Summary
This document is the technical review behind the initial parameters proposed for the tokenized equities market on Aave V4 Base. It covers the legal structure of the certificates, the issuance and redemption mechanics, the token standard and the issuer’s onchain contracts, the handling of corporate actions, and the behaviour of the price feed.
The market initially lists the Magnificent Seven US technology stocks in their Coinbase B20 form (AAPLc, AMZNc, GOOGLc, METAc, MSFTc, NVDAc, and TSLAc) as collateral in a dedicated Equities Hub, with USDC as the only borrowable asset. Each token is a certificate over shares held in segregated custody under a bare trust governed by ADGM law, offered under a public prospectus approved by the ADGM Financial Services Regulatory Authority. Holders who acquire the tokens on the secondary market hold them as unvested holders with economic exposure but no redemption right until they complete the issuer’s vesting process.
1. Legal Structure
Expand the legal structure review (sections 1.1 to 1.7)
The review is based on the prospectus, the terms and conditions and the deed of trust of the NVIDIA certificates. The seven tokens are issued under the same programme by the same issuer, and the analysis applies to each of them.
1.1 Jurisdictional Compliance
The offering document is a public prospectus, approved by the FSRA on 4 August 2026 (the “Prospectus”) “under section 61(2) of FSMR and section 4.6.2 of the Market Rules” (Prospectus, cover, p. 1), and valid until 3 August 2027 — after which continued primary issuance requires renewal — and obliges the Issuer to publish an FSRA-approved supplement on any significant change or material mistake (Prospectus, Validity of Prospectus, p. 2). The Issuer and both Directors accept responsibility for its contents without qualification (Prospectus, §1.1, p. 20). These are favourable features, though approval is not endorsement: the ADGM “does not accept any responsibility for the content” (Prospectus, cover, p. 1).
The Prospectus itself settles the classification of the vested instrument: the Securities “constitute ‘Certificates representing certain Financial Instruments’” under paragraph 92 of Schedule 1 of FSMR and are deemed securities by the FSRA “pursuant to a written determination under section 58(2)(b) of FSMR” (Prospectus, Summary C, p. 14; §13, p. 68).
The unvested position carries a second, distinct classification: Unvested Securities “constitute ‘Rights to or interests in investments’” under paragraph 98 of Schedule 1 and “are also deemed to be ‘securities’” (Prospectus, §13, p. 68). The Coinbase DDQ response asserts the opposite — that this category “is not itself listed as a Security type” so no prospectus obligation arises (Coinbase DDQ response, Q3). The same DDQ response inverts the Prospectus on the on-chain token: the Prospectus states the tokens “do not constitute separate securities or independent financial instruments” (Prospectus, §12.8(b), p. 59); the DDQ response asserts “the on-chain token itself is a separate security / independent financial instrument” (Coinbase DDQ response, Q8). The token-status consequences are treated in the title and transfer-restriction sections of this examination.
The Issuer’s follow-up response confirms that Securities held by an Unvested Holder “constitute ‘Rights to or interests in investments’” — adopting the Prospectus’s paragraph 98 classification and, in substance, withdrawing the earlier Q3 analysis (Coinbase DDQ response (2), item 1).
The regulatory perimeter covers the offering and one service provider, not the Issuer. Nowhere is Coinbase Onchain SPV Ltd described as licensed, authorised or exempt; it is an SPV with no employees whose only activity is issuing Digital Securities (Prospectus, §3.2, p. 21). The Coinbase DDQ response calls it an “Unregulated SPV” (Coinbase DDQ response, Q2).
The single regulated ADGM node is Onchain Marketplace Ltd, “authorised by the FSRA to carry on the regulated activities of Arranging Deals in Investments and Providing Custody (restricted to operating a Central Securities Depositary)” (Prospectus, §3.5(b)(i), p. 22), which operates the Relevant System and is the declared Reporting Entity. Favourably, the definitive record of legal title sits inside an FSRA-supervised depositary subject to intraday reconciliation consistent with COBS 10.3.3 (Prospectus, §12.8(c), p. 60); but the permission is narrow, Onchain Marketplace Ltd does not custody the underlying shares. At the asset layer, Alpaca Securities LLC “is an SEC-registered broker-dealer and a member of FINRA and the SIPC” (Prospectus, §3.5(b)(ii), p. 22), contractually bound to remain so (Prospectus, §10(ii), p. 51), and the Issuer’s right to demand return of the shares is “an absolute right preserved under SEC Rule 15c3-3” (Prospectus, §4.5(d), p. 36). Pass-through SIPC protection for Holders in an Alpaca insolvency is expressly uncertain: “neither SIPC’s rules nor its published guidance directly address this novel custody structure” (Prospectus, §4.7(d), p. 41).
The Securities are not, and are not expected to be, admitted to trading on any exchange or trading facility anywhere (Prospectus, §13.1, p. 69); they are “solely transferable and traded through DeFi Markets,” which “are not currently regulated in the ADGM” (Prospectus, Summary C, p. 16); and secondary trading “does not constitute participation in the Offer and is not subject to the Offer perimeter” (Prospectus, §4.7(b), p. 39). The Issuer “has not entered into any formal market making or liquidity provider arrangement” and takes no responsibility for one (Prospectus, §13.2(a), p. 70); there is no stabilisation (Prospectus, §13.3, p. 70); and Holders “may have no legal remedies or practical recourse” against market interference (Prospectus, §4.2(f), p. 27).
The Securities are unregistered under the U.S. Securities Act, and the prohibition is absolute and perpetual: they may not be acquired, held, sold, transferred or delivered, directly or indirectly, in the United States “or to, or for the account or benefit of, any ‘U.S. Person’”, and all secondary dealings must occur “in offshore transactions in reliance on Regulation S” (Prospectus, §14.1(a), p. 72). Every acquirer is deemed to represent that it is not a U.S. Person, is outside the United States, and is not acquiring for one; the Deed of Trust dated 4 August 2026 (the “Deed of Trust”) recites the same reliance (Deed of Trust, recital (B), p. 103). Unexplained, the cover applies two different tests — Regulation S “U.S. Persons” for the offer, but CFTC-defined “Non-U.S. Persons” for onward delivery (Prospectus, cover, p. 1).
Enforcement rests on restrictions “embedded in the Security’s smart contract” and binding on all transferees (Prospectus, §4.4(b), p. 31), on blockchain analytics, and on the freeze power — and the Prospectus concedes their limits: “Notwithstanding these restrictions, a Security could be transferred on a peer-to-peer basis or through DeFi Markets” to prohibited persons (Prospectus, §4.7(b), p. 39).
The primary offer is made in the ADGM exclusively to Authorised Participants, each a Professional Client under COBS 2.4 or a Market Counterparty under COBS 2.5, approved by the Issuer in its absolute discretion (Prospectus, Summary D, p. 17); in the secondary market, Authorised Participants “may make Securities available in DeFi Markets, including to retail investors” (Prospectus, §13.1, p. 69). Every secondary acquirer takes as an Unvested Holder with no redemption, voting or information rights — “The Issuer will not recognise any Holder as having any rights whatsoever” until vesting (Prospectus, p. 3) — and vesting is determined by the Tokenisation Entity on the Issuer’s behalf, final and binding absent manifest error, and revocable at any time (Terms and Conditions, Condition 2.4(c) and 2.4(e), pp. 81–82). Every liquidation counterparty will therefore stand, on acquisition, in the weakest class the structure recognises; exit runs through a discretionary compliance gate with no committed timeline anywhere in the reviewed material. We take no view on whether any particular holder would satisfy the Vesting Conditions.
