ST0x tokenized stocks (S01 Issuer GmbH)

Review open since 2026-10-06: ST0x tokenized stocks and ETFs (S01 Issuer GmbH debt tokens on Base; traded as wt- vault shares) on Base: Beacon owner gained a holder: 0x48ba1371a78e6cc54157c63721756ab444510db3, a timelock with a 2-day delay (not checked against the chain’s log); Beacon owner lost a holder: 0xe70d821f3462a074e63b42d0aac6523faae1d611 (not checked against the chain’s log) (read at block 52204438). Ketju will review the file before any client action. A draft revision dated 2026-10-06 is under audit and would change the assessment. The verdict stands until the review closes.

Summary

Ketju does not approve ST0x tokenized stocks: the prospectus bars US persons, and a non-US holder gets an unsecured debt claim on a thinly capitalised issuer whose contracts a small group of keys can stop. Each token is a debt claim on S01 Issuer GmbH, a Berlin company with EUR 25,000 of share capital and no licence. The FMA Liechtenstein approved its base prospectus on 30 March 2026. The holder may ask the issuer to deliver one share of the named stock or ETF to a brokerage account, and receives in stablecoin the dividends the issuer collects. S01 Issuer holds the shares as its own hedge, outside any trust, pledge or segregated account. If S01 Issuer fails, holders rank with its other unsecured creditors. The tokens that trade are ERC-4626 vault shares (wt-tokens) that hold the issued t-tokens. CoinGecko lists 20 wt-tokens worth about $1.65 million on 23 September 2026. Almost all issued tSPYM sits inside the wtSPYM vault, so the vault contract holds the claim that the prospectus describes until a buyer unwraps. One 3-of-6 Safe owns every t-token. It can freeze all transfers, replace the contract that approves transfers, upgrade the t-tokens and the wrappers through two shared beacons, and grant the role that confiscates any balance. A single externally owned key holds the certifier role, and if certification lapses, every holder transfer stops.

Review triggers
• S01 Issuer pledges or segregates the hedge shares for holders, or appoints a security agent
• The owner freezes a token, replaces the authorizer, upgrades a beacon, or anyone is granted a confiscation role
• A certifier forces certification backwards or lets it lapse
• The issuer suspends exchanges, exercises the call option, or announces a Security Event
• The prospectus lapses on 29 March 2027 without a successor

Ketju checks this memo every night. A review opened on 2026-10-06 and appears under the verdict above. The verdict stands until the review closes.

Research

How it works

The prospectus calls the products ”Token (debt instruments)” under German law with no ISIN. Each token ”solely confers a contractual right to redeem Tokens … against one such Share,” and grants ”No voting rights, dividend rights … rights to participate in rights issues or Shareholder meetings.” The right is to a share of the same class, never to a specific share, and ”The Issuer is not obliged to acquire, maintain, or hold any specific Share for the benefit of Investors.” The ST0x FAQ states: ”Holders are unsecured contractual creditors of the Issuer,” and the position the issuer keeps with a US broker-dealer is ”held for the Issuer, not on trust for holders.” Under the SEC staff statement of January 2026 the token is a synthetic tokenized security: a note that refers to a stock, with physical settlement on request.

Dividends reach holders only as far as the issuer receives them. The terms promise Distributions in ”USS” (USDC or another authorised stablecoin) from a claim vault with a Merkle entitlement list, less any distribution or management fee the Final Terms set. The issuer has published no Final Terms on its site, so the fee rates for any filed token are not known.

Contracts

Each stock has a t-token and a wt-token on Base. The t-token (tSPYM at 0x8fdf…debfbb) is a Rain OffchainAssetReceiptVault that S01 Issuer mints when shares reach its broker account and burns when it delivers shares back. The wt-token (wtSPYM at 0x31C2…c2d8) is a plain ERC-4626 vault whose only asset is the t-token. Its source says the wrapper ”never produces yield or rebases,” so dividends and splits that change the t-token show up as a rising exchange rate: on 23 September 2026 the wtSPYM vault held 9,749.6 tSPYM against 9,705.2 wtSPYM. The ST0x markets, the CoinGecko listings and the DEX liquidity are all in the wt-tokens. The site’s token list names 54 pairs, and Ketju covers the eight largest by market value. All 54 share one t-token beacon, one wt-token beacon, one owner and one authorizer.

