KETJU Research

← The Register

Tokenized real-world assets

Franklin OnChain U.S. Government Money Fund (FOBXX), BENJI token

Not approved No defect found; not on the approved list

Review open since 2026-09-29: Franklin OnChain U.S. Government Money Fund (FOBXX), BENJI token on Polygon: the transfer allowlist is now no, the file recorded yes; the power to freeze a holder is now no, the file recorded yes (read at block 94592173). Ketju will review the file before any client action. A draft revision dated 2026-09-29 is under audit. The verdict stands until the review closes.

Verdict
Not approved
No defect found; not on the approved list
Who can freeze it
Issuer can freeze
Withdrawals
Holders may send shares to each other.
Reviewed
2026-09-26
Researched memo

Summary

Ketju does not approve BENJI: Franklin sells the fund only through its own app or portal, bars IRAs and every other retirement account, and redeems shares only through that app. We found no defect in how the fund works. BENJI is a share of the Franklin OnChain U.S. Government Money Fund (FOBXX), a series of Franklin Templeton Trust registered under the Investment Company Act. The fund runs under Rule 2a-7, keeps at least 99.5 percent of assets in government securities, cash and fully collateralized repos, and is priced to hold $1.00. Franklin Templeton Investor Services (FTIS), the fund’s registered transfer agent and a Franklin subsidiary, keeps the list of owners. Its system joins a private database to public chains, and each share appears on a chain as one BENJI token. FTIS decides who owns each share. On every chain we read, the issuer can whitelist, freeze and claw back, and one key or one of a few can change those rules. Five holders had about 75 percent of the shares on July 1, 2026.

Research

How it works

An individual downloads the Benji app, passes Franklin’s anti-money-laundering and know-your-customer checks, and links a bank account. FTIS then creates a wallet for the investor on Stellar, unless the investor has asked in advance to use another chain. Stellar has been the fund’s primary chain since it launched in April 2021. For an individual, FTIS creates and secures the key pair, and the investor instructs the wallet through the app. Only institutions may keep their own keys, and only with FTIS approval. Franklin’s Benji page lists Stellar as the one chain open to retail. Polygon, Arbitrum, Avalanche, Aptos, Ethereum, Base and Solana are for institutions.

A purchase is a dollar transfer from the linked bank. When it settles, FTIS mints shares to the wallet. The fund strikes a NAV each hour from 8 a.m. to its 5 p.m. Eastern close. Orders must arrive by 2 p.m. Pacific to trade that day. The fund pays dividends daily as new tokens, which Franklin says are ”airdropped directly into shareholders wallets.” When shares move between holders during a day, FTIS splits that day’s dividend by the hours each side held them. The prospectus calls this method patent pending.

Moving between chains does not create shares. FTIS burns the shares on one chain and mints the same number on the other. The prospectus gives the example of 100 shares burned on Stellar and minted on Polygon, with ”no new shares” created on the official record. Each chain has its own minimum first purchase because network fees differ: $20 on Stellar; $100 on Aptos, Base and Solana; $1,000 on Polygon and Arbitrum; $20,000 on Avalanche; and $5,000,000 on Ethereum. The manager pays the network fees for any transaction made through the app or portal.

FTIS picks chains under a written suitability framework. A chain needs ten or more full nodes, 99.9 percent uptime, blocks under ten seconds, multi-signature support, and a clawback or administrative balance control. FTIS may move holders off a chain that fails the framework.

What the holder owns

The holder owns a fund share with the same claim as any other FOBXX share. That claim is a pro rata interest in a pool of Treasury bills, agency paper and repurchase agreements, with a vote on matters that need shareholder approval. The token is not a separate security and not a claim on Franklin. Shares are not bank deposits, and neither the FDIC nor SIPC covers them.

FTIS keeps the official record. The prospectus says FTIS ”maintains the official record of share ownership via a proprietary blockchain-integrated system that utilizes features of traditional book-entry form and one or more public blockchain networks.” The no-action request describes the parts. One is an internal database with names and tax numbers. The others are the chains, which carry purchases, redemptions, dividends and NAVs, ”automatically joined by FTIS on a real-time basis by referential data linkage to establish the master securityholder file.” The prospectus says fund shares on this system ”are under the unilateral control of the transfer agent.”

The chain is therefore part of the official record only as FTIS links it. For that reason Ketju classes BENJI under the issuer-indirect model: a token balance counts because FTIS recognises it. The prospectus covers the edge case directly. A person holding a wallet to which shares were sent in error ”would have no legal claim to such Fund shares.”

Size and holdings

The fund has run for five years, and we found no NAV break. It reported 686.6 million shares outstanding for August 31, 2026 on Form N-MFP3. It reported $843.8 million of net assets at its March 31, 2026 year end. On September 23, 2026 we read about 427.5 million BENJI on Stellar, 59.7 million on Base, 48.2 million on Ethereum, 47.9 million on Arbitrum, 34.3 million on Avalanche, 32.2 million on Polygon and 0.2 million on Solana. That is about 650 million in all. Ketju cannot yet read the Aptos balance.