The Issuer’s follow-up response adds the practical record: no liquidator, enforcement agent or lending protocol’s liquidation contract “has not yet been permitted to Vest” [sic]; expected processing time is described as “short”, with no service standard or outer time limit committed; onboarding discretion is expressly retained; and the Issuer offers to “discuss the process of potentially onboarding … liquidation contract” or partnering with an existing Authorised Participant for that purpose (Coinbase DDQ response (2), item 2).
The offer exists only in the ADGM: “no action has been or will be taken by the Issuer that would permit a public offering” anywhere else (Prospectus, §14.1, p. 71); every acquisition must comply with local law without imposing any obligation on the Issuer; and the Issuer reserves an unbounded right “to impose additional restrictions” by jurisdiction, person, wallet, venue or settlement system (Prospectus, §14.1(d), pp. 72–73). Transfers to jurisdictions where the offer was never made “could result in the Securities being frozen at the smart contract level” (Prospectus, Summary C, p. 17). No country-by-country selling restriction schedule exists, and no analysis addresses the lawfulness of holding the token in the European Union, the United Kingdom or elsewhere.
1.2 Bankruptcy Remoteness
The separation architecture rests on a single instrument, the Deed Poll and Declaration of Trust dated 4 August 2026, published in full as Annex 2 to the Prospectus and executed by the Issuer as Trustee “IN FAVOUR OF: THE REGISTERED OWNERS AND UNVESTED HOLDERS” (Deed of Trust, preamble, p. 103). It declares two trusts. First, the Trustee “holds all Deposited Property on trust as bare trustee” for the Registered Owners from time to time (Deed of Trust, cl. 3.1, p. 104), the Deposited Property capturing the NVIDIA shares and everything received in respect of them (Deed of Trust, cl. 1.1, pp. 103–104). Second, where the Trustee is itself registered as owner of Unvested Securities, it holds “the legal title and all Beneficial Interests attaching” to them as bare trustee for the Unvested Holders (Deed of Trust, cl. 4, p. 105). Each Beneficial Interest is “a pro rata equitable interest in the Deposited Property as a whole” (Deed of Trust, cl. 1.1, p. 103).
The Deed is governed by ADGM law with exclusive ADGM jurisdiction (Deed of Trust, cll. 15–16, p. 107); as a deed poll, each beneficiary “may severally enforce the obligations of the Trustee” directly (Deed of Trust, cl. 11.2, p. 106), and the trust and segregation “continue throughout any such redemption, termination or wind-down” (Deed of Trust, cl. 14.3, p. 107).
The Deposited Property “shall be segregated from, and shall not form part of, the proprietary assets of the Trustee” (Deed of Trust, cl. 3.5, p. 105), and the custodian, Alpaca Securities LLC, must hold it on trust for the Trustee, identified in its books, segregated from Alpaca’s own assets “and, so far as practicable, from the assets of the Custodian’s other clients” (Deed of Trust, cl. 9.2, p. 106). Per the Prospectus’s summary of the Institutional Account Agreement, the custodian “is not permitted to engage in any securities lending”, “shall have no right to assert any applicable rights of lien”, and deposits “will not expire in the event of loss of capacity to act or bankruptcy” of the Issuer (Prospectus, §10(ii), p. 51). The custody accounts stand in the Issuer’s own name, and the Issuer’s right to demand return of the shares is “an absolute right preserved under SEC Rule 15c3-3” (Prospectus, §4.5(d), p. 36).
Under the Deed, all claims of Registered Owners and Unvested Holders “under this Deed, however arising, are limited in recourse” to the Deposited Property and its proceeds; no claim lies against the Trustee’s other assets, and once the property is realised and applied, “any outstanding claim of a Registered Owner or Unvested Holder shall be extinguished” (Deed of Trust, cl. 12.2, p. 106). The Prospectus asserts the proposition more broadly: “The Issuer’s obligations to Holders are limited recourse” (Prospectus, §6.3(d), p. 47).
The bankruptcy statement is expressly conditional: “subject to the validity of the bare trust arrangements”, the Deposited Property and Unvested Securities will not form part of the Issuer’s assets in an insolvency, and Registered Owners and Unvested Holders “are not creditors of the Issuer” in the ordinary course (Prospectus, §16.6, p. 77). The risk factors concede the central vulnerability in terms: creditors “may apply to a court to challenge or set aside the trust structures”, and proceedings may leave the property “being frozen” with delayed redemptions (Prospectus, §4.7(a), p. 39; Summary, p. 17).
1.3 Title and Ownership
Title runs through five links across three legal systems. First, NVIDIA common stock is held by Alpaca Securities LLC in “segregated Custody Accounts in the Issuer’s name” (Prospectus, §4.5(d), p. 36); the Issuer “holds a beneficial interest in the Underlying” through the custodian (Prospectus, §12.10(b), p. 63) — in United States terms an account holder with an intermediated claim, not the shareholder of record. Second, the Issuer holds all Deposited Property as bare trustee for the Registered Owners under ADGM law (Deed of Trust, cl. 3.1, p. 104). Third, legal title to each Security belongs to its Registered Owner, “the person in whose name legal title” is registered in the Legal Register (Terms and Conditions, Condition 23.1, p. 99). Fourth, for every Security whose holder has not passed vesting, the Registered Owner is the Issuer itself, holding on a second bare trust for the Unvested Holders (Prospectus, §12.8(c), p. 59; Deed of Trust, cl. 4, p. 105). Fifth stands the Holder, defined purely operationally as “the person controlling the Wallet” in which the tokens sit (Terms and Conditions, Condition 23.1, p. 98).
The structure’s central design choice is that the token is not the record of ownership. “Legal title to the Securities shall be recorded exclusively by registration in the Legal Register” (Terms and Conditions, Condition 2.2, p. 80); the Legal Register is “the definitive and exclusive record of legal title” (Prospectus, §12.8(c), p. 59). Dealings on any blockchain, wallet or smart contract “shall not create, transfer, evidence, or extinguish legal title” except as reflected in the register, and wherever the two records diverge, “the Legal Register shall prevail” (Terms and Conditions, Condition 2.2, p. 80) — even mid-investigation: “Pending resolution, the Legal Register prevails” (Prospectus, §12.8(c), p. 60). Token possession passes on-chain; legal title passes “solely upon registration in the Legal Register” (Terms and Conditions, Condition 3.2, p. 82). When possession and register entry diverge — hack, erroneous transfer, register error, contested liquidation — the wallet-side party loses on the face of these provisions; the Tokenisation Entity may rescind transfers, cancel Securities, demote vested holders or freeze positions, “in each case with or without payment” (Prospectus, §14.2(a), p. 73).
