KETJU Research

← The Register

Tokenized commodities

Matrixdock gold and silver (XAUm, XAGm)

Not approved The evidence weighs against it

Review open since 2026-10-02: Matrixdock Silver (XAGm) on Sui: the power to freeze a holder is now no, the file recorded yes; the power to pause transfers is now no, the file recorded yes; the power to change the contract code is now no, the file recorded yes (read at block 329024421). Ketju will review the file before any client action. A draft revision dated 2026-10-02 is under audit. The verdict stands until the review closes.

Verdict
Not approved
The evidence weighs against it
Who can freeze it
No freeze key
Withdrawals
Minting and redeeming need a Matrixdock account and KYC.
Reviewed
2026-09-23
Researched memo

Summary

Ketju does not approve Matrixdock gold and silver (XAUm, XAGm): the XAUm terms contradict themselves on whether the holder owns the gold, and two single keys can block any address at once. XAUm is Matrixdock’s gold token, one troy ounce per token, and XAGm its silver token. Matrixdock is the real-world-asset arm of Matrixport. On 2026-09-23 Matrixdock reported 16,491.918 XAUm against 16,491.924 ounces of gold in 513 kilo bars. It reported 73,040.462 XAGm against 72,927 ounces of silver. Together the two were worth about $76 million. The bars sit at Brink’s in Hong Kong and Singapore and at Malca-Amit in Singapore, and Bureau Veritas counted every bar in July 2026. Section 2.2 of the XAUm terms grants the holder “legal and beneficial ownership.” Section 9.1 says value in the gold “accrues for the benefit of Token Issuer.” XAGm has no terms at all. The documents say privileged operations are time-locked. On 2026-09-23, though, one owner key and one operator key ran every EVM contract. The same operator key writes the reserve number that caps minting. A physically backed ETF or PAX Gold gives a client gold or silver without these gaps in terms, custody and attestation.

Research

How it works

The XAUm Token Terms and Conditions (last revised October 21, 2025) name Matrix Mining Limited as the Token Issuer and Matrix Infinitus Hong Kong Limited (Matrix HK) as the company that keeps the gold. Section 2.2 says each token is “legal and beneficial ownership of a single troy ounce” of a kilo or Good Delivery bar. The bar is held either allocated at Malca-Amit or Brink’s or “on an unallocated basis (not identifiable by a unique serial number) with a reputable financial institution.” The section makes the holder the bearer of a document of title and names the Matrix entities as bailee. That is the language of a warehouse receipt.

Section 9.1 then says the gold is held “for the accounts of Matrix HK,” that Matrix HK holds it “as agents for Token Issuer,” and that value in it “accrues for the benefit of Token Issuer.” Section 9.1.1 adds that Matrix HK grants the issuer a security interest in Matrix HK’s property under an intercompany note. Section 9.1.2 says the holder has no relationship with the vaults. In a bailment the bailor owns the goods and the bailee holds them for the bailor. Here the terms name the issuer as the party the custodian acts for, and the holder is not named. The terms choose British Virgin Islands law and arbitration, and they do not settle which section a court there would follow. Matrixdock says a purpose trust owns the issuer, with Appleby Global Services as trustee and Hamilton Services as enforcer, to keep the gold away from Matrixport’s creditors. That structure protects the issuer from its parent; it does not protect the holder from the issuer.

XAGm has no terms and conditions. The XAUm terms name only XAUm. The XAGm white paper (17 March 2026) says each token “represents fractional ownership” of LBMA silver bars. Its notice says the paper “is not intended to be legally binding.” An XAGm holder therefore has a description of the token and no contract.

Fees

XAGm uses what Matrixdock calls the Fungible Reserve Standard. At launch one token stood for one ounce. Each day the contract lowers ozPerToken by the annual custody fee divided by 365. The fee collector may then call reconcileSupply to mint new tokens, so that supply times ozPerToken still equals the silver in the vault. The fee is 0.30% a year; on 2026-09-23 ozPerToken was 0.998446576. Holders pay the fee by dilution: their token count stays the same while each token buys less silver. The white paper promises 30 days’ notice of a fee change. The verified contract, however, lets the owner key call updateAnnualFeeRate at any moment, up to a hard cap of 10% a year, with no delay. XAUm has no fee yet; the white paper says one may come with 30 days’ notice.

Who controls it

XAUm runs on Ethereum, BNB Chain, Plume, HyperEVM, Solana, Sui, Stellar, and Circle’s Arc. Matrixdock retired Polygon, HashKey Chain, and Tron on 2026-08-07. XAGm runs on Ethereum and Sui. On every EVM chain the owner is 0xb573…36d7 and the operator and revoker are both 0x89bb…7799. Neither address holds contract code, so each is a single private key and neither is a multisig or a timelock contract.

The contracts do contain delays. The owner must request an upgrade or a new operator and wait the set delay, 14,400 seconds (four hours) on 2026-09-23, and a mint request waits the same time. The revoker can cancel a pending request, but the revoker key is the operator key. Other powers take effect at once. The operator’s addToBlockedList stops the address sending as soon as the operator calls it. On XAGm the owner’s forcedTransfer moves any holder’s balance to any address at once. The XAUm code lacks forcedTransfer, but a four-hour upgrade could add it. On Solana one address, the mint’s own key, is the mint, freeze, pause, permanent-delegate, and transfer-fee authority. The holder of that key can freeze, pause, or take any balance and set a transfer fee. The HyperEVM implementation is not verified, so we could not read its powers. The terms mention none of this. They say only that Matrixdock may upgrade the contracts and suspend a user’s access.

