RWAs as DeFi Collateral: The Oracle and Liquidity Problem

Why lending venues want RWAs

RWAs bring three things lenders want: collateral that barely moves in price, yield that keeps accruing while it is pledged, and new deposits from holders who would otherwise leave them idle. Tokenised Treasury funds alone held $14.75B onchain as of 2 October 2026, per rwa.xyz.

For a borrower, posting a tokenised money fund instead of USDC means earning roughly the T-bill rate on the collateral — rwa.xyz showed a 3.6% seven-day yield across tokenised Treasury funds on 2 October 2026 — while borrowing against it. For a venue, it is a large pool of assets looking for a use. Centralised exchanges got there first: Binance from February 2026 and Bybit from September 2026 accept Franklin Templeton's Benji shares as off-exchange collateral, per crypto.news. For the wider demand picture, see why demand for tokenised RWAs is growing.

DeFi venues face the same attraction with an extra difficulty: they need a price they can trust, in code, every few seconds, and a way to sell the collateral if a loan goes bad.

The pricing problem: NAV versus market

An RWA has two prices: the NAV its issuer calculates offchain, typically once a day, and whatever an onchain market says. NAV is hard to manipulate but slow and depends on the issuer's reporting. The market price is live but, for most RWAs, set by very little trading.

Price source	Strength	Weakness
Onchain market (DEX, AMM)	Live, reflects what the asset can actually be sold for	Thin markets can be pushed with small trades
Issuer NAV feed	Hard to manipulate onchain; matches redemption value	Updates slowly; relies on issuer reporting; ignores whether you can actually sell
Both, cross-checked	Each guards against the other's failure	More moving parts; venue must decide what happens when they disagree

Pricing models add a twist. Some funds keep a fixed $1.00 share price (Franklin's FOBXX targets $1.00 per its prospectus); others, such as Etherfuse's USTRY, let the token price rise as income accrues. A feed that assumes $1 will misprice the second kind, and a tight band around a rising price needs updating over time. See tokenised money market funds compared for which funds use which model.

Liquidity and redemption delays

A lender's last line of defence is liquidation: selling the collateral before it is worth less than the loan. For RWAs that sale has two routes, both imperfect: a thin onchain market that punishes size, or redemption with the issuer, which often requires eligibility and keeps banking hours.

The numbers on Stellar make the point. On 2 October 2026 Aquarius's USTRY/USDC pool held about 1.02M USTRY and 1.10M USDC, around $2.28M in total. By our calculation from those reserves, selling 250,000 USTRY into it — the size of XOXNO's whole USTRY supply cap — would realise about 20% less than the spot price. A liquidator facing that loss needs a bonus at least that large, or will not act.

Redemption is the other route, and it has its own frictions. Franklin's FOBXX processes purchases and redemptions on business days during normal hours, per its prospectus. BlackRock's BUIDL has a 3pm ET cut-off, per rwa.xyz. Many funds will only redeem for approved holders, so a liquidation bot cannot simply redeem what it seized. Permissioned tokens such as BENJI, whose Stellar issuer requires authorisation for every holder, cannot be held by a permissionless lending contract at all unless the issuer approves it.

Case study: YieldBlox and USTRY

On 22 February 2026 an attacker drained more than $10M from the YieldBlox pool on Blend. The pool accepted Etherfuse's USTRY as collateral and priced it via Reflector from the USTRY/USDC market on the Stellar DEX. The attacker pushed that market from about $1.06 to about $107 and borrowed against the inflated value.

BlockSec's analysis sets out the sequence. The USTRY/USDC order book was nearly empty; Cointelegraph described it as a market with less than one dollar in hourly trading volume. The attacker cleared the normal orders and placed abnormal ones, the Reflector feed reported the new price, and the pool valued USTRY collateral at about a hundred times its NAV. The attacker borrowed about 1M USDC and 61M XLM and bridged funds to other chains.

Every element of the RWA pricing problem was present:

• Market price with no market. The feed read a venue where a single actor could set the price.
• No sanity bound. A Treasury note token worth about $1.06 was accepted at $107. A band check against NAV would have rejected it.
• No cross-check. No independent NAV source was consulted.

BlockSec was clear that this was "a pool-operator (YieldBlox DAO) configuration failure, not a Blend V2 core-contract flaw". USTRY itself did nothing wrong. The full account, including the backstop losses, is in Blend's 2026 incidents, explained, and the broader failure class in DeFi risks.

