Section 1. The primary token architecture design decision
This decision precedes every other item in this document and should be settled before technical work begins. It determines the liquidity venues available to the asset, the breadth of wallet and custodian support, and the range of compliance logic that can be expressed.How to approach the decision
A classic Stellar asset is the faster and simpler route to issuance, but the choice rests with the issuer. A classic asset is settled at protocol level, requires no bespoke code, is tradeable on the built-in order book and liquidity pools*, and is generally supported across a broader, pre-existing set of wallets, exchanges, custodians, and other integrations without additional integration work. A contract token offers materially greater flexibility, at the cost of a longer build, an audit requirement, and narrower ecosystem support (support for contract tokens is expanding currently). A frequent misconception is that a custom contract token is necessary in order to use smart contracts, but it is not. A classic Stellar asset accessed through the Stellar Asset Contract is automatically compliant with the SEP-41 token interface and operates inside Smart contracts. The underlying classic Stellar Asset and its SAC are the same asset: G-address balances remain trustline balances, while C-address balances are held in SAC contract storage. Before selecting a contract token, also consider extensions available to a Stellar Asset. SEP-8 can add off-chain, per-transaction approval for regulated transfers, and a custom SAC administrator can delegate privileged SAC actions to a G- or C-address while issuer-account authority remains a separate control path. A SEP-41 contract token is appropriate when the token itself needs custom behavior that the SAC cannot express; SEP-57/T-REX is a standardized SEP-41-based framework for permissioned RWAs with pluggable identity and compliance. The consideration that most often points towards a contract token is a compliance rule that the four issuer flags cannot express: a maximum holder count, a jurisdiction-conditional transfer restriction, a lockup period, or on-chain identity attestation. Where none of these apply, the classic route will generally reach production sooner and with fewer dependencies. Four pathways are shown below for decision-making, but they are not four independent token types. A and B are two interaction paths for the same Stellar Asset; anyone can deploy the asset’s reserved SAC later, so native issuance does not close the smart-contract path. SEP-8 and custom SAC administration can be layered onto a Stellar Asset where needed. C is a general SEP-41 contract-token model, while D (SEP-57/T-REX) extends SEP-41 with a regulated-asset framework. See Assets Overview and Comparison for the maintained side-by-side comparison:- A. Stellar asset (account issued, G…). Behavior enforced at protocol level by the four issuer flags ( Authorization Required controls who may hold the asset; Authorization Revocable allows authorization to be withdrawn/frozen; Clawback Enabled permits eligible balances to be reclaimed; Authorization Immutable permanently restricts future changes to authorization settings), holders opt in through a trustline, no bespoke code. Fits payments, remittances, fiat-backed stablecoins, and any regulated instrument whose transfer rules are a static approve or reject decision. Broadest ecosystem support.
- B. Stellar asset with the Stellar Asset Contract. The same asset as A, made callable from Soroban contracts through the protocol-maintained SAC, and automatically satisfying the SEP-41 interface. Fits any option A asset that also needs to be used inside smart contracts, for example as DeFi collateral. This is the default wherever composability was the only reason a contract token was being considered.
- C. Contract token on the SEP-41 interface (C…). Balances in contract storage, no trustline, typically built on the audited OpenZeppelin fungible token. Fits Custom token behavior beyond SAC capabilities, without requiring the full SEP-57 identity and compliance framework: a transfer fee, a supply cap enforced in code, token factory logic. Support is secured through integration by integration.
- D. Contract token on SEP-57 / T-REX. A permissioned security token, per SEP-57, with identity registry, trusted claim issuers and modular compliance. Reference implementation: the OpenZeppelin RWA token suite and RWA Wizard. Fits compliance rules the issuer flags cannot express: maximum holder count, jurisdiction-conditional restrictions, lockup periods, holding limits, on-chain identity attestation.
What each capability actually applies to
Capabilities are frequently described as properties of Stellar when they are properties of one architecture. The matrix below states, for each control, which option provides it and by what mechanism.- A. Stellar asset
- B. Stellar asset + SAC
- C. SEP-41 token
- D. SEP-57 token
Section 2. Decisions that cannot be reversed after launch
Some Stellar Asset settings are non-retroactive, and some administration choices can permanently constrain future control paths. Treat the items below as a pre-launch checklist: document the intended holder model, issuer flags, SAC administration and migration path, then rehearse them on Testnet before Mainnet.Clawback must be enabled before any trustline exists
On options A and B, the clawback-enabled flag applies only to trustlines created after the flag is set, and it requires authorization revocable to be enabled as well. That does not change an existing trustline. If settings and holder cooperation permit, a holder can empty and remove an existing trustline and recreate it after clawback is enabled. Otherwise, migration may require reissuance/token swap. Clawback should therefore be decided before distribution whenever it may be required. Separately, authorization immutable permanently locks the remaining flags and prevents the issuing account from being merged. See Control asset access and Clawbacks.Migration between asset models is not a configuration change
Changing architecture after launch may require issuing a new asset, migrating every holder and executing a token swap or redemption and reissuance. Before architecture selection, obtain confirmation from the wallets, exchanges and custodians expected in the distribution chain that they support the exact Stellar Asset or contract-token model and required control flows. Network support for XLM does not imply support for a given asset, and support for Stellar assets does not imply support for contract tokens.Section 3. The integration stack
Seven layers. Not every issuer requires every component. Section 4 sets out the requirements by asset type.Layer 1. Asset and issuance
Layer 2. Keys, custody and account control
Layer 3. Custody and safekeeping
Layer 4. Compliance and identity
Layer 5. Data, oracles and attestation
Layer 6. Distribution and liquidity
Layer 7. Assurance and visibility
Section 4. Requirements by asset type
Requirements vary by jurisdiction and by the method of distribution. This table represents the starting position for a scoping discussion and does not constitute a compliance opinion. Issuer authority should be designed for the chosen architecture.