The prospectus describes only the t-token. A wt-token holder’s claim on the vault’s t-tokens rests only on the vault code. To reach the issuer, the holder must redeem the wt-token for t-tokens, then use the issuer’s Core Bridge interface.

Who controls it

We read the contracts on 23 September 2026. Safe 0xe70d…d611 owns every t-token; it has 3 of 6 signers, and their names are not published. The owner can call ownerFreezeUntil, which stops all transfers until a date the owner cannot bring forward, with exceptions for addresses it marks as always allowed. The owner can replace the authorizer contract that approves every transfer, deposit, withdrawal and confiscation. As owner of both beacons, it can replace the code of all t-tokens and all wrappers at once. The shared authorizer (0x315b…f0cd) lets anyone transfer while certification is current. The Safe and one externally owned address (0x3d0c…e8ae) hold the certifier role, and certify accepts a forced earlier date. One key can therefore end certification and halt holder transfers. Confiscation moves any holder’s t-tokens to the caller. No address held that role on 23 September 2026; the Safe administers it and can grant it. The prospectus warns of both: ”a confiscation functionality enabling the transfer of Tokens from any Investor to a designated Wallet” and a ”smart contract-based freeze function” on a security event, after which the issuer may airdrop replacement tokens and leave out wallets it links to the event.

A confiscation or freeze aimed at the wtSPYM vault address would hit every wtSPYM holder at once, because the vault holds nearly all tSPYM.

Eligibility and withdrawals

The prospectus says the products ”may not be offered, sold or delivered within the United States to, or for the account or benefit of, U.S. Persons” and names public offers in Liechtenstein, Germany, Luxembourg, France, Spain and Italy. A holder needs no onboarding to hold the token; the st0x.io site sells its SGOV token with ”No KYC.” To mint or redeem, the holder must name an account at a broker the issuer designates, and ”Should an Investor be unable to maintain or open an Account with any Eligible Broker,” the issuer owes no alternative. The smallest redemption is tokens worth US $10.00. The Core Bridge ”may require several hours to multiple weeks,” and the issuer may suspend exchanges on a broker insolvency, a trading halt, a corporate action or regulation, in which case it ”may be entitled to sell all the Shares it holds” and pay stablecoins. It may also end a token on 30 business days’ notice under its call option. Most holders sell on the Raindex order books on Base, where the depth of the market depends on arbitrageurs.

Comparison

ST0x resembles Robinhood’s Jersey tokens and Backed’s xStocks: each is debt of a small issuer, approved in Liechtenstein and closed to US persons, with an admin that can freeze and seize. ST0x gives the holder less security than either. xStocks and Robinhood pledge the hedge to a security agent for each series; S01 Issuer pledges nothing and keeps the shares in its own estate. ST0x also adds the ERC-4626 wrapper, which neither of the others has. The wrapper separates the token people trade from the instrument the prospectus governs.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

• S01 Issuer GmbH, Base Prospectus, Program on the Issuance and Offer of Token (30 March 2026) · primary · accessed 2026-09-23
  Supports: debt instruments, no ISIN, German law, no rights in a specific share, no vote, Distributions in USS from a claim vault, unsecured, unsegregated hedge, US persons barred; six offer countries, broker account needed to redeem; minimum US $10.00, Core Bridge delays, suspension, sale of shares, confiscation and freeze functions; replacement tokens, Issuer Call Option, EUR 25,000 share capital
• ST0x FAQs · primary · accessed 2026-09-23
  Supports: unsecured contractual creditors, hedge held for the issuer, not on trust, markets trade wrapped vault shares
• ST0x home page · primary · accessed 2026-09-23
  Supports: SGOV sold with no KYC
• S01 Issuer GmbH, Prospectus page · primary · accessed 2026-09-23
  Supports: only the base prospectus is posted; no Final Terms
• StoxReceiptVault implementation on Base (Sourcify exact match) · primary · accessed 2026-09-23
  Supports: ownerFreezeUntil, setAuthorizer, confiscateShares, certify with forceUntil, authorizer role model
• StoxWrappedTokenVault implementation on Base (Sourcify exact match) · primary · accessed 2026-09-23
  Supports: ERC-4626 wrapper; revaluations in price
• Blockscout, Base: role grants and revocations on authorizer 0x315b16faa6ee413fabca877d3851b3818369f0cd · secondary · accessed 2026-09-23
  Supports: CERTIFY held by the Safe and 0x3d0cd66e…e8ae, no CONFISCATE_SHARES holder; Safe is its admin

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.