity providers.
The market maker provides credit facilities through bilateral arrangements with the issuer or specific protocols, fronting cash on demand and recovering when the underlying clears, while the AMM liquidity provider posts paired inventory into a pool, providing a thin secondary market. They earn swap fees on trades and accumulate RWA inventory at a discount when exit pressure imbalances the pool, which they can later redeem against the issuer. The KYC constraint limits both the LP and the user base, so pool depth is typically small and AMM-based exit is not the most common way to exit. Most issuers that rely on it pair it with another mechanism.
Symbiotic enables exit through an RFQ with Liquid Lane, the launch product of its Instant Liquidity infrastructure on Symbiotic V2, with Midas as its first issuer. What makes it distinct is that the capital settling redemptions is not a market maker's own balance sheet but a shared, curator-managed vault: LPs deposit into Symbiotic vaults that earn base yield in lending markets like Morpho and Aave between redemptions, and that capital is drawn only when a redemption is filled. The flow runs through an on-chain RFQ - a holder requests an exit, registered market makers bid to price the redemption discount, and the winning bid settles atomically, with the cash pulled from the vault rather than fronted by the maker. The maker takes on the RWA and earns the spread without committing its own capital, then either holds the position and bears the duration itself or redeems it against the issuer over the standard settlement cycle. Because one vault services many RWA types from a common capital base, Liquid Lane is as much a shared-liquidity layer as a credit facility: the curator, not the maker, decides which issuers to support and at what risk parameters.
3.2 Liquidity Buffers
Buffer-based designs absorb redemption flow against dedicated capital before the underlying settlement cycle is touched. The capital paying for the mismatch is committed to a specific module with explicit terms, in contrast to the on-demand credit facilities described above where capital can be withdrawn at any time. This is the most common architecture in production today, not because it is necessarily cheaper but because it provides committed liquidity that does not depend on external counterparties continuing to participate. Credit facilities can widen spreads or withdraw under stress; buffers cannot.
Buffers honour redemptions instantly up to a defined cap, after which the architecture degrades, making pending redemptions either fall back into the underlying settlement cycle (T+X against the issuer) or wait for the buffer to be replenished.
They are divided into two forms depending on whether the buffer serves for a single product or for several.
3.2.1 Shared liquidity (Midas Staked Liquidity)
The buffer is capitalised by external depositors who commit stablecoins into a dedicated module and earn a yield in exchange for absorbing the duration gap between user redemption and the underlying settlement cycle. Midas Staked Liquidity (mSL) functions as a shared liquidity layer that provides atomic redemptions across Midas's mTokens. When a user requests instant redemption of any mToken, mSL extends a stablecoin loan to the issuer, who pays the user immediately and repays mSL once the underlying redemption against the issuer's portfolio clears.
The structure protects mSL depositors against credit risk on the underlying. The mSL loan is senior to mToken holders' equity, which means depositors only incur losses if the underlying portfolio's total asset value declines by more than the loan exposure before the loan is repaid. Because the loan is small relative to the portfolio it sits against, the mToken equity beneath it would have to be almost entirely wiped out within a single settlement cycle before a depositor took any loss - a remote scenario.
The capital is therefore absorbing duration risk but is structurally protected from credit risk.
3.2.2 Isolated liquidity
The buffer is capitalised by the RWA issuer itself, holding stablecoins on its own balance sheet to honour redemptions against the RWA token. When a user requests instant redemption, the issuer pays out from this reserve directly, then redeems the corresponding portion of the underlying portfolio against its custodian during the native settlement cycle to replenish the reserve. The mechanic is operationally simpler because there is no separate module, no external depositors to compensate, and no loan to repay; the buffer is just a portion of the issuer's own treasury held in stablecoin form rather than deployed into the yield-generating asset.
OpenEden's TBILL Vault operates this way, holding up to 5% of total asset value as on-chain USDC reserve specifically for redemption service. Any request that exceeds the buffer falls back into a FIFO queue that takes one to two business days to clear against the underlying T-bill settlement.
The actor paying is the protocol itself. The put is partially priced through an instant redemption fee charged to users (5bps on subscription and redemption, plus 0.3% p.a.), but the bulk of the cost is absorbed as opportunity cost on the issuer's side, since stablecoins held in reserve cannot be invested in the underlying yield-generating asset. The fee covers part of the spread but if it's too big, it does not fully compensate the issuer for the foregone yield.
We return to the structural tradeoff between these two forms in 5., once the full set of actors is on the table.