Ownership is concentrated. As of July 1, 2026, the SAI lists the Stellar Development Foundation at 27.30 percent, Franklin Distributors at 15.53, Franklin Advisers at 15.41, Ondo I LP at 9.45, and one family trust at 7.21. Western Asset became sub-adviser on May 18, 2026, under Franklin Advisers.

Who controls it

Franklin publishes every contract address on its Benji contracts page, so we could read the controls directly. On Stellar, BENJI is a classic asset issued by account GBHNGLLIE3KWGKCHIKMHJ5HVZHYIK7WTBE4QF5PLAKL4CJGSEU7HZIW5. It is the first live Stellar program with a published issuer that Ketju has reviewed. Horizon shows all four issuer flags that matter. A holder needs the issuer’s authorization to hold (auth_required). The issuer can revoke that authorization and so freeze a holder (auth_revocable). The issuer can still change the flags (auth_immutable is false). The issuer can claw back (auth_clawback_enabled).

The issuer’s own master key has weight zero. Fourteen other keys sign for it, ten with weight 3 and four with weight 1. The thresholds are 2 for low and medium operations and 6 for high ones. Revoking authorization is a low-threshold operation and clawback a medium one. Any one of the ten weight-3 keys can therefore freeze a holder or claw back shares alone. Changing the signers takes two.

On the five EVM chains, the token is an upgradeable ERC-20, Franklin’s MoneyMarketFund contract. It consults a module registry held in its storage. Its verified source requires both sides of every transfer to be authorized shareholders, and neither may be frozen. The token checks this against the Authorization module, which carries authorizeAccount and freezeAccount. The token itself lets an admin burn any holder’s shares (burnShares), move shares between holders (instantTransfer), and switch off all holder transfers (disableERC20Transfer). On Ethereum, the Transfer Agent module adds adjustBalance and recoverAccount.

The upgrade power matters most. ROLE_TOKEN_OWNER controls the token’s upgrade function. On every EVM chain the same three plain addresses (0x42cc…, 0x64d4…, 0xb671…) hold that role. A contract also holds it on most chains, and more plain addresses hold it on Polygon and Arbitrum. On Polygon one plain address also holds the default admin role. Each holder of the role can replace the token’s code alone. On Ethereum the authorization admin role sits with the contract that Franklin names as its MultiSig Module. On Avalanche and Base, Franklin has not published the Authorization module’s source. We therefore mark whitelist and freeze there as unverified, though the token source shows the same checks.

On Solana the mint is a Token-2022 account. Its mint authority, freeze authority and permanent delegate are all the mint address itself, which no private key controls. Only Franklin’s program can sign for it. A transfer hook, program huk3EPrNreTdUUjVKVkGSGKF1WC4P9BiUKBkn2kFWnP, enforces the whitelist. All three Franklin Solana programs (the hook, the MultiSig module and the MultiChain module) share one upgrade authority, AJyEpT8V17VniFmVhrUvegQJXy5g3qcRnqRe3joesXeJ, an ordinary wallet. That one key can rewrite the code that holds every power over the Solana mint.

The chain cannot show what stands behind these keys. Franklin represented to SEC staff that FTIS ”uses a layered wallet security architecture, including multi-signature and multi-party computation techniques, geographically and operationally distributed signers, and offline recovery capabilities.” A key split by multi-party computation signs as one address. We record what the chain shows, one key, and Franklin’s representation beside it. Franklin discloses these powers. The prospectus says FTIS can ”correct errors and unauthorized transactions in, and limit the transferability of, Fund shares.” The suitability framework makes a clawback control a condition for using any chain.

Withdrawals

Holders may send shares to each other. The prospectus allows peer-to-peer transfer ”within any approved blockchain network or between any two approved blockchain networks,” at any hour, with no minimum. Both wallets must be ”active, permissioned” and whitelisted with FTIS. Retail transfers went live in the app in May 2025. Neither the fund nor FTIS matches buyers and sellers. The prospectus says the shares ”will not be listed for trading” on an exchange or an alternative trading system. The same prospectus says the shares trade on the Nasdaq under the ticker FOBXX. We read that as the Nasdaq fund symbol that every mutual fund carries, which is not a listing. Franklin warns that a transfer at a price other than NAV may raise securities-law questions for the parties.

A holder can redeem only through the app or portal. FTIS processes orders on business days at the next hourly NAV, and the daily cutoff is 2 p.m. Pacific. Proceeds go by ACH or Fed wire to the linked bank ”within seven days”; ACH generally arrives in two to three business days. Requests over $250,000, or to a bank account changed in the last 15 days, may need a signature guarantee. Proceeds from shares bought by electronic transfer may wait up to ten calendar days for the funds to clear. Holders cannot exchange shares into other Franklin funds. The fund does not now intend to charge a liquidity fee, but its board may add one after notice.

Losses and incidents

The risks are the fund’s, and the token adds few of its own. If large holders redeem together, the fund sells short government paper to pay them, as any government money fund does. The concentration of ownership makes that risk real: two Franklin affiliates held about 31 percent of shares on July 1, 2026. If a chain fails, FTIS says it can move holder records to another approved chain. If a holder loses a wallet key, FTIS can restore the record, though the prospectus warns that the shares may be unavailable while it works.

