The layer that wakes up real-world assets on Stellar.
Roughly $3 billion of tokenized real-world assets — US and Mexican treasuries, money-market funds, short credit — now live on Stellar, growing about 3× year over year. Almost all of it is idle. Holders earn the base coupon and nothing else: the assets cannot be borrowed against, pooled, or compounded, because the very rules that make them safe in the real world make them incompatible with on-chain DeFi.
Leontief is an adapter layer, not another lending protocol. It wraps restricted RWAs into normalized, freely-composable share tokens — ld-shares — that keep accruing the underlying's native yield, then routes those shares into existing venues: Blend for credit, Aquarius for liquidity. One asset, two jobs, at the same time: still earning, now working.
deposit → mint ld-share at fail-closed NAV → move / borrow / LP → underlying keeps accruing → redeem ≤ deposited + growth
A tokenized treasury is a near-perfect on-chain asset: real yield, real backing, daily NAV. And yet, once it lands in a wallet, it does nothing but sit there. It cannot be posted as collateral, cannot join a liquidity pool, cannot compound. On-chain, it is a beautiful receipt.
This is not a theoretical gap. On Ethereum, roughly $9 billion of tokenized treasuries became active collateral the moment venues accepted them — and issuer AUM measurably followed the new utility (BUIDL rose after exchange-margin acceptance; OUSG rose after its Aave listing). The same assets, the same holders, exist on Stellar today. The rail that makes them useful does not.
Ordinary DeFi assumes an asset that anyone can hold, priced by an on-chain market, with a fixed unit balance. Regulated RWAs violate all three assumptions at once.
A naïve wrapper that ignores any one of these either breaks the asset's compliance, misprices it, or silently dilutes holders across a rebase tick. Leontief is built to respect all three from the first line of code.
Value is unlocked not by moving assets to a new venue, but by making the assets they already hold composable — without breaking a single rule.
Leontief sits one layer below the venues. It does not compete with Blend, Aquarius, or any lending market; it manufactures the collateral they consume. Deposit a restricted asset into its per-asset vault and receive an ld-share: same value, same yield, none of the restrictions. The share is a plain composable token that any Soroban protocol can accept — while the vault keeps every issuer rule intact underneath.
The wrapper itself is not the moat; it is a head start. The durable advantages are three: the permissioned-liquidation design and the issuer relationships it requires; integration gravity, as venues and third-party protocols come to depend on ld-shares; and compliance posture as product, in an era that rewards whoever built with restrictions from day one.
Five small Soroban contracts, each with one job. Everything is i128 checked math; every user-favorable rounding goes to the user, every protocol-owed rounding to the protocol.
Per-asset wrapper that is its own ld-share token (ERC-4626-style, SEP-41 surface). Measures deposits by balance-diff, defends against inflation/donation attacks with a virtual-share offset, and passes yield through to pledged and idle shares identically.
Deploys one vault per underlying at a deterministic address and keeps the registry. Duplicate underlyings are rejected.
Fail-closed NAV. A price is accepted only if it is fresh (within a real-world staleness bound) and within a per-update deviation limit. Anything else halts pricing-dependent operations — no fallback price, ever.
An isolated borrow market for the prototype, with permissioned liquidation. At mainnet, Blend takes over as the credit venue and Leontief ships the price adapter Blend consumes.
Exits — withdraw and repay — are never pausable. A circuit breaker can halt deposits during an incident; it can never trap a user's funds.
Restricted assets can't be seized by anonymous liquidators — a random address taking possession of a gated security is exactly the outcome the issuer's rules forbid. This single constraint is why most of the RWA market by value has no lending rail. It is also Leontief's sharpest edge.
Liquidation is gated by an on-chain whitelist. Only approved, compliant liquidators may act, and only when a position's health factor drops below one. A close factor caps how much of a position a single liquidation may repay, and the seize amount rounds in the protocol's favor. The rejection path — a non-whitelisted caller turned away — is a first-class, tested behavior, not an afterthought.
The prototype proves the mechanism deterministically in its own mini-pool. Production credit stays with the incumbent: at mainnet, ld-shares list as collateral in a dedicated Blend pool, and Leontief's tiered unwind design (liquidator → issuer redemption at NAV → documented backstop) handles the restricted-asset case Blend cannot.
An ld-share is a single number with a rising price. When you deposit, the vault reads the fail-closed NAV, values your contribution, and mints shares floored in your favor. When you withdraw, it converts your shares back to underlying at the current NAV, floored in your favor, and burns before it transfers.
share_price = (V + VIRT) · SCALE / (S + VIRT)
rebase asset → balance grows → V rises → price rises
accrual asset → NAV grows → V rises → price rises
Because the price is defined on total value, growth reaches every holder equally — whether their shares sit in a wallet or are pledged as collateral in a pool. Yield-while-pledged is therefore a property of the accounting, not a feature that has to be maintained. A direct donation to the vault raises the price for everyone and mints nothing; a one-stroop attacker cannot profit from a victim's first deposit.
Stellar is where this specific supply is arriving. It hosts the largest and fastest-growing concentration of exactly the instruments people borrow against elsewhere — treasuries, money-market funds, short credit — and its native asset model (classic assets reachable through the Stellar Asset Contract, with real authorization flags) makes compliance a first-class primitive rather than a bolted-on afterthought.
The tailwind is structural: the Stellar Development Foundation targets around a further billion dollars of asset growth in 2026, and DTCC's Stellar tokenization work lands in 2027. Supply keeps arriving on a utility layer that does not yet exist. Soroban — Rust smart contracts with deterministic execution and explicit state-archival — gives Leontief the safety surface to build that layer conservatively.
Leontief is infrastructure, not a destination app. It is tokenless by design — no token is required or planned, and revenue is real-yield-linked and non-inflationary. The fee switch ships off at mainnet for a clean audit and a clean launch narrative; activation is a pre-announced governance event, hard-capped in code.
At a 20 bps management fee alone, $50M of wrapped AUM is $100K/yr; the uplift share at scale is comparable or larger. Break-even for a lean team sits around $60–90M AUM with both streams on — aggressive for year one, plausible in year two against a $3B+ and compounding base.
The full loop on testnet: restricted asset → wrapped share → borrow → yield-while-pledged → permissioned liquidation, proven by the public five-beat demo.
Two to three assets under conservative per-asset caps, 2-of-3 multisig admin, fail-closed oracle live, fee switch off.
Blend pool accepting ld-shares at launch; Aquarius liquidity; the fee switch turned on at demonstrated utility.
A SEP-57 pilot with one permissioned issuer — the step that opens the BENJI-class majority of the market by value.
Leontief holds user funds, so it is engineered to fail safe, and its risks are stated plainly.
The target is stated without hedging: zero loss events, ever.
The near-term serviceable pool is the openly-transferable RWAs on Stellar. Wrapping even a small fraction is a meaningful first book of business.
The prototype demonstrates the full loop on a purpose-built restricted demo asset, LEOD, issued with real authorization flags so the compliance path is proven end to end before any real asset is touched.