3.3 Users
When none of the above is in place, redemption defaults to the underlying settlement cycle. The user requests redemption, the tokens are locked, and the user waits for the off-chain settlement to clear. Most RWA vaults across DeFi operate this way, including Veda, Upshift, and many of the pre-buffer Midas mToken implementations. The capital paying for the mismatch is the user's time.
The strength of vanilla redemption is that it does not require any subordinated capital and cannot be exhausted under stress. Its weakness is that it is less composable, because money markets are reluctant to list collateral whose exit timing is unbounded, which also means that assets redeeming under these conditions are less capital efficient as you can’t leverage your exposure dynamically.
The mismatch between on-chain demand and off-chain settlement does not disappear under any of these designs. It is shifted, repriced, or distributed, but the underlying asset still mints and redeems on its original schedule regardless of what the buffer layer does. What changes across designs is who holds the duration risk in the interim, on which side, and at what price.
4 Looping and Liquidation Infrastructure
The actors so far are the primitives - credit facilities, buffers, and users - sorted by how their capital is exposed. This section moves up a layer, to the products that assemble those primitives into usable leverage and liquidation infrastructure. None introduces a new way of absorbing the gap: infiniFi is a credit facility wired into the liquidation path, 3F's bridge facilitators are credit facilities wired into the looping path, and the integrators 3F routes to are redemption buffers by another name. What is new is not the mechanism but the packaging - the duration risk is bundled into a one-click product the end user never has to assemble.
4.1 Liquidation Infrastructure
The liquidation function is what makes these protocols load-bearing for the broader composability of RWAs.
Usually, a liquidator captures the discount and immediately tries to convert the collateral, in secondary markets or against the issuer's buffer if the collateral is an RWA, because their business model depends on not holding the position. That works for small liquidations, where buffer capacity and secondary market depth are sufficient to absorb the flow, but at larger sizes the buffer may be hit and secondary market depth may not be enough, widening spreads and making the liquidation unprofitable.
infiniFi can act as the counterparty in this case, not as a liquidator in the conventional sense but as a credit facility against the collateral. The protocol operates as an on-chain fractional reserve, taking deposits in stablecoins, issuing iUSD as the base claim, and offering two tranches: siUSD as the senior liquid tranche and liUSD as the junior locked tranche. The deposits form a shared reserve that the protocol deploys across different yield strategies, including liquid money markets, longer-duration DeFi positions, and RWAs. Because the locked tranche already warehouses assets with slow exits, stepping in as the credit facility for a liquidated RWA is operationally coherent with what the protocol already does: the capital fronting the purchase comes from the shared reserve, the collateral is routed into the locked tranche, and the position is held until the underlying redeems against the issuer at par.
The discount captured at purchase flows back to depositors, and both tranches share in it. liUSD holders take the bulk, since they underwrite the duration and credit risk on the position. siUSD holders also earn a portion - more than their baseline money-market yield, but less than a pure pro-rata split would give them - because they trade some of that upside for unconditional liquidity. The loss waterfall runs the other way: siUSD sits senior to liUSD and stays protected unless the RWA actually impairs.
Functionally this looks like liquidation from the perspective of the lending market, but mechanically it is a credit facility where infiniFi advances capital against an asset it expects to redeem at par on a known schedule, and prices the duration risk into the discount it accepts. The execution requires preset rules around which RWAs the protocol will buy, the discount it demands, per-issuer caps, and integrations with lending markets that route liquidations to it automatically.
In addition, Symbiotic's Liquid Lane fills the same liquidation backstop from its shared vault rather than a single balance sheet: RedStone Settle routes atomic lending-market liquidations into it, and 3F and Keyring plug it in as a fast-exit path for liquidated leverage positions. The same competitive RFQ that prices early exits also prices liquidations, which means the marginal buyer a lending market relies on can be a shared, curated capital layer rather than a dedicated liquidator.
This is a piece of infrastructure that no holder of the RWA interacts with directly. The user who took the leveraged position only sees the lending market liquidate them, and the lending market sees a counterparty willing to purchase the collateral.
4.2 Leveraged Exposure
Building a leveraged RWA position requires repeating the borrow-swap-redeposit loop several times against an asset whose underlying mints off-chain on its native settlement cycle. When on-chain inventory is insufficient to fill each leg in a single block, the loop has to be built sequentially, waiting for the underlying to mint between each iteration. Building a 5x position on a T+1 RWA takes around 20 loops, roughly 20 days to enter and another 20 to unwind, which makes the strategy unviable in practice for most users.
