Why the vault standard must be reinvented on B20's principles for financial institutions to go from pilot to production

Institutions put the asset into production onchain and left the vault in pilot, and the container is why. A vault is the container DeFi puts a managed strategy in: assets go in, a share comes out, and a manager decides what happens in between. This summer Coinbase launched tokenized stocks on Base, the network it built, under a new token standard called B20. Two weeks later they stood as collateral in DeFi lending markets, with the issuer's controls still attached. The vault they get deposited into runs on a standard written to make yield tokens easy to integrate. It cannot say who values it. It cannot say who may hold the share, or what the manager is allowed to do. Regulated capital enters a container like that only behind a named firm's word.

B20 put the rulebook inside the token

B20 works because the issuer's controls sit inside the token's interface, where any contract can call them. A transfer is checked against a policy, and a blocked transfer reverts. A stock split or a dividend changes one number, the multiplier. No balance moves. A corporate action can be announced onchain in the same transaction that executes it, and each token carries its ISIN in its own metadata. The issuer can pause transfers, mints and burns separately, and a seize function arrives with Base's Cobalt upgrade.

No venue needed the issuer's sign-off to list it. Base's documentation leaves holding and secondary trading open to any address the policy does not block, and the listing page already names lending markets and yield vaults as venues for its ten tokenized stocks (base.org/stocks, read 21 September 2026). The rules are in the token, so every venue gets them by default.

Five principles did the work

Nothing B20 did is specific to stocks. None of it is new. ERC-3643 has checked transfers against an onchain registry for years. Role-gated pausing is stock OpenZeppelin, and the multiplier follows ERC-8056. B20's contribution is the assembly: all five as a chain's default, with address-level policies where its predecessors asked every holder for an identity. Coinbase chose a blocklist, which is why an unblocked pool needed no onboarding.

Rules are public reads. Any contract can ask the policy registry whether an address may send, receive or execute a transfer before it tries. Compliance becomes a function call.

Rules are defined once and shared. A policy lives in one registry and many tokens point at it, so a single membership update reaches every asset at once. An issuer runs a whole product line from one list.

Powers are named and separated. Pausing, unpausing and administering a policy are distinct roles, seizing joins them at Cobalt, and policy administration changes hands in two steps. Anyone can check which address holds which power.

Change is announced. The announce primitive turns a corporate action into a dated, identified public event. B20 stops at disclosure: its documentation is explicit that an announcement is notice and imposes no delay.

Dynamic assets leave the integrator's accounting alone. The multiplier moves and balances do not, so a pool's balances survive a ten-for-one split untouched. Pricing stays the integrator's job. Every multiplier still reads 1.00. The design has no track record yet.

The vault is where they stop

The vault standard was never asked to carry any of this. ERC-4626 was finalised in March 2022 to "lower the integration effort for yield-bearing vaults". It did exactly that. Every DeFi integrator reads it. Its silence is why it won: a 2022 standard that named a custodian would have been adopted by nobody. Its specification never names a manager, custody, eligibility, valuation, governance or records. The vault reports its own totalAssets, a figure the standard itself calls an estimate "useful for display purposes". ERC-7540 added asynchronous requests and says the unknown exchange rate "requires users to trust the implementation".

Fund law lists the same missing pieces as duties. In the EU an alternative fund's valuation must be functionally independent of its portfolio management (AIFMD Article 19). A depositary, the independent bank that holds a fund's assets, must check the NAV calculation and monitor the investment restrictions (Article 21 and Delegated Regulation 231/2013, Article 95). Since 16 April 2026 an open-ended EU fund must select at least two liquidity management tools, such as redemption gates and extended notice periods. For registered funds, US law covers the same ground through rule 2a-5 on fair value, section 17(f) on custody and the books-and-records rules. A vault built to the letter of ERC-4626 answers none of them.

A B20 asset turns that gap into daily work. A vault holding tokenized stocks has to check the policy before every transfer and stop borrowing while transfers are paused. It has to value the position through a feed that holds its last value whenever the market is closed, and Base's integration guidance reads: "never settle or liquidate against a frozen feed". It has to keep ineligible holders out of its own share, because the token's blocklist knows nothing about the offering's geography. Each duty lands on the manager. The vault standard has nowhere to write them down.

Every regulated fund routes around it

The institutions that went onchain rebuilt the fund outside the vault. BlackRock's BUIDL is a permissioned token with Securitize as transfer agent and BNY as custodian. Centrifuge's fund vaults issue through ERC-7540, but only behind a transfer-restriction list and a share price computed outside the vault. No regulated tokenized fund we read is a plain ERC-4626 vault. None of them needed a standard to satisfy a regulator: a transfer agent, a custodian and an administrator do that offchain, where no contract can read them. That is why these funds are held and rarely composed, and why each new use as collateral starts with a legal review and cannot start with a function call.