Highly recommended, to be planned from the outset. Recommended, expected by most counterparties. Situational, dependent on distribution and jurisdiction. Rarely required.
Note on issuer key controls. Multisig is not mandated by the Stellar protocol and a single master key is technically sufficient. What is required in practice is a deliberate key-control scheme for the accounts holding issuance authority. On the classic path this is implemented through weighted signers and operation thresholds at account level. On the contract token path, minting authority rests with the contract administrator, which may itself be an account or a further contract, and control is exercised through the contract’s administrator or role model.
Section 5. Reference documentation
The materials below constitute the recommended reading for an issuing partner’s technical and compliance teams. Specifications marked Draft may change and should be confirmed before development work is committed against them. Start here- Assets Overview and Comparison. Both asset models compared, with trustlines and compliance options. The primary orientation document.
- Issuing Assets vs. Creating Custom Tokens. The design decision in Section 1, stated directly.
- Guidebook for Asset Tokenization. Commercial overview for legal and business stakeholders.
- Tokenized Investment Assets. Asset class context and existing precedents on the network.
- Issue an Asset on Stellar. End-to-end tutorial covering issuer and distributor separation, trustlines, minting and distribution.
- Custom SAC administration. How to delegate SAC administration to a G- or C-address and how issuer-account locking interacts with SAC admin authority.
- Asset Design Considerations. The four issuer flags in detail, and the transaction-level authorization pattern.
- Clawbacks. Operations, regulatory use cases and worked code examples.
- Signatures and Multisig. Weighted signers, operation thresholds and alternative signer types.
- Volta Circuit. Example of a contract-based vault
- Stellar Asset Contract. How a classic asset becomes usable within Soroban contracts.
- Create Contract Tokens on Stellar. The contract token interface, and the event shape difference affecting downstream indexers.
- SEP-41 Soroban Token Interface Standard fungible-token interface. Administration is intentionally implementation-specific; mint and clawback methods are not required by the interface.
- OpenZeppelin Stellar Contracts. Audited primitives with AllowList, BlockList and Capped extensions.
- Publishing Asset Information. Required contents of the information file. A prerequisite for listing.
- SEP-1 Stellar Info File The specification for the file hosted at /.well-known/stellar.toml.
- SEP-14 Dynamic Asset Metadata Removes the file size ceiling for issuers carrying many tickers.
- SEP-46 Contract Meta . Standard for metadata embedded in contract Wasm; useful for contract provenance and interface/source metadata.
- SEP-8 Regulated Assets Approval server protocol for per-transaction issuer approval.
- SEP-57 T-REX Permissioned tokens with modular compliance, adapted from ERC-3643.
- Full SEP index. Including SEP-6, 9, 10, 12, 24, 30, 31 and 38.
- Developer Tools. Index of SDKs, the Stellar CLI, Lab and Quickstart.
- Horizon API. Classic ledger data, nearing end-of-life
- Stellar RPC. Recommended starting point for real-time network access and smart-contract interaction. Required for contract deployments.
- API and RPC providers. Including which providers retain full Horizon history.
- Oracle providers. Directory of oracle services operating on the network.
- SEP-40 Oracle Consumer Interface The common oracle interface, which makes feeds interchangeable.
- Hubble analytics dataset. Full historical network record through BigQuery.
- Block Explorers | Stellar Docs Explorer discovery
- Soroswap Token List Curated asset lists
- StellarExpert asset-list catalogue Curated asset lists
- Anchor Platform. For issuers operating their own fiat ramp.
- Wallet Integration / Stellar Wallet Kit. Maintained wallet integration options and the multi-wallet Stellar Wallet Kit.
- Stellar Anchor Directory. For issuers selecting an anchor partner.
- Liquidity on Stellar. Order book, automated market maker pools and path payments.
- Soroban Audit Bank. Audit cost support for eligible projects.
- Security best practices. Hardening guidance for issuer-operated systems.