3F is a one-click leverage protocol for asynchronous assets, built on the premise that the most efficient way to handle operational complexity is to outsource it to specialised actors. Those actors are called bridge facilitators, who front the capital to build the loop strategy and handle the exit queues when the underlying settlement is too long.
On entry, bridge facilitators provide the full up-front capital needed to assemble a leveraged position in a single execution. A user wanting to build a 5x leverage position on $1m can do it thanks to bridge facilitators that supply the remaining $4m, so the full $5m RWA position is created at once and refinanced through Morpho. In that way, total construction time drops from one settlement cycle per loop - around 20 for a 5x position - to a single N (the RWA still needs to be minted), regardless of target leverage. This logic also applies for the unwinding, as the bridge facilitators front the $4m needed to repay the Morpho loan, releasing the full collateral in a single redemption, then the RWA is redeemed against the issuer, and the proceeds repay the bridge, making the total unwind time a single settlement cycle (N).
The facilitator is paid through 3F's funding layer, which splits the capital it fronts into a principal claim and a yield claim. It funds against a signed offer fixing an expected return, receiving principal tokens 1:1 with its capital plus yield tokens representing that return; when the position is unwound and the loan repaid, it redeems both - principal back, plus the agreed spread as its fee for fronting capital across the settlement cycle. The principal leg is what carries the risk: if the underlying redeems below par it absorbs the shortfall before any yield is paid, so the facilitator is underwriting duration and impairment, not earning a riskless spread.
While bridge facilitators solve the looping problem on both entry and exit, the underlying settlement cycle (N) itself can still be too long. For shorter-duration RWAs like tokenised Treasuries this is rarely a concern, but for quarterly-redemption products a single settlement cycle can stretch to months. Apollo's tokenised credit fund (ACRED, and its Anemoy-issued counterpart ACRDX) is the clearest case: the underlying interval fund offers redemptions only once a quarter and is capped at 5% of the fund per period, so a holder who misses a window - or is one of many queuing for the same one - can wait months to exit through the underlying.
To bypass this, 3F externalises that waiting time to specialised liquidity integrators that absorb the duration risk and pay the user instantly. The pricing depends on the asset duration and the risk of principal impairment. For short-duration RWAs the redemption can happen essentially at par through integrators like Multiliquid that offer atomic swaps, while longer-duration RWAs carry an explicit discount that reflects the duration risk the integrator absorbs. Fission for example charges around 3.34% for ACRED and 3.47% for ACRDX. Either way, the user can choose between waiting one settlement cycle to unwind at par through the bridge facilitators, or exit immediately through an integrator at whatever cost the asset's duration implies.
Both bridge facilitators and liquidity integrators only serve users within 3F's vaults. A user who built a leveraged RWA position outside 3F cannot retroactively benefit from the atomicity that 3F provides. The protocol is critical infrastructure for users who choose to loop their RWAs through them, but it does not provide a generic exit mechanism for the asset.
5. Shared vs Isolated Liquidity Buffer
We met both forms in 3.2, Midas's mSL as the shared case, OpenEden's reserve as the isolated case.
The choice between consolidated and isolated buffer capital is the most critical decision in buffer architecture. It dictates maintenance costs, resilience, and composability.
While consolidated modules offer efficiency, they introduce implicit cross-asset exposure for lenders. Conversely, isolated buffers ensure independent liquidity and exit behaviour, shielding individual products from the risks of neighbouring assets.
5.1 The case for pooling
Pooling works because redemption flows across products are not perfectly correlated. When several assets draw on one buffer, the capital needed to cover them is smaller than the sum of the buffers each would need alone, since aggregate volatility grows more slowly than the sum of the individual volatilities. That efficiency shows up three ways: depositors earn more, because a lower reserve ratio is spread over a larger base; the issuer carries less idle capital, because one buffer serves many products; and anyone underwriting the asset has a single exit mechanism to model rather than one failure mode per product.
The catch is that efficiency is entirely a function of that independence. If a stress event couples flows that looked uncorrelated in normal conditions, everyone redeeming at once, the pooled buffer can be too small precisely when it is most needed.
5.2 The case for isolation
Isolation makes the opposite trade. Each product is backed by its own dedicated capital, so its behaviour doesn't depend on any assumption about how it correlates with its neighbours and stays the same regardless of what they're doing. That buys three things: adequacy is easy to check, since a buffer is sized against one product rather than a modelled aggregate; a redemption crisis in one asset can't drain the capital backing another; and adding a new product changes nothing about the redemption mechanics or risk of the existing ones.