The reconciliation between the two records is disclosed only as a fact: the Tokenisation Entity “carries out intraday reconciliation procedures in its capacity as CSD” (Prospectus, §12.8(b), p. 59). The Prospectus itself concedes that the Legal Register “does not benefit from the transparency and real-time verifiability” of a public blockchain (Prospectus, §4.5(e), p. 36).
Only Vested Holders — those who have satisfied the Vesting Conditions “as determined by the Tokenisation Entity” (Terms and Conditions, Condition 23.1, p. 100) — may exercise rights attaching to the Securities (Terms and Conditions, Condition 2.4(a), p. 80). “Unvested Holders shall not be entitled to redeem Securities or withdraw Underlying” (Terms and Conditions, Condition 5.1, p. 85); the unvested claim “is limited to a right to become the Registered Owner” upon vesting (Prospectus, §12.8(d), p. 61), alongside possession, transfer and economic exposure. The Vesting Conditions comprise compliance, wallet-control, bank-account and sanctions requirements, plus “such other conditions as may be specified” from time to time — an open-ended list, whose satisfaction is determined with finality binding “on the relevant Holder and all other persons” absent manifest error (Terms and Conditions, Condition 2.4(c), p. 81). Vested status is revocable at any time in the Issuer’s or the Tokenisation Entity’s sole discretion, on triggers including a wallet merely coming under governmental investigation (Terms and Conditions, Condition 2.4(e), p. 82), and transfer to a non-vested transferee automatically demotes the Security (Terms and Conditions, Condition 3.3, p. 83). Anyone acquiring in secondary markets takes as an Unvested Holder unless and until it satisfies the Vesting Conditions (Prospectus, §13.1, p. 68).
1.4 Issuer Structure
Coinbase Onchain SPV Ltd is a private company limited by shares incorporated in the ADGM on 17 June 2026, wholly owned by Onchain Marketplace Holdings Limited and ultimately by Coinbase Global, Inc. (Prospectus, Summary B, p. 12).
The board comprises two directors, Jordan Fish and John D’Agostino, both senior Coinbase executives and both holding offices at the very service provider the board exists to oversee: Mr Fish is a director of Onchain Marketplace Ltd; Mr D’Agostino is a director of Onchain Marketplace Holdings Limited and of Onchain Marketplace Ltd and “performs the controlled function of Senior Executive Officer” for the latter (Prospectus, §7.3, p. 48). While “all material decision-making is reserved to the Issuer’s Board of Directors” (Prospectus, §4.5(b), p. 35), the Issuer has no employees and every operation is executed by Onchain Marketplace Ltd — so every discretion exercised “on behalf of the Issuer” is, in personnel terms, an internal Coinbase Group decision.
The operation runs on four material contracts summarised in the Prospectus. Under the Tokenisation Services Agreement, effective 1 July 2026, Onchain Marketplace Ltd mints, delivers and burns the Securities, deploys and audits the smart contracts, operates the Relevant System, maintains the Legal Register and verifies Vesting Conditions (Prospectus, §12.10(d), p. 64). Its liability, absent gross negligence, fraud or wilful misconduct, “will not exceed the fees paid to the Tokenisation Entity” to the date of the claim (Prospectus, §10(i), pp. 50–51). The dependency is total: on a failure of the Tokenisation Entity, “the Issuer would immediately lose the ability to process any minting, redemption, transfer control, corporate action, or Deposit Ratio adjustment,” with “no alternative means of performing these functions,” and the offer “would be operationally suspended” pending replacement (Prospectus, §4.5(b), p. 35).
The Institutional Account Agreement with Alpaca, dated 30 July 2026 and governed by New York law, contains genuinely strong custody protections as summarised: segregated accounts, no securities lending or proprietary use, no “rights of lien, retention, or other rights to retain” the Deposited Property, and deposits that “will not expire in the event of … bankruptcy on the part of the Issuer” (Prospectus, §10(ii), p. 51); the Deed of Trust requires segregation from the Custodian’s own assets and, “so far as practicable,” from other clients’ assets (Deed of Trust, cl. 9.2, p. 106). Against that, the Custodian’s liability is “limited to a contractually specified amount” that is undisclosed, either party may terminate on written notice of unspecified length (Prospectus, §10(ii), p. 51), and replacement “could take several weeks or longer” (Prospectus, §4.5(d), p. 36). The General Services Agreement with Coinbase Global, Inc., effective 1 July 2026 and governed by California law, supplies finance, legal, compliance and technology support at an undisclosed arm’s-length fee, terminable on notice of unspecified length (Prospectus, §10(iii), pp. 51–52). The Issuer may replace any service provider — and even substitute a new issuer in its own place, subject to conditions including assumption of the trusteeship — without Holder consent (Terms and Conditions, Conditions 18 and 19, p. 96).
Deloitte & Touche (M.E.) LLP is the appointed ADGM-registered auditor. No audited financial statements yet exist for any period (Prospectus, §8.1, p. 48); the only financial statement is the unaudited day-one balance sheet, predating all four material contracts; and “the Prospectus has not been audited or reviewed by the Auditors” (Prospectus, §9.1, p. 49). No reserve attestation or systems assurance report is referenced in the Prospectus, and the Coinbase DDQ response confirms none exists yet (Coinbase DDQ response, Q14).
1.5 Subscriptions, Withdrawals and Redemption
Securities enter circulation through one channel only: creation by Authorised Participants “is the sole means through which Securities may come into circulation” (Prospectus, §12.8(e), p. 62). An Authorised Participant must be a Professional Client or Market Counterparty, “approved and engaged by the Issuer (in its absolute sole discretion)” (Prospectus, §13.2(a), p. 70), under an Authorised Participant Agreement which is not published — confidential, per an unverified issuer statement (Coinbase DDQ response, Q1). The creation fee is one basis point of the invested amount (Prospectus, §12.11(i), p. 66).
The creation is suspendable and cappable: the Issuer may suspend or refuse issuance generally or in particular instances (Terms and Conditions, Condition 2.3, p. 81), and “the Tokenisation Entity may limit the number of Securities that can be created in a 24-hour period” (Prospectus, §13.1, p. 69). Further, the Issuer “has not entered into any formal market making or liquidity provider arrangement” with any Authorised Participant (Prospectus, §13.2(a), p. 70), no price stabilisation will occur (Prospectus, §13.3, p. 70), and divergence between the trading price and the Underlying “may be significant” (Prospectus, §4.2(c), p. 25).
The redemption right belongs to Vested Holders alone, and the exclusion of everyone else is express and double-barrelled: “Unvested Holders shall not be entitled to redeem Securities or withdraw Underlying” (Terms and Conditions, Condition 5.1, p. 85). Vested status is determined by the Tokenisation Entity on the Issuer’s behalf, and that determination is, “in the absence of manifest error, … final and binding” on the holder and all other persons (Condition 2.4(c), p. 81). The Prospectus itself contemplates that the exclusion can become permanent: “the corresponding Underlying … may remain permanently held by the Issuer” (Prospectus, §4.4(e), p. 32), and “a partial or total loss of invested capital is possible” through vesting failure (Prospectus, §4.4(c), p. 31).