DeFi's own frameworks made the same repair. Morpho Vault V2 added four roles, four gates and timelocks, and it reads its positions onchain, which works while every position is an onchain read. Veda checks every manager call against a Merkle root, bounds how far a reported price may move, and pauses outside the band. None of this is careless work: the two hold about $12.6B between them (DefiLlama, 21 September 2026: Morpho $10.72B, Veda $1.88B). Neither re-derives a price that comes from offchain. And no integrator can read both rulebooks through one interface.

A market run on reputation stays a pilot, because reputation is diligenced one team at a time. Of the $72,000 supplied to the Morpho markets on Coinbase's tokenized stocks, 84% comes from one named curator's vault (Morpho API, 21 September 2026), and every allocation into a curated vault is underwritten the same way. One failure shows the cost. Stream Finance suspended deposits and withdrawals in November 2025 after an external fund manager reported a loss to it. Nothing in the vault's interface could have warned a depositor.

The five carry over to the vault

Applied to the vault, the five principles become an interface an institution can diligence once and reuse everywhere.

The vault's mandate becomes a public read. Its investment restrictions are committed onchain, every call is checked against them, and every refusal is recorded with a reason. Exit terms are rules too, and fund law already lists them: requests, gates, notice periods, a side pocket that takes a frozen position out of the share price, and a risk halt that lapses unless confirmed and never blocks an exit. A holder reads them before depositing, the way a pool reads a policy before a transfer.

Put the vault's share on the registry its assets already use. A flag can then freeze one holder, and the issuer no longer has to freeze the pool to reach him.

Named powers is where B20 hands over to fund law. B20 names an issuer's roles and lets one party hold them all. Fund law asks for separation and accepts a functional wall inside one firm. Onchain the wall is an address, so the line can be drawn harder: one party decides, one verifies, one holds. The address that runs the portfolio never prices it, and no decision settles until a verifier independent of manager and issuer has checked it. The depositary and the valuer keep their jobs. They gain a replayable record.

A vault's rule changes get announced with a delay, which is more than B20 asks of an issuer. Changes to the mandate, the verifier set and the fees are timelocked, and every settlement names the program and the block that produced it.

Each of these is an optional layer over ERC-4626 and ERC-7540, so an integrator that reads today's vault still reads this one. Most of it already exists in one framework or another. The properties converged. The interface never did. B20 adds the two that were missing, eligibility at the share and announced rule changes.

One principle B20 never needed

B20 could stop at five because an issuer is a named, regulated party whose discretion is the point. A vault manager's discretion is the risk. The token can prove an address was eligible. It cannot prove the manager valued the book by its stated policy, or checked the pause flag before borrowing. Those decisions are computed offchain.

Verifying them is the sixth principle: verified execution. On the Trustless Execution Network an operator quorum, a group of parties whose machines must agree, re-runs the vault's declared computation from inputs pinned where anyone can fetch them. A result settles only when the re-execution agrees and the outcome satisfies the rules written onchain. Outside the mandate no operator signs, and no single operator's signature settles anything. Re-execution does not make a bad feed true. It makes the feed, the rule and the result checkable by someone other than the manager, and the decision log that remains is one a regulator can replay.

The SEC has now put conditions on code that trades a security: public contracts, synchronous halts, kept records. Its 17 September 2026 exemption for tokenized stock venues (Release 34-106402) is conditioned on smart contracts that are public and auditable, on trading halts applied concurrently with the primary exchange, and on records kept for three years past the exemption's term. It covers US trading venues that opt in and says nothing about vaults. Read it as a preview.

The missing sections are already written

Institutions have already said what they want these shares for: collateral. In December 2025 CFTC staff guidance told futures brokers, clearing houses and swap dealers that a tokenized Treasury or money market fund share keeps its margin eligibility if it passes the existing tests: legal enforceability, segregation and custody, haircuts and valuation, operational risk (CFTC Letter 25-39, 8 December 2025). Those tests read like the vault standard's missing table of contents.

B20's success story is still young. Tokenized stocks total $3.01B across all issuers (rwa.xyz, 21 September 2026). Four weeks after launch, eight of Coinbase's ten stock tokens add up to about $16M on Base (onchain supply at Morpho API prices, same day), and about $126,000 of that stands as collateral on Morpho. Distrust any argument, this one included, that reads scale into a standard four weeks old. B20 proved a regulated asset can enter DeFi with its rules attached. It has not yet proved that size follows.

The vault standard now has to make the manager prove it kept the rules. Priime's version of these layers is open, because no issuer hands its rulebook to a format one firm owns. B20 took one chain and one issuer. Who writes the vault's?