Why Locked Collateral Should Not Circulate Freely in Afi Protocol

A reserve asset cannot reliably secure a circulating token while remaining freely available for unrelated transfers, lending, trading, or additional issuance. If the same asset is simultaneously treated as collateral and as usable capital elsewhere, several financial claims may depend on one underlying unit of value.

This is the foundation of double counting.

Afi Protocol addresses the problem through Proof-of-Reserve Vaults that separate the locked base asset from the token that circulates in DeFi. The underlying collateral is deposited into an ERC-4626-compatible vault and becomes non-circulating within that structure. The vault then issues a corresponding receipt token representing the depositor’s claim on the locked collateral.

Only the receipt token is intended to circulate. The original asset remains inside the vault and cannot simultaneously appear as freely available backing somewhere else.

This separation creates a clear accounting rule:

one locked reserve position should support no more than the permitted amount of circulating receipt tokens.

The structure does not solve every form of off-chain fraud, custody failure, or legal uncertainty. It does, however, prevent an important on-chain weakness: using the same visible collateral both as locked backing and as a freely transferable asset.

What Does It Mean to Lock Collateral?

Locking collateral means transferring an asset into a smart contract whose rules restrict how that asset can be moved.

The asset remains on-chain and visible, but it is no longer freely controlled by the depositor. It can leave the vault only through permitted operations, such as a valid redemption, withdrawal, administrative recovery process, or another explicitly defined action.

For example, an issuer may deposit a tokenized reserve asset into an Afi Protocol Proof-of-Reserve Vault. Once deposited, the base token is held by the vault rather than remaining in the issuer’s ordinary wallet.

The vault issues receipt tokens in return. Those receipt tokens can represent the depositor’s proportional claim on the locked assets.

The two tokens have different functions:

the base asset provides the collateral;
the receipt token represents the transferable claim.

Confusing these roles would weaken reserve accounting. The underlying asset cannot be treated as fully locked if its owner can still transfer it freely while the corresponding receipt tokens remain in circulation.

Why Free Circulation Creates Double-Counting Risk

Double counting occurs when one asset is recorded as supporting more than one independent financial claim.

Suppose an issuer owns 10 million units of an RWA token. It claims that these units back 10 million receipt tokens circulating in DeFi.

If the issuer keeps the original RWA tokens in a freely controlled wallet, it may also:

transfer them to another entity;
deposit them into a second vault;
borrow against them;
provide them as liquidity;
bridge them to another network;
sell them while the first receipt tokens remain outstanding.

The same 10 million units may then appear to support several positions.

The blockchain can see each transaction, but users of the first receipt token may not know that its claimed backing has been moved or reused. The original system might continue displaying an outdated reserve total even though the collateral is no longer dedicated to its liabilities.

Locking the base asset prevents this specific behavior at the smart contract level. The collateral cannot be moved through an ordinary transfer while receipt tokens remain outstanding.

A Simple Double-Counting Example

Consider an issuer with $100 million of tokenized reserve assets.

Without a locking structure, the issuer could use the same assets in the following ways:

claim that they back $100 million of Token A;
deposit them into another system and mint $100 million of Token B;
pledge them to a lender for a separate loan;
continue reporting the original $100 million as available reserves.

The market could see $200 million or more of circulating claims even though only $100 million of underlying value exists.

This does not require an obvious counterfeit transaction. Each individual token contract may function exactly as programmed. The failure occurs because the different systems do not have exclusive claims on the collateral.

A Proof-of-Reserve Vault changes the structure:

the $100 million base asset enters the vault;
the vault takes custody of it on-chain;
the base asset becomes non-circulating collateral;
the vault issues no more than the allowed amount of receipt tokens;
the collateral can leave only when the corresponding receipt claim is removed or redeemed.

The same asset cannot then be deposited into another on-chain vault without first leaving the original one.

How Afi Protocol Separates Collateral From Circulation

Afi Protocol’s Proof-of-Reserve model distinguishes three relevant quantities.

On-Chain Locked Collateral

This is the amount of the base asset physically held in the vault contract. Its balance can be inspected on-chain.

The locked amount demonstrates that the deposited token is no longer circulating freely through an issuer-controlled address.

Attested External Reserves

For an RWA token, the base asset may itself depend on off-chain backing such as custody accounts, securities, commodities, credit positions, or other real-world assets.

Afi Protocol therefore considers external reserve verification in addition to the balance held in the vault.