A redeeming Vested Holder submits a Redemption Order “in such form and manner as the Tokenisation Entity may prescribe from time to time” (Terms and Conditions, Condition 5.2, p. 85). The prescribed form, the operational timetable and any settlement deadline appear nowhere in the Prospectus, the Terms and Conditions or the Deed of Trust; the procedures may be “otherwise determined by the Issuer or the Tokenisation Entity in their sole and absolute discretion” (Prospectus, §12.8(e), p. 62).
Before acceptance, the Tokenisation Entity, the Custodian or any relevant service provider may re-run any validation — expressly including re-verification of the Vesting Conditions “whether or not previously satisfied” — and may “reject, suspend, delay, or conditionally accept any Redemption Order” (Terms and Conditions, Condition 5.4, pp. 86–87). After acceptance a broader power applies: “Notwithstanding acceptance of a Redemption Order”, the Issuer, the Custodian or the Tokenisation Entity may suspend, delay or modify settlement inconsistent with Applicable Law, sanctions requirements, custody requirements, “market conditions”, settlement restrictions, or operational requirements of the Relevant System (Condition 5.4, p. 87). Neither stage carries a duration limit.
The settlement election belongs, in the first instance, to the redeeming Vested Holder, who may choose among in-kind transfer of the Underlying to a nominated custody or brokerage account, sale for US dollars to a nominated bank account, or sale and conversion into “USDC or such other stablecoin as may be accepted” delivered to a nominated Wallet (Terms and Conditions, Condition 5.3, p. 86). The redemption fee is five basis points of the redemption amount (Prospectus, §12.11(ii), p. 66).
1.6 Investment Programme, Yield and Distribution
The Issuer applies creation proceeds “solely to acquire the corresponding Underlying” and “does not retain the subscription proceeds for its own account” (Prospectus, §11, p. 53). There is no investment mandate, no leverage against the Deposited Property and no rehypothecation: the Custodian “is not permitted to engage in any securities lending or other proprietary transactions” affecting the Deposited Property and has “no right to assert any applicable rights of lien” or retention over it (Prospectus, §10(ii), p. 51).
Each Security is backed by NVIDIA common stock through the Deposit Ratio — the number of Underlying represented by one Security, “as determined and adjusted by the Issuer” (Terms and Conditions, Condition 23.1, p. 98). The Prospectus elsewhere states that costs are funded through fees and the affiliate loan facility (Prospectus, §11, p. 53), which cuts against routine downward adjustment, but nothing in the Conditions confines the power.
Holders never receive cash. Condition 6 operates “in lieu of making any distribution of cash to Holders”: cash distributions received on the Underlying are applied, net of the Issuer’s fees and withheld taxes, to purchase additional Underlying, reflected as an upward adjustment to the Deposit Ratio (Terms and Conditions, Condition 6(i), p. 87). Distributions of shares are retained; other property is sold and reinvested, or retained; subscription rights may be exercised, sold, or permitted to lapse in the Issuer’s discretion; and under the compliance limb the Issuer may hold amounts “uninvested and without liability for interest” (Condition 6(ii)–(v), pp. 87–88). The Securities do not bear interest (Prospectus, §12.1, p. 54).
The distribution fee is “5.0% of the gross aggregate value” of any dividends, computed “before any withholding, deductions, or reinvestment” (Prospectus, §12.11(iv), p. 66); United States withholding is “currently 30% for non-U.S. Holders (unless reduced by applicable treaty)” (Prospectus, §12.11(iii), p. 66).
Corporate actions vest wide reshaping powers in the Issuer. An Adjustment Event extends to “any other event” affecting the Underlying, the Underlying Issuer or the Deposited Property “that, in the opinion of the Issuer, requires an adjustment” (Terms and Conditions, Condition 4.2(a), p. 84). On such an event the Issuer may exchange or surrender the Underlying for other shares, securities, cash or property; may in its sole discretion “call for surrender of the Securities in exchange” — against payment of the Issuer’s fees and expenses — for new Securities describing the substituted Underlying; and, on a partial redemption of the Underlying, selects which Holders are redeemed “in such manner as it shall determine” (Condition 4.2(e), p. 85). A delisting of NVIDIA without immediate re-listing feeds into a sole-discretion termination (Condition 4.2(b), p. 84); Holder consent is expressly not required and a failure of notice does not invalidate an adjustment (Condition 4.2(d), p. 85).
1.7 Transfer Restriction Enforcement and the Secondary Market
A transferee who satisfies the Vesting Conditions at the time of transfer takes Vested Securities and is registered. Where the transferee does not, “the relevant Securities shall automatically be redesignated as Unvested Securities and legal title thereto shall be held by the Trustee” on trust for the transferee (Terms and Conditions, Condition 3.3(ii), p. 83). This is the ordinary design of the whole secondary market: persons other than Authorised Participants acquire only through secondary transactions “and will hold them as Unvested Holders unless and until they satisfy the Vesting Conditions” (Prospectus, §13, p. 68). A liquidator seizing the token therefore holds, at that moment, an unvested position — no redemption right, no entitlement to termination proceeds, no registered legal title — with a route to vesting that is discretionary.
Asked how a secured creditor would enforce in practice, the Issuer elaborates: enforcement “will ultimately depend on the type of security interest”; a creditor with a direct right of appropriation — under a financial collateral arrangement, foreclosure under a mortgage, or conversion of a charge into an equitable mortgage — “would likely enforce directly against the debtor”, and otherwise “via application to the court for appointment of a receiver”; the appropriator declares the appropriation to the trustee, which “will update its records”, and “take[s] the equitable interest without procuring a transfer of the legal interest”, on the footing that “the normal principles of derivative transfer of title apply” to Unvested Securities; a transfer of legal title still requires onboarding as a Vested Holder; and the Tokenisation Entity may freeze, pause, rescind or cancel Securities “to give effect to the order of a court or authority recognised in the ADGM” (Coinbase DDQ response (2), item 3).
The unvested position is not a nullity: it expressly includes “a beneficial interest in such Securities” and “a right to possess, transfer, and benefit from economic exposure to the Underlying” (Terms and Conditions, Condition 2.4(d), p. 81). That interest is protected by an express trust — the Trustee holds “the legal title and all Beneficial Interests” as bare trustee for Unvested Holders (Deed of Trust, cl. 4, p. 105), the Deed takes effect as a deed poll in their favour, and each Unvested Holder “may severally enforce the obligations of the Trustee owed to them” (Deed of Trust, cl. 11.2, p. 106). An unvested token thus remains a possessable, transferable instrument carrying trust-protected exposure to NVIDIA stock.
The Prospectus and the Conditions do not describe the unvested position identically, and the divergence should be recorded rather than smoothed over. The Conditions grant a right “to possess, transfer, and benefit from economic exposure” (Condition 2.4(d)(ii), p. 81); the Prospectus body states that “the claim of any Unvested Holder is limited to a right to become the Registered Owner thereof” (Prospectus, §12.8(d), p. 61).
The Issuer’s follow-up response restates the register and vesting mechanics without choosing between the two formulations (Coinbase DDQ response (2), item 4). Its enforcement answer, however, proceeds on the footing that the unvested position is a present equitable interest capable of transfer and appropriation — the reading the Conditions and clause 4 of the Deed of Trust support — rather than a bare vesting expectancy.