How venues mitigate it

The tools are well known: cap how much of an RWA can be deposited, make it collateral-only so it cannot be borrowed, set loan-to-value well below what its volatility alone would justify, price it from NAV feeds cross-checked against market prices, and reject any price outside a plausible band.

• Supply caps limit the damage if pricing fails, and keep positions small enough to liquidate through the available market.
• Collateral-only listing stops anyone borrowing the RWA inside the venue, which removes one route to shorting or cornering it.
• Conservative LTVs and liquidation bonuses sized to the cost of actually selling, not to the asset's price volatility.
• NAV ("fundamental") feeds from oracle providers that report the issuer's calculated value. RedStone launched on Stellar after the YieldBlox exploit, including a BENJI feed, per Cointelegraph.
• Cross-checks and hard bounds: require market and NAV sources to agree within a tolerance, use time-weighted averages rather than spot, and reject prices outside fixed limits.

None of this is free. Caps and low LTVs make RWA collateral less useful; hard bounds must be updated as accruing tokens rise; NAV feeds move trust from markets to issuers and oracle operators.

Stellar examples

XOXNO Lending's published mainnet configuration for Stellar applies all of these tools. Its separate RWA markets list Etherfuse's USTRY and CETES, Ondo's USDY, Centrifuge-issued Janus Henderson JTRSY and Matrixdock gold as collateral-only, with caps, NAV-based feeds and hard price bounds. A Spiko market is configured but disabled.

Asset (XOXNO config)	LTV / liq. threshold	Supply cap	Price source
USTRY	60% / 70%	250,000 USTRY	Reflector 3-period TWAP × USDC, cross-checked with RedStone fundamental (±5%); bounds ~$0.98–$1.16
CETES	60% / 70%	1.5M CETES	Same design; bounds ~$0.062–$0.072
USDY (Ondo RWA market)	80% / 85%	300,000 USDY	RedStone fundamental (NAV) feed; bounds $1.08–$1.32
JTRSY (deJTRSY)	60% / 70%	100,000 deJTRSY	RedStone fundamental (NAV) feed; bounds $0.99–$1.21

XOXNO also accepts the Aquarius USTRY/USDC, CETES/USDC and USDY/USDC LP tokens in a separate market, at 50% LTV, a 60% liquidation threshold and a 10% liquidation bonus, with caps of 500 LP tokens each. Their price comes from the pool's reserves valued with the venue's own token prices, rather than from the pool's spot price, and the feed refuses to price a pool worth less than $1M. Pricing an LP from reserves and independent prices, not from the ratio inside the pool, is what stops a single swap from inflating it.

The contrast with YieldBlox is direct. A USTRY price of $107 would be rejected by XOXNO's bound long before any cross-check. All of these assets are collateral-only — borrowable assets in those markets are USDC, XLM, EURC and PYUSD — and the USTRY cap is small relative to Aquarius depth. XOXNO's configuration was last changed on 22 September 2026; parameters can change through its governance, and DefiLlama showed only about $123K of XOXNO Lending TVL on Stellar on 2 October 2026, so this is a design to study rather than a large market.

The Etherfuse side is covered in Etherfuse Stablebonds on Stellar; for LP tokens as collateral on the same venue, see borrowing against Aquarius LP tokens; and for how Blend pools are configured, what is Blend.

The takeaway

RWAs make sense as collateral only when the venue prices them like what they are: assets with a slow, issuer-reported value and very little onchain liquidity. The questions are the same for every pool. Where does the price come from? What stops an implausible price? How much is deposited, and could it be sold? YieldBlox answered none of them; the more recent Stellar configurations answer all three, at the cost of making RWA collateral smaller and less exciting.

Sources: BlockSec, "YieldBlox DAO Incident on Stellar: Oracle Misconfiguration Enabled a $10M+ Drain"; Cointelegraph via TradingView on RedStone's Stellar launch; XOXNO rs-lending-xlm, configs/mainnet/spokes.json and markets.json (last changed 22 September 2026); Aquarius AMM API (USTRY/USDC pool reserves, 2 October 2026); rwa.xyz (2 October 2026); Franklin OnChain U.S. Government Money Fund summary prospectus (1 August 2025); crypto.news (28 September 2026); DefiLlama (xoxno-lending).