Security Audit Report for Bitget's RWA EVM Contracts

The target of this audit is the private code repository of RWA EVM Contracts of Bitget. The protocol introduces an on-chain Real World Asset (RWA) tokenization implementation on EVM-compatible chains, enabling regulated issuance and redemption of asset-backed tokens representing securities. The system is organized around three core contracts: RWAToken, RWATokenManager, and RWATokenFactory. RWAToken is an upgradeable ERC-20 token deployed via a BeaconProxy pattern, implementing a rebase mechanism in which all token balances are stored as raw values and divided by a global rebase index at read time. The rebase index is updated through a split ratio, allowing the protocol to model corporate splits and reverse splits by adjusting the index proportionally across all holders simultaneously without modifying individual balances. Each RWAToken instance also enforces three-layered compliance guards: KYC verification through IDRegistry, freeze controls, and protocol-wide sanctions screening via SanctionsList. RWATokenFactory handles token deployment and wires each instance to shared infrastructure, including a CorporateActionOracle, which governs time-windowed corporate actions such as rebase splits and name and symbol updates. RWATokenManager acts as the primary entry point for user-facing mint and redeem flows, both of which operate through an EIP-712 Attestation signed by a trusted SIGNER_ROLE. Each attestation binds the token, quantity, price, settlement amount, and expiration into a single one-time-use authorization. Price integrity is enforced by SanityCheckOracle, which validates the attested price against an independent reference via either a Pyth Lazer Pro on-chain verification or a SignedPrice signed by multi-party, rejecting deviations exceeding a configurable basis-point threshold. Throughput is governed by RateLimiter, which applies a linear-decay sliding-window quota at both the global per-token and per-user levels. Market session eligibility is enforced by MarketHours. The protocol is designed for a KYC DEX intermediary model, where partner DEX contracts hold calling rights and are responsible for end-user compliance off-chain before invoking the Manager on behalf of their users.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.