We found no public report of a NAV break, a redemption suspension, a record correction that touched a holder, or a contract exploit for FOBXX since its April 2021 launch. Ketju’s daily check reads the seven chains’ controls, module addresses and supply and compares them with the day before.

Fees

The fund charges 0.20 percent after a waiver that runs to July 31, 2027. A U.S. client can open an account in the Benji app with $20.

SEC staff letter

On August 12, 2026, SEC staff gave Franklin a custody no-action position. It answers a narrow question for Franklin’s own funds. Rule 17f-2 governs a fund that keeps its own assets. Franklin’s other mutual funds want to hold cash in FOBXX with FTIS, an affiliate, as custodian. Staff said they would not recommend enforcement if those funds skip the rule’s vault, notation and verification steps. Staff relied on a 1992 letter about an affiliated transfer agent keeping book-entry fund shares.

The conditions show what staff treated as custody. FTIS must keep the administrative controls to correct, freeze, migrate and restore the share register; the letter describes FTIS’s power to ”maintain, correct, freeze, migrate, or restore the official record.” FTIS must keep a separate wallet and account for each investing fund and send confirmations. If it stops acting as transfer agent, it must hand the records and the administrative controls, ”including administrative control over any smart contracts,” to its successor.

The letter settles how staff view the share register. It does not settle the adviser’s own custody duty. It does not interpret Rule 206(4)-2, the adviser custody rule, and the SEC’s agenda lists an amendment proposal for October 2026. Because the fund sells only direct, a client’s shares sit in the client’s own Benji account, outside the custodian that holds the rest of the portfolio. The adviser’s compliance counsel should decide whether an adviser with trading authority over that account has custody, and how the adviser reports the position.

Comparison

WisdomTree’s WTGXX is the only other registered money market fund Ketju has reviewed. BENJI is the same kind of claim with better public evidence. Both are 1940 Act government funds whose affiliated transfer agent keeps the official record and can correct the chain. WTGXX costs $1 to start through WisdomTree Prime, and BENJI costs $20 on Stellar. WisdomTree has not published its Stellar issuer, so we can read only its Ethereum contract. Franklin publishes every address on every chain, including the modules and the Solana programs. Where we can read both, the controls are similar: whitelist, freeze, clawback and an upgradeable contract. BENJI excludes retirement accounts outright.

BlackRock BUIDL, Circle USYC and Ondo OUSG are private tokenized Treasury funds on the Register. Unlike them, BENJI is open to a retail U.S. client with no accredited-investor or qualified-purchaser test. It carries a registered fund’s disclosure and board, and it redeems at a stable $1.00. It lacks what those funds offer institutions: an approved on-chain venue and a stablecoin redemption named in the prospectus. Holders can transfer only to other Benji holders. Against a conventional government money fund held at the client’s custodian, BENJI adds round-the-clock transfer to other whitelisted holders and little else. A client who wants a money fund for cash has simpler ways to own one.

Open questions

Four facts would change this memo. First, the state list: the prospectus says only that shares may be bought where eligible for sale. We found no published list, so we record the states as unconfirmed. Second, the keys: Franklin does not say which person or system holds each Stellar signer, each ROLE_TOKEN_OWNER address or the Solana upgrade key. Ketju will review the memo again if any of them changes. Third, the chains we could not read: Ketju cannot yet read Aptos, and the Authorization modules on Avalanche and Base are unverified. Fourth, the Benji app terms: Franklin shows them only inside its apps, and we did not rely on them. We rely on the prospectus and SAI.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.

ChainVerdictFreezeWhat it can do
StellarNot approved Issuer can freeze freeze is native at every level: issuers hold revocation and clawback flags on their assets, and since Protocol 26 the validator quorum can vote to freeze specific accounts and trustlines on-chain (CAP-77).
EthereumApproved No freeze key Ethereum has no sequencer, no upgrade key and no operator who can be compelled to act; rule changes require social consensus.
Polygon PoSNot approved Mixed control a public validator set orders transactions, but a 5-of-9 multisig can instantly upgrade staking and canonical bridge contracts, and a 5-of-8 multisig controls custom child tokens.
Arbitrum OneApproved with limits Mixed control a single sequencer orders more than 99% of transactions, and admin keys can upgrade bridge contracts on a timelock of about 7 days.
AvalancheApproved with limits Governed, no freeze no party can freeze or seize C-Chain funds, but one vendor writes the only production client and Messari measured over a third of stake hosted on AWS.
BaseApproved with limits Mixed control Coinbase, one regulated US company, operates the only sequencer, and admin keys can upgrade bridge contracts within about 7 days.
SolanaApproved with limits Governed, no freeze no admin key can seize funds, but stake is concentrating and the Nakamoto coefficient is below 25.
Every memo is public. Subscribers link the research to the positions their clients hold, and Ketju emails them when the evidence changes. $299 per firm per month, first 30 days free. Start the trial.