Locking 100 million units of an under-backed base token would not create $100 million of reliable collateral. The external backing must also be verified.

Circulating Receipt Supply

This is the amount of the ERC-4626 receipt token issued by the vault and available to users or DeFi protocols.

The receipt supply should remain within the amount supported by both the on-chain locked collateral and the verified off-chain backing.

A conservative model can be represented as:

Circulating receipt supply ≤ Safety coefficient × Lower of locked collateral or verified reserves

Using the lower value is essential.

If the vault holds 100 million base tokens but only 80 million units of external reserves are verified, receipt supply should not be based on the 100 million headline deposit.

Conversely, if external reserves total 100 million but only 70 million base tokens are actually locked, the system should not treat the uncommitted 30 million as dedicated vault collateral.

Why the Original Asset Becomes Non-Circulating

The base asset is not destroyed when it enters the vault. It remains visible and forms part of the vault’s holdings.

However, it becomes economically non-circulating because the vault, rather than the depositor, controls its movement.

This prevents the depositor from presenting the same asset in another transaction while continuing to benefit from the receipt tokens already issued against it.

The locked asset effectively changes roles:

before deposit, it is a transferable asset;
after deposit, it is dedicated collateral;
the receipt token becomes the transferable representation of that position.

When a valid redemption occurs, the process reverses. Receipt tokens are burned or removed from circulation, and the corresponding base assets can be released.

This preserves the relationship between circulating claims and locked backing.

Why Burning Receipt Tokens Matters

A secure vault must control both sides of the lifecycle.

Locking collateral when minting receipt tokens is not enough. The system must also remove the receipt tokens when collateral is withdrawn.

Otherwise, a user could deposit an asset, mint a receipt token, withdraw the original collateral, and continue holding the receipt. The same liability would remain in circulation without backing.

A properly designed redemption process follows this sequence:

the user returns or redeems receipt tokens;
the vault calculates the corresponding asset amount;
the receipt tokens are burned or otherwise removed from supply;
the underlying collateral is released.

The precise timing can vary, particularly when a vault uses cooldown periods or delayed settlement. However, the core invariant must remain intact: collateral should not become freely available while the related circulating claim continues to exist.

Why Internal Vault Accounting Is Not Enough

An ERC-4626 vault can accurately record deposits, shares, and redemptions while still relying on a weak underlying asset.

For example, the vault may hold 50 million units of an RWA token and issue exactly 50 million receipt tokens. Its internal accounting appears fully collateralized.

However, the issuer of the underlying RWA token may have only $30 million of real reserves.

This is why Afi Protocol combines on-chain locking with external reserve verification. The vault must examine both layers:

whether sufficient base tokens are locked;
whether sufficient real assets support those base tokens.

Neither condition is sufficient alone.

On-chain collateral without external backing may represent an unsupported claim. External reserves without locked on-chain collateral may remain reusable elsewhere.

Combining the two creates a stronger link between real assets and circulating receipt supply.

Preventing Recursive Minting

Recursive minting occurs when one token is repeatedly reused to create additional tokenized claims.

A simplified cycle may look like this:

Asset X backs Receipt A.
Receipt A is treated as fresh collateral for Receipt B.
Receipt B supports another borrowing or issuance position.
Each layer is described as backed, even though the chain ultimately depends on the same original asset.

Not every use of a receipt token in DeFi is improper. Composability allows legitimate lending, trading, and liquidity strategies. The risk arises when each layer treats the same economic value as independently available reserve capital.

Afi Protocol’s vault structure prevents the original base asset from remaining freely transferable after the first receipt token is issued. It establishes a visible starting point for the collateral chain.

Other protocols must still assess whether accepting the receipt token as collateral creates excessive leverage or circular exposure. Afi Protocol cannot control every downstream use, but it can make the original reserve relationship auditable.

The Difference Between Ownership and Availability

An issuer may legally own an asset without that asset being available as reserve backing.

For example, an asset may be:

locked in another protocol;
pledged to a creditor;
subject to a lien;
committed to pending redemptions;
restricted by a custodian;
used to support another token;
inaccessible because of settlement conditions.

Reserve verification must therefore ask more than whether the asset appears on a balance sheet.

It must ask whether the asset is dedicated, available, eligible, and free from competing claims.

On-chain locking gives a direct answer for the vault layer. The asset’s smart contract balance shows that it has been committed to a specific structure and cannot be transferred arbitrarily by the issuer.