The Prospectus describes a substantial apparatus — blacklisting, freezing, pausing, cancellation, rescission, redesignation, burning — operable at the smart-contract level “without requiring counterparty cooperation” (Prospectus, §14.2(d)(iii), p. 74). Possession transfers on-chain first, effective “upon validation and execution of the relevant transaction on a Blockchain Network” (Terms and Conditions, Condition 3.2(i), p. 82), and secondary trading occurs “outside of the CSD environment” (Prospectus, §4.3(b), p. 27). The single ex-ante, machine-enforced control described is address blocking: “The smart contract will block interactions with addresses flagged as sanctioned” (Prospectus, §14.2(b), p. 73), the Conditions adding, permissively, that the smart contracts “may include” controls against Wallets on the Designated List (Terms and Conditions, Condition 3.5, p. 83). Every other tool operates after settlement, on detection: a graduated protocol proceeding from identification of an ineligible address, through a freeze “denying the Holder all ability to transfer the Security or receive any economic benefit”, to ongoing monitoring (Prospectus, §14.2(d), p. 74), together with the power of “rescinding any purported transfer in violation of this Prospectus” (Prospectus, §14.2(a), p. 73).
The Tokenisation Entity may rescind transfers, cancel “any or all Securities”, redesignate Vested Holders, or freeze Securities on-chain, “in each case with or without payment” (Prospectus, §14.2(a), p. 73). A freeze denies all economic benefit “until the position is no longer prohibited (which may never occur)” (Prospectus, §4.2(a)(ii), pp. 24–25); detected prohibited holdings may be “frozen or burned” (Prospectus, §4.2(a), p. 25). No provision imposes a duration limit on a freeze, a compensation standard for a cancellation, or any procedure for contesting or releasing either.
Condition 3.5 permits freezing, cancellation, or the refusal, suspension, delay, reversal or invalidation of any transfer where the Tokenisation Entity determines in good faith that action is necessary or advisable for legal, sanctions, compliance, custody or operational reasons, that a Designated List Wallet is involved, that a transfer “would expose the Issuer, Trustee, Custodian, or Tokenisation Entity to legal, regulatory, sanctions, or reputational risk”, or that it “would otherwise be inconsistent with the Relevant System” (Terms and Conditions, Condition 3.5, p. 83). The Prospectus separately reserves to the Issuer, “in its sole and absolute discretion and without liability”, power to refuse or suspend transfers “or require the disposal or transfer of Securities” (Prospectus, §14.1(a), p. 71) — a forced-disposal power.
The Tokenisation Entity “conducts continuous on-chain monitoring and reconciles on-chain positions against the Legal Register on an intraday basis” (Prospectus, §4.4A(b), p. 40), “applies blockchain analytics to risk-label external addresses” (Prospectus, §4.4(b), p. 31), and subjects all addresses holding Securities to “sanctions screening and transaction monitoring of the destination address”, with enhanced manual review above defined thresholds (Prospectus, §14.2(c), p. 73).
+++++
2. Issuance, Holding and Redemption
Primary issuance is available only to authorised participants approved by the issuer, which must qualify as professional clients or market counterparties under ADGM rules. Authorised participants mint against delivery of shares or cash and may sell the tokens into secondary markets, including to retail holders. The creation fee is one basis point and the redemption fee is five basis points.
Anyone who acquires the tokens on the secondary market holds them as an unvested holder. An unvested holder has possession of the token, the right to transfer it, and the economic exposure to the underlying shares, which are held for it on a second bare trust. It does not have a redemption right until it completes the issuer’s vesting process, which covers compliance, sanctions, and wallet-control checks and is conducted at the issuer’s discretion. Vested holders may redeem in kind, in US dollars or in USDC. The securities are offered outside the United States under Regulation S and may not be held by US persons.
This structure has a direct consequence for liquidations. A liquidator that seizes tokens holds them as an unvested holder and must either sell them on the secondary market, hedge them until they can be realised, or complete vesting before it can redeem. Vesting has so far been used by authorised participants, and there is no separate onboarding path for a liquidator or a lending contract, so the redemption route should be treated as available only to parties that already hold the right. No minimum amounts, timing windows, or jurisdictional conditions apply to redemption beyond the fee, although the issuer may introduce them.
2.1 Primary Issuance Path
Every mint runs through the issuer’s token supply manager, which is the only holder of the mint role on the tokens, so authorised participants never interact with the token contract directly. In practice a participant places an order off-chain, the issuer settles the share or cash leg in custody, and a single minter key then calls the supply manager, which mints to the participant’s wallet and records the order identifier so that the same order cannot be executed a second time. Nothing on-chain ties the token supply to the shares held at the custodian, since there is no order queue, no proof-of-reserves check ahead of a mint, and no attestation of the share inventory. The issuer reconciles the two off-chain, and the audited accounts and reserve reports that would evidence that reconciliation do not yet exist.
The only on-chain limit on issuance is the allowance assigned to the minter, which caps the amount of each token that can be created in any 24-hour window and refills continuously over that window. The amounts, listed in section 3, come to about USD 5M per token per day at current prices, and the issuer’s administrator can change or remove them in a single transaction. A mint can be directed to any address that is not on the transfer blocklist.
The seven names saw their first mint on 12 August 2026, and since then the supply manager has processed 1,669 mints and 803 redemptions on them, worth USD 34.7M and USD 20.3M respectively at the daily close, with the weekly volumes per token shown below. The same contract also serves the issuer’s other six equity tokens and seven test tokens, bringing its totals to 2,634 mints and 1,533 redemptions since late July 2026, so any operational change to it reaches every listed name at once.
Source: LlamaRisk, 23 September 2026
2.2 Redemption Path
Redemption runs through the same contract in the opposite direction. The redeemer transfers tokens to the supply manager, which burns them and records the multiplier in force at the time, and the issuer then settles the share or cash leg off-chain. Before the burn the call passes three checks:
- The caller must be a member of the redeem allowlist held in Base’s policy registry,
- the token must not have its redemption paused on the manager,
- and the redeemed amount must clear a per-token minimum, which is currently zero for all seven names.
The redeem allowlist is where the vesting gate described in section 1 takes effect on-chain, and it is managed by the issuer’s administrator key. On 23 September 2026 it holds five addresses, all of them externally-owned accounts, which were added one at a time on 24 July, 2 August, 18 August, 31 August and 13 September 2026. Since redemption carries no rate limit, an allowlisted party can redeem its entire holding in one transaction and depends only on the issuer’s off-chain settlement thereafter.
The supply manager also carries a per-token redemption pause, but only an address holding a redeem-pauser right can use it and the issuer has not granted that right to anyone. As a consequence, when the issuer halts redemptions around a corporate action it does so by no longer processing orders off-chain, and nothing on-chain records that redemptions are closed. An integrator that wants to know whether a corporate-action window is open therefore has a single signal to read, which is the pause flag on the oracle registry described in section 5.