Reserves

The white paper describes a Proof of Reserves oracle: the Ethereum contract will not raise the mint budget past the reserve the feed reports. The feeds Matrixdock lists are FallbackReserveFeed contracts whose owner types in the number. On 2026-09-23 the owner of both was the operator key, 0x89bb…7799, the same key that mints. The gold feed last read 14,209.416 ounces, set on 2026-06-08. The Ethereum contract’s running total of reserve drawn was 13,695.048 ounces, while Matrixdock reported 16,491.918 XAUm outstanding. The gap is possible because the Solana, Sui, and Stellar tokens mint under their own keys, so the Ethereum cap binds only the EVM side. On chain, Matrixdock is reporting its reserves to itself.

Bureau Veritas makes the physical check. Its report of 17 July 2026, issued to Matrix HK, says inspectors weighed all 508 gold kilo bars and 66 silver bars on the list Matrix HK furnished as of 30 June 2026. The bars were at Brink’s Hong Kong, Brink’s Singapore, and Malca-Amit Singapore, and each was at standard weight. A full count is better than a sample. But Bureau Veritas inspected bars on the client’s list twice a year and did not attest that tokens and bars match. The custody page promises quarterly audits, and the white paper says “every quarter.” The report also says inspectors checked the weights against “ICBC’s Vault Management System.” ICBC, a bank, appears nowhere else in Matrixdock’s documents. Matrixdock says Brink’s insurance covered up to $50 million as of 29 November 2024, against gold now worth about $71 million.

Eligibility and withdrawals

Minting and redeeming need a Matrixdock account and KYC. Unlike STBT, XAUm asks for no accredited-investor check. The smallest mint is $10,000 of stablecoins. The smallest XAUm redemption is 32.148 XAUm, one kilo bar, about $137,000 at the 2026-09-23 redeem price, whether the holder wants gold or stablecoins. The smallest XAGm redemption is 2,100 XAGm, about $132,000. Fees are 0.25% on XAUm redemptions and 0.50% on XAGm; minting is free for now. Orders run during New York trading hours and settle T+3. Holders collect physical bars in Hong Kong or Singapore or receive them by secured delivery, subject to inventory. The prohibited list names North Korea, Iran, Syria, Myanmar, Cuba, Crimea, Sevastopol, Russia, and the EU member states. It does not name the United States, but the terms let Matrixdock close any jurisdiction “in their sole discretion.”

The terms say XAUm “is transferable solely to persons that satisfy the eligibility requirements.” The docs say “Holding/transfer/secondary swaps of XAUm is permissionless,” and the contracts check nothing but the block list. A holder who bought on a DEX therefore owns a token the terms say it may not receive. That holder cannot redeem without an account and a kilo’s worth of tokens, and must depend on DEX and exchange prices to sell.

Comparison

We compare XAUm with PAX Gold. XAUm redeems in smaller bars (a kilo against a 400-ounce bar) and runs on more chains, but its terms and keys are weaker. PAXG’s terms call it a warehouse receipt and contain no clause that hands the value to the issuer. Paxos is an OCC-supervised trust bank, KPMG attests monthly, and the Ethereum owner is a timelock contract with a one-day delay. We also compare both tokens with a physically backed ETF. Against that ETF, both add a private company’s keys, a reserve feed the issuer reports itself, and redemption only in kilo lots through one issuer. XAGm is weaker than XAUm: it has no terms, its owner can take balances, and its owner can raise the fee without notice. Ketju will review both tokens again if Matrixdock reconciles Sections 2.2 and 9.1 in the holder’s favor and publishes terms for XAGm. Matrixdock would also need to move the owner and operator roles to multisigs or timelock contracts that cover the block list and forced transfer, and give the reserve feed to a party other than the minter.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.

ChainVerdictFreezeWhat it can do
EthereumApproved No freeze key Ethereum has no sequencer, no upgrade key and no operator who can be compelled to act; rule changes require social consensus.
BNB Smart ChainNot approved Issuer can freeze the validator set concentrates around one company, and the chain’s operators have halted it on purpose.
SolanaApproved with limits Governed, no freeze no admin key can seize funds, but stake is concentrating and the Nakamoto coefficient is below 25.
SuiNot approved Issuer can freeze validators have frozen and moved funds: their standing deny lists began freezing the Cetus exploiter’s ~$162M within about 80 minutes, and a Foundation-organized vote later moved the frozen funds without the owner’s keys.
StellarNot approved Issuer can freeze freeze is native at every level: issuers hold revocation and clawback flags on their assets, and since Protocol 26 the validator quorum can vote to freeze specific accounts and trustlines on-chain (CAP-77).
Hyperliquid / HyperEVMNot approved Issuer can freeze the same 21 permissioned validators operate both the chain and its bridge.
Every memo is public. Subscribers link the research to the positions their clients hold, and Ketju emails them when the evidence changes. $299 per firm per month, first 30 days free. Start the trial.