The status of the upstream real-world asset still requires attestations, custody controls, legal analysis, and reliable source data.

Key Benefits of Separating the Two Assets

Clearer Reserve Accounting

Users can distinguish the collateral held by the vault from the token circulating against it.

Reduced Rehypothecation Risk

The depositor cannot freely redeploy the locked base asset while retaining the receipt tokens.

Enforceable Supply Limits

The vault contract can reject minting that would push receipt supply above allowed backing.

Transparent Redemption Logic

Collateral is released only when the corresponding receipt claim is removed.

Better DeFi Integration

External protocols can evaluate a standardized receipt token without assuming that the underlying asset remains in an issuer-controlled wallet.

Easier Monitoring

Observers can compare locked collateral, verified external reserves, and circulating receipt supply.

Risks and Limitations

Locking collateral does not eliminate every form of double counting.

An off-chain custodian may still pledge the same real-world asset elsewhere. An issuer may provide inaccurate reserve data. Related legal entities may have competing claims. A valuation model may overstate collateral. A smart contract may contain vulnerabilities or privileged withdrawal functions.

The receipt token can also be reused in downstream DeFi markets, creating leverage and liquidation dependencies even though the original base asset remains locked.

Users should therefore examine:

who controls the vault;
whether contracts are upgradeable;
which functions can release collateral;
how external reserves are verified;
whether liabilities are counted completely;
how receipt tokens are used elsewhere;
what happens when reserve data becomes stale.

Locking is a strong accounting control, not a universal guarantee.

Why This Matters for Project X and HyperEVM

A receipt token created by an Afi Protocol vault can potentially circulate through broader DeFi markets, including liquidity and portfolio infrastructure.

For applications operating on HyperEVM, the separation between collateral and receipt token provides a clearer asset structure. The underlying reserve stays dedicated to the vault, while the receipt token becomes the instrument available for market activity.

For Project X, this distinction could be relevant when evaluating liquidity pools or portfolio exposure involving externally backed assets. A platform would need to assess not only the receipt token’s trading liquidity but also the vault’s locked balance, reserve proof, safety coefficient, redemption process, and downstream leverage.

No automatic integration should be assumed. The practical benefit depends on whether Project X or another HyperEVM application reads and uses the relevant reserve signals.

FAQ

Why can the underlying collateral not circulate with the receipt token?

Allowing both to circulate independently could create two transferable claims based on the same economic value.

Is the underlying asset destroyed after entering the vault?

No. It remains held by the vault contract as dedicated collateral and can be released through valid withdrawal or redemption rules.

What circulates after the deposit?

The vault issues an ERC-4626 receipt token representing a proportional claim on the locked collateral.

How does Afi Protocol prevent excessive receipt issuance?

The vault can restrict receipt supply according to on-chain locked collateral, verified external reserves, and an applicable safety coefficient.

Can the same real-world asset still be pledged off-chain?

Potentially. On-chain locking cannot independently prevent an external custodian or legal entity from creating competing off-chain claims. Independent reserve verification remains necessary.

Does using a receipt token in DeFi create double counting?

Not automatically. It becomes risky when downstream systems treat the receipt as new independent reserve capital without accounting for the original collateral and resulting leverage.

What happens when a user redeems receipt tokens?

The relevant receipt tokens are removed from circulation, after which the corresponding amount of base collateral can be released according to the vault’s rules.

Conclusion

A reserve asset cannot provide reliable backing if it remains freely available for other uses while a second token circulates against it.

Afi Protocol’s Proof-of-Reserve Vault structure separates these functions. The base asset is locked and becomes dedicated collateral. An ERC-4626 receipt token is issued as the transferable representation of the user’s claim.

This separation helps prevent one on-chain asset from being counted simultaneously as vault collateral and as freely deployable capital. Supply constraints can then compare the circulating receipt tokens with both the locked on-chain balance and the verified external reserves.

The model does not eliminate upstream custody risk, false source data, legal claims, contract vulnerabilities, or leverage created by downstream DeFi integrations. It does, however, create a clear and enforceable accounting boundary.

Before using an Afi Protocol receipt token, examine whether the base asset is genuinely locked, whether the external backing is current, whether every withdrawal burns the related receipt supply, and whether privileged roles can bypass these controls.

Why Afi Protocol Locks RWA Collateral