Processing times for either leg are not observable on-chain. A mint appears only at the moment the minter key executes it, and a redemption burns in the same transaction in which the redeemer hands over the tokens, so neither event records when the order was placed or how long the issuer took to settle the share or cash leg in custody. The offering documents commit to no timetable either. Creation orders are processed at the issuer’s discretion and may be capped per 24-hour period, a redemption order is submitted in whatever form the tokenisation entity prescribes and can be delayed or suspended both before and after acceptance with no outer time limit, and the issuer describes the processing time for vesting only as short. We therefore treat the timing of the primary route as resting entirely on the issuer.
2.3 Secondary Holding and Transfer Controls
Secondary transfers need no allowlist, but every transfer is checked against a single blocklist held in Base’s policy registry, with the check applied to the sender, the receiver, and the account submitting the transaction, and the same blocklist decides who may receive a mint. A blocked transfer reverts. Approvals are not checked against the list, so an allowance can remain in place for tokens that can no longer move.
| Property |
Value |
| Policy |
Blocklist, policy id 5 in the policy registry |
| Created |
10 July 2026, by the issuer’s deployer key |
| Applied to |
Transfer sender, transfer receiver, transfer executor, and mint receiver on all seven tokens |
| Administrator |
Compliance administrator 0xEC0F…2812, externally-owned account, no handover pending |
| Members on 23 September 2026 |
479 addresses |
| Change control |
One administrator, no delay, no cap on batch size |
The list was seeded in bulk and has grown in occasional batches since.
| Date |
Change |
Members after |
| 22 July 2026 |
390 addresses blocked in eight transactions |
390 |
| 23 July 2026 |
7 blocked |
397 |
| 4 to 11 August 2026 |
8 blocked, 1 unblocked |
404 |
| 25 August 2026 |
25 blocked |
429 |
| 10 September 2026 |
52 blocked |
479 |
The compliance administrator is a different key from the issuance administrator, which is consistent with the issuer’s statement that compliance functions are held apart from issuance functions.
3. Token Standard and Issuer Contracts
The tokens are implemented on B20, a Base-native token standard that runs as a chain precompile and extends ERC-20. Balances never change, each token instead carries a multiplier that starts at 1.0 and moves only on corporate actions.
Transfers are open to anyone not on the blocklist described in section 2.3. Each token can pause transfers, mints, and burns separately, can burn the balance of a blocked account, and gains a seize function with the Cobalt network upgrade. The tokens carry no supply ceiling of their own, and issuance is bounded instead by the issuer’s supply manager contract, which the rest of this section describes.
3.1 Onchain Footprint
The seven tokens are precompile accounts whose bytecode is a single marker byte, so their behaviour comes from the Base node software rather than from verified contract source. The issuer’s own contracts sit beside them, all deployed by one deployer key on 10 July 2026, and the issuer’s asset factory then created the thirteen equity tokens on 26 July 2026.
| Component |
Address |
Function |
| AAPLc |
0xb200…d1fb |
B20 asset precompile, 8 decimals, supply 6,437 |
| AMZNc |
0xb200…C2E8 |
B20 asset precompile, 8 decimals, supply 7,706 |
| GOOGLc |
0xb200…58B7 |
B20 asset precompile, 8 decimals, supply 6,584, multiplier 1.000377 after one reinvested dividend |
| METAc |
0xb200…707C |
B20 asset precompile, 8 decimals, supply 3,854 |
| MSFTc |
0xB200…872B |
B20 asset precompile, 8 decimals, supply 3,986 |
| NVDAc |
0xB200…108C |
B20 asset precompile, 8 decimals, supply 16,618 |
| TSLAc |
0xb200…0cD0 |
B20 asset precompile, 8 decimals, supply 2,838 |
| Token supply manager (proxy) |
0xd1ca…664c |
Holds the mint and burn roles on every token. Executes mints for the configured minter and processes redemptions for allowlisted redeemers. Rate-limits minting per caller through an allowance that refills linearly over a 24-hour interval |
| Token supply manager (implementation) |
0x3F27…C6E3 |
Version 2, verified source, in force since 11 August 2026 |
| Asset factory (proxy) |
0x4bA3…534D |
Creates tokens through the B20 factory precompile, seeds the transfer blocklist into each new token, and registers it on the supply manager |
| Asset factory (implementation) |
0xbBcb…28Ca |
Verified source, unchanged since deployment |
| Oracle registry |
0x3f3E…5CaD |
Publishes the live multiplier and a pause flag per token. Chainlink reads both from this contract. Not a proxy, verified source |
| Policy registry |
0x8453…0002 |
Base precompile holding the transfer blocklist (policy 5) and the redeem allowlist |
| B20 factory |
0xB20f…0000 |
Base precompile that creates B20 tokens at deterministic addresses |
3.2 Upgrade Architecture
The token logic changes only when Base upgrades the network. B20 arrived with the Beryl upgrade, and the Cobalt upgrade on 30 September 2026 swaps in new logic behind the same precompile addresses, adding the scheduled multiplier path, the seize function, composite policies, and ERC-165 interface detection. Because a fork changes every B20 token on the chain at once, the issuer cannot opt out and has nothing to sign. Base’s contract upgrades are authorised jointly by a Coinbase signer set and the Security Council for Base, although the B20 documentation does not say who sets a fork’s activation time.
The issuer’s own contracts follow a more conventional pattern. The supply manager and the asset factory are UUPS proxies whose upgrader role sits with a single externally-owned account and is not behind a timelock. The supply manager has been upgraded once, on 11 August 2026, when version 2 added the order identifier on mints and separated the redemption checks, while the asset factory has not changed since 10 July 2026. The oracle registry is a plain contract with no upgrade path, so changing what Chainlink reads would require a new deployment and a feed reconfiguration.
None of the changes available to the issuer is subject to an on-chain delay, so contract upgrades, role grants, policy edits, and allowance changes all take effect in the transaction that submits them.
3.3 Audit History
The B20 precompile has been reviewed by Spearbit researchers working through Cantina ahead of each Base upgrade that touched it, and the reports are published in the Base repository.
| Audit |
Date |
Coverage |
Outcome |
| Cantina, B20 precompiles |
Review 1 to 9 June 2026, report 14 August 2026 |
B20 token and policy registry precompiles as shipped in Beryl |
29 findings, 1 High (oversized precompile inputs aborting the EVM) fixed, 11 Low, 17 informational |
| Cantina, precompile macros and storage |
Review 1 to 9 June 2026, report 14 August 2026 |
Storage layout and macro layer under the precompiles |
37 findings, 5 Medium, 13 Low, 19 informational |
| Cantina, Cobalt precompile diff |
Review 17 August to 2 September 2026, report 10 September 2026 |
Seize, scheduled multiplier, composite policies, ERC-165 |
20 findings, 1 High (policy update access order on the stablecoin variant) fixed, 1 Medium, 4 Low, 3 acknowledged |
| Cantina, Cobalt dynamic upgrades |
Report 19 September 2026 |
Fork-activation mechanism nodes poll from L1 |
1 High, 6 Medium, 9 Low |
The Beryl reviews cover the code running today, and the Cobalt review covers the changes that go live on 30 September 2026, which means that the scheduled multiplier path and the seize function have been reviewed once and have not yet run in production.