The cost is redundancy. Each product funds a buffer sized for its own worst case, so across products whose stress events aren't perfectly correlated, the issuer or its depositors pay for capacity that mostly sits idle. The isolated buffer buys predictability with foregone yield in exactly the regimes where the predictability is least valuable.
6. RWA Composability
For an RWA to be composable as collateral, the lending market and the liquidator have to be aligned on what exit looks like.
In a lending market where the collateral can be used to borrow different assets, the LTV and the liquidation parameters are based on assumptions about how fast and at what discount the collateral can be converted; the liquidator decides whether to take the liquidation based on whether those parameters give them a profitable path to exit.
An RWA with a deep buffer and reliable liquidators can support a high LTV but one with an unreliable conversion path forces the lending market either to set a conservative LTV or not to list them as liquidations may not clear in time. The aggregate effect of this caution shows up in the data: only around 10% of tokenized RWAs are currently used as DeFi collateral.
A different architecture exists when the borrower side is consolidated. 3F operates a Morpho market where it is the sole borrower, which lets the protocol enable pre-liquidation and set the liquidation LTV higher than a standard market could support. Lenders gain comfort from 3F imposing a max leverage cap at the protocol level and rebalancing positions whenever the LTV deviates by 25 bps from target. Borrowers gain comfort from pre-liquidation triggering around 98% LTV, which lets a user run 10x leverage without being liquidated by a small move.
The discount the liquidator demands is the price of the duration risk the liquidator has to absorb between the moment of liquidation and the moment they can dispose of the collateral. This means that the liquidation discount is a proxy for the depth of the market and the reliability of the buffer that the liquidator uses to dispose of the collateral.
Every lending market that lists an RWA inherits its full exit infrastructure, whether or not it priced the inheritance correctly. The buffer the issuer chose to size becomes a parameter of the lending market's solvency without the lending market having any direct control over it, which is the externality that the rest of the stack is currently underpricing.
7. What breaks at Scale
Every architecture above works under the assumption that someone will absorb the duration risk for a premium. That assumption is behavioural, and it is weakest exactly when it matters most - the moment redemptions correlate. This is the state the opening described as the option going in the money all at once, and it is where each design is actually tested.
While liquidity buffers effectively manage routine redemptions, they remain entirely unproven against extreme, long-tail events. A systemic crisis - marked by cascading bank runs and correlated liquidity drains - will trigger unpredictable demand shocks that standard calibrations fail to anticipate. On-chain, this vulnerability is severely compounded by stale oracle feeds and delayed network updates, creating a chaotic window for MEV searchers and arbitrageurs to aggressively exploit collapsing collateral books. Ultimately, if these buffers fail to absorb such unprecedented pressure, the foundational guarantee of instant asset redemption completely collapses.
Lenders accept lower yield than the underlying because the liquidation LTV protects them from collateral losses, but that protection is only real if liquidations clear on time and unwind liquidity exists. Today much of the borrow yield is funded by external incentives like Merkl campaigns or points boosts that can bootstrap a market but cannot prove sustainability, as inorganic incentives often attract mercenary capital. Additionally, the lender-side becomes even less straightforward in shared-pool money markets. In isolated markets, lenders underwrite a specific collateral/borrow pair. But in multi-collateral systems, lenders may be indirectly exposed to the risk of other assets in the pool, making the appropriate lender rate harder to price and weakening the case for accepting a discounted return.
Money markets operate on the assumption that a liquidation will clear atomically, but the underlying RWA cannot honour that timing by itself, as it needs an instant redemption layer that absorbs the settlement gap on the liquidator's behalf or a liquidator willing to wait the settlement cycle. When that layer is correctly designed, the liquidator can convert the collateral within a window that justifies the discount they priced, and the market clears. When this layer doesn’t exist liquidations stop being economically attractive, which will eventually lead into bad debt for the money market.
8. Conclusions
All architectures examined work well under the assumption that someone is willing to absorb the duration gap between on-chain demand and off-chain settlement, in exchange for a premium that compensates the underwriter for that risk. What remains are the questions the system has not yet answered, and that determine whether the architectures hold up when tested at scale or in adverse scenarios like big losses on the collateral book.
This article shows that it requires more than tokenising the underlying and listing it as collateral. It requires an entry-side actor willing to front the inventory that lets a leveraged position be built atomically when on-chain depth is insufficient, an exit-side actor willing to absorb the redemption delay, a liquidator willing to buy the collateral, and lenders willing to provide the borrow side in the first place. RWAs are only leverageable and composable to the extent that these actors are in place.
Tokenising an asset puts it on-chain. Making it composable is a separate problem.
.svg)