Over the past 90 days, tokenized U.S. Treasury products added roughly $4.1 billion in on-chain float. Secondary-market turnover on those same instruments did not keep pace. I pulled the transfer logs twice because the first pass looked like a parsing error. A handful of addresses accounted for the overwhelming majority of Transfer events, and the velocity between distinct counterparties was roughly an order of magnitude below what a liquid instrument of that size should show.
So I stopped looking at flow and started looking at code. I downloaded the verified source of the five largest products and diffed their access-control surfaces against each other. Three of the five expose a role that can block any holder's balance from moving. In all three cases that role is held by a single externally owned account. No timelock. No multisig. No upgrade delay. In one of them, the role was granted inside the constructor and never referenced anywhere in the public documentation.
That is the finding. Not an exploit. Every one of these contracts does precisely what it was written to do. The problem is that the market is pricing them as bearer assets when they are, structurally, permissioned database entries with a blockchain attached as the receipt printer.
Context: what is actually inside a tokenized T-bill
The wrapper is remarkably consistent across issuers, which tells you something about how much of this design is legal template rather than engineering choice. A bankruptcy-remote SPV holds the CUSIP. A registered transfer agent maintains the official cap table. The token is a mirror of that cap table, deployed as an ERC-20 with two additions stacked on top: a permission layer and an administrative control layer.
The permission layer exists for reasons that are entirely legitimate. Reg D 506(c) requires verified accredited investors. Reg S restricts offers to non-U.S. persons. Fund-level rules cap illiquid allocations and restrict who may transact at all. An unrestricted ERC-20 would break every one of those constraints on its first transfer to a random wallet. So _beforeTokenTransfer gets a hook, and the hook consults an allowlist.
The administrative layer exists for operational reasons that are equally legitimate and considerably less discussed. Transfer agents must reverse erroneous transfers. Compliance must respond to sanctions designations, court orders, and estate actions. When you audit these systems, the freeze function is not an afterthought bolted on at the end. It is the load-bearing wall of the legal structure. Remove it and the fund cannot be offered to the investors it was built for.
Both layers are necessary. The question worth asking is narrower and far more useful: what is the latency, the authority threshold, and the disclosure of that control surface โ and does the secondary market price any of it?
Here is the part that takes a while to internalize. A tokenized T-bill and a Treasury ETF share the same underlying exposure, but they differ in one dimension that nobody models. ETF shares are bearer instruments in the practical sense: you can sell them to any counterparty on an exchange, and settlement is a clearing-house function. Tokenized T-bills settle in seconds, around the clock, but only to addresses the transfer agent has already approved. You are trading counterparty openness for settlement speed. That trade is real and often a good one. What is not real is the assumption that you kept the bearer property.
NAV compounds the asymmetry. The fund strikes NAV once per business day, typically in the late afternoon New York window, and pushes it to an oracle. Between strikes, the on-chain price of the token is whatever the last trade printed. In a thin permissioned market, that is frequently a stale number from several days back. The token has a price. It does not really have a market.
Core: dissecting the control surface
Here is a stripped-down version of what I found in three of the five, reduced to the parts that matter.