No audit of the supply manager, the asset factory, or the oracle registry has been published, and the prospectus does not cite one either, saying only that the tokenisation entity deploys and audits the smart contracts. The three contracts are small, with verified source, and are built from standard OpenZeppelin access control and UUPS components, but version 2 of the supply manager, in force since 11 August 2026, postdates any review the July deployment may have had. Coinbase runs a bug bounty on Cantina that covers every mainnet contract it has deployed, with a maximum payout of USD 5M for a critical finding, and Base runs a separate HackerOne programme for off-chain and infrastructure findings, both referenced in the Base security policy. No unfixed critical finding is reported across the audits or the bounties.
3.4 Access Control Model
Every contract in the footprint uses OpenZeppelin role-based access control, and on 23 September 2026 every role resolves either to an externally-owned account or to the supply manager, with no multisig, timelock, or module contract anywhere in the role tables. The issuer has indicated that administrative actions go through a hardware-backed key management system with multiple approvals, and that compliance keys are held apart from issuance keys.
The token roles are defined by the B20 standard. The default administrator grants and revokes every other role, changes the policy slots, and sets the supply cap, and the standard will not let the last default administrator be removed unless it deliberately renounces into a state with no administrator at all. A role-gated call checks the role first and then whether the feature concerned is paused.
| Role |
Purpose |
Holder (on-chain) |
DEFAULT_ADMIN_ROLE on all seven tokens |
Grant and revoke every token role, update the four policy slots, set the supply cap |
Issuance administrator 0x3846…72B1, externally-owned account |
OPERATOR_ROLE on all seven tokens |
Update the multiplier instantly, schedule or cancel a multiplier update after Cobalt, wrap calls in an announcement |
Operator 0x5da4…4d9a, externally-owned account, and on GOOGLc only a second operator 0xe6cb…8c37, externally-owned account, granted on 14 September 2026 in the transaction that applied the dividend multiplier |
MINT_ROLE and BURN_ROLE on all seven tokens |
Mint to any non-blocked address, burn the caller’s own balance |
Token supply manager only |
PAUSE_ROLE and UNPAUSE_ROLE on all seven tokens |
Pause and unpause the transfer, mint, burn, and seize features individually |
Pauser 0x2fb5…bcdd, externally-owned account |
METADATA_ROLE on all seven tokens |
Change name, symbol, contract URI, and extra metadata such as the ISIN |
Operator 0x5da4…4d9a and 0x1cc0…beca, externally-owned accounts |
BURN_BLOCKED_ROLE and SEIZE_ROLE on all seven tokens |
Burn from a blocked account (deprecated), seize from any non-exempt account after Cobalt |
No holder |
DEFAULT_ADMIN_ROLE on the supply manager |
Configure and remove minters and their allowances, register and deregister tokens, set the redeem policy, set the per-token redeem minimum, grant redeem pausers, grant the factory and upgrader roles |
Issuance administrator 0x3846…72B1 |
UPGRADER_ROLE on the supply manager and the asset factory |
Replace the implementation |
Upgrader 0x7D4D…a106, externally-owned account |
FACTORY_ROLE on the supply manager |
Register a newly created token and its redeem minimum on the supply manager, called at the end of each token deployment |
Issuer asset factory 0x4bA3…534D, the proxy contract listed in 3.1, which needs this role to complete a deployment |
| Configured minter on the supply manager |
Call the mint function within the per-token 24-hour allowance |
Minter 0x06fB…AbA8, externally-owned account, the only minter on all seven tokens |
DEFAULT_ADMIN_ROLE on the asset factory |
Grant token deployer and upgrader roles |
Issuance administrator 0x3846…72B1 |
TOKEN_DEPLOYER_ROLE on the asset factory |
Create new tokens with the issuance administrator as token admin and the operator as operator |
Deployer 0xE090…5C6f and 0xeE63…cC70, externally-owned accounts |
DEFAULT_ADMIN_ROLE and PAUSER_ROLE on the oracle registry |
Grant roles, set the per-token pause flag that halts the Chainlink feed |
Issuance administrator 0x3846…72B1 |
| Redeem allowlist administrator |
Add and remove redeemers |
Issuance administrator 0x3846…72B1 |
| Transfer blocklist administrator |
Block and unblock addresses on the policy applied to every transfer and mint |
Compliance administrator 0xEC0F…2812, externally-owned account |
The issuance administrator sits at the root of the structure, since it is the default administrator on every token, on the supply manager, on the asset factory, and on the oracle registry, as well as the registry’s only pauser and the administrator of the redeem allowlist. Whoever holds that key can grant any role on any token to any address, re-point a transfer policy slot, lift the mint allowance, replace the redeem policy, or halt the price feed, each in a single transaction. The operator key is the second point of concentration, because it can move the multiplier on all seven tokens instantly and with no bound on the size of the step, and since 14 September 2026 a second operator key has held the same power on GOOGLc.
Policies in the registry follow their own rules. Each policy has one administrator at a time, handing it over takes a stage step followed by a finalise step, and an administrator that renounces freezes the membership permanently. Neither the blocklist nor the redeem allowlist has a handover pending, so both can still be changed.
3.5 Pause Surface
Three pause mechanisms coexist, and none is active on 23 September 2026.
- Token feature pause. The pauser key can pause transfers, mints, and burns on any token separately, and seizures once Cobalt is live. A transfer pause stops every balance movement, so supplies, withdrawals, and the collateral leg of a liquidation all fail until it is lifted and a position cannot be unwound on-chain in the meantime, although approvals continue to work. The issuer describes on-chain pauses as unlikely, the pause roles were first granted on 3 September 2026, and no token has been paused since deployment.
- Redemption pause. The supply manager can pause redemptions per token, but only an address with a redeem-pauser right can do so and none has been granted, so the pause on minting and redemption that the issuer applies around corporate actions is an off-chain decision not to process orders.
- Oracle registry pause. The issuance administrator can set a flag per token that Chainlink reads, and while it is set the feed stops publishing and holds its last value. The flag has never been set on any of the seven tokens. This is the pause the issuer intends to use around corporate actions, and because tokens keep changing hands against a frozen price while it is set, the affected reserve is paused on the Aave side for the same window.
Like every role action, a pause executes immediately with no on-chain delay.
3.6 Multiplier and Corporate-Action Controls
Two properties of the corporate-action path shape the controls on the Aave side. The operator role can change the multiplier instantly, and although the standard recommends wrapping the change in an on-chain announcement it does not enforce it. The standard also defines a scheduled path with an effective time, following ERC-8056, but that path is not active on the deployed tokens and only arrives with the Cobalt upgrade on 30 September 2026, together with pre-announcement of pending changes and ERC-165 interface detection. Until then the tokens should be treated as not conforming to those interfaces, and a multiplier change that does not match an announced corporate action is treated as a price incident, with the affected reserve paused until the change is explained.
The instant update has no limit on the size of the step and does not check the state of the feed, so a mis-sequenced or mistaken call can move the token’s value by any factor in one transaction. After Cobalt the scheduled path allows one pending update at a time with an effective timestamp, which the operator can cancel before it matures, but maturation itself writes nothing and emits no event, so an integrator has to read the pending value and its effective time directly rather than wait for a signal. The instant setter remains available as an emergency path and clears any pending update. Because the oracle registry reads the multiplier live from the token, a change reaches the Chainlink feed on its next update unless the registry pause flag has been set first.
The multiplier has moved once across the seven tokens, for the GOOGLc cash dividend of 14 September 2026. At 15:39 UTC the operator key posted an announcement on GOOGLc describing the dividend and linking to the issuer’s corporate-action record, with no state change inside it, and at 18:29 UTC a second key, granted the operator role in the same block, applied the multiplier update from 1.0 to 1.000377 inside a second announcement carrying the same description and record identifier. The oracle registry was not paused for the event, as expected for a dividend with no price discontinuity. In effect this is the pre-announcement pattern the issuer intends to formalise after Cobalt, carried out for now as two operator transactions about three hours apart.
3.7 Supply Bounds
None of the seven tokens has a supply cap, although the token administrator can set one at any value at or above the current supply. What bounds issuance instead is the minter’s allowance on the supply manager, which refills at the rates below, equivalent to about USD 5M per token per day at current prices, while redemption is limited to allowlisted addresses and has no rate limit.
| Token |
Mint allowance per 24 hours |
| AAPLc |
15,500 |
| AMZNc |
19,100 |
| GOOGLc |
15,700 |
| METAc |
8,200 |
| MSFTc |
10,300 |
| NVDAc |
24,000 |
| TSLAc |
14,300 |
Source: Base onchain data, 23 September 2026
The allowances for AAPLc, GOOGLc, METAc, and NVDAc were set on 2 August 2026 and those for AMZNc, MSFTc, and TSLAc on 3 September 2026, and none has changed since. The issuance administrator can change them at any time with immediate effect, and because the add caps in the Aave V4 Base deployment ARFC are sized against these values, a change to them is a reason to revisit the caps.
4. Corporate Actions
Corporate actions reach the chain through the multiplier. A reinvested dividend moves it by a fraction of a percent with no price event, and a split moves it by the split ratio at the same moment as the underlying price divides by that ratio. A split is the event that matters for a lending market, because if the token applies the new multiplier before the feed applies the new price, or the reverse, the token is mispriced by the full split ratio until the two realign.
The issuer’s current sequence is to pause minting and redemption off-chain and pause the feed through the oracle registry, update the multiplier, verify that the new underlying price multiplied by the new multiplier matches the held value, and then resume the feed and the off-chain flows. The announcement accompanies the multiplier update in the same transaction, and the multiplier update event is the point at which the action is considered processed onchain. The issuer has stated that every direct multiplier update will be wrapped in an announcement. That commitment is operational, since the standard does not enforce it, and it is expected to move to a pre-announcement once the network upgrade described in section 3 is live.
Dividends are reinvested at the time and price of the dividend payment, net of withholding tax and the issuer’s distribution fee, and reach the token as an increase in the multiplier. Because there is no price discontinuity, a dividend does not require a feed pause. Fractional amounts and later corrections are absorbed at the custody layer, where shares are held to a finer precision than the token, and the same process applies to forward and reverse splits, with any residual reinvested for all holders equally. A delayed corporate action is delayed onchain, and a cancelled action does not reach the chain.
5. Price Feed
Each token is priced by a Chainlink tokenized equity feed that combines two inputs. The first is the price of the underlying share, which Chainlink’s Data Streams have carried on a 24/5 basis since January 2026. The second is the issuer multiplier described in section 3, which Chainlink reads from Coinbase’s onchain oracle registry together with the registry’s pause flag. The feed publishes the product of the two as a single total return price, and the market consumes that value directly with no multiplier handling of its own.
Source: LlamaRisk, 17 September 2026
The underlying equity price is assembled from the four sessions in which US equities trade. The regular session is multi-sourced from exchange data and carries almost all of the day’s volume. The pre-market and post-market sessions are sourced from extended-hours venues, and the overnight session is sourced from Blue Ocean ATS, the largest of the venues on which US-listed stocks trade between 20:00 and 04:00 ET and the one Chainlink sources. Chainlink runs a separate stream for the regular, extended, and overnight sessions and constructs the continuous price by switching between them on the stream’s market status field. The extended-hours streams draw on several providers, while the overnight stream is currently single-sourced.
| Session |
Hours, ET |
Days |
Sourcing |
| Pre-market |
04:00 to 09:30 |
Monday to Friday |
Extended-hours venues, several providers |
| Regular |
09:30 to 16:00 |
Monday to Friday |
Exchange data, multi-sourced |
| Post-market |
16:00 to 20:00 |
Monday to Friday |
Extended-hours venues, several providers |
| Overnight |
20:00 to 04:00 |
Sunday evening to Friday morning |
Blue Ocean ATS |
| Closed |
20:00 Friday to 20:00 Sunday, and US market holidays |
|
No updates, last value held |
Taken together, the sessions give the feed an operating window from Sunday 20:00 ET to Friday 20:00 ET, or 120 of the 168 hours in a week, against the 32.5 hours of the regular session alone. While the market is closed the feed publishes nothing, including heartbeat updates, so the last value published before the Friday close stands with a stale timestamp until the Sunday evening reopen. The same applies on US market holidays, and the collateral factor treats every such closure, including the long weekends around holidays, as a window in which the position cannot be repriced.
Source: LlamaRisk, 17 September 2026
The multiplier converts the share price into the value of the token. It starts at 1.0 and moves only on corporate actions. A reinvested dividend raises it by the dividend net of the distribution fee and withholding tax, which for the seven names is a fraction of a percent per quarter, and a stock split multiplies it by the split ratio at the same time as the share price divides by that ratio. Because dividends are reinvested rather than paid out, the token value drifts above the share price over time, which is what makes the feed a total return tracker rather than a plain price feed. Between corporate actions the multiplier sits still, so all of the fast market risk lives in the underlying equity stream, and the multiplier can be audited against the issuer’s announcements and the public corporate-action calendar.
Onchain, the feeds are configured with a 0.5% deviation threshold and a 24-hour heartbeat, so during open sessions a new value is written whenever the offchain price moves 0.5% from the last published value. The published value can therefore lag the live price by up to 0.5% at any time, and the liquidation bonus carries that lag as the oracle allowance. Coinbase pays for the feeds and sets this configuration, and Chainlink has indicated that a tighter threshold is available on request if the modelling shows it is needed.
During a corporate action, the issuer pauses the registry flag, the feed holds its last value, the issuer applies the new multiplier, and the feed resumes once the new underlying price multiplied by the new multiplier has been confirmed to match the frozen value. Minting and redemption pause for the same window while token transfers continue. The affected reserve is paused for that window as well, since a token that continues to change hands against a frozen price is precisely the state in which a mispriced liquidation can occur.
Source: LlamaRisk, 17 September 2026
The underlying equity price is delivered through Chainlink Data Streams, with one stream per name and a market status field that identifies the session. The status values are pre-market, regular, post-market, overnight, and closed, and the closed state covers weekends and US market holidays. All seven names are expected to change state at the same moment. Trading halts at the overnight venue are not represented as a separate state and appear as staleness on the stream instead.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
