Who holds the keys

A backdoor is a legal requirement, not a defect

A plain ERC-20 has one transfer rule: the sender has the balance, so the balance moves. A security cannot run on that rule, because the law puts at least five conditions on its movement: who may hold it, when they may move it, how much they may hold, what happens after a court order, and who supervises all of that.

The last two are the awkward ones. The transfer agent, defined in chapter 1 as the licensed firm that keeps a fund's official shareholder list, carries a legal duty to execute court orders and to correct errors in the register. One that cannot technically move shares on an order cannot do the job it is registered for, so a product built to be legal has to carry a backdoor. Asking whether an RWA product has administrative keys answers itself.

A forced transfer moves a holder's tokens to another address without that holder's consent. In BUIDL, BlackRock's tokenized Treasury fund, which has run on Securitize's DS Protocol since 1 March 2024, the function that does this is called seize. A clawback takes the tokens away without sending them anywhere. On Stellar, where Franklin Templeton's BENJI has run since 2021, the operation of that name destroys the balance outright. Both powers are commonly summarized as an ability to freeze tokens, and that summary loses the difference that decides what a holder can get back.

The question worth asking has three parts: how narrowly the power is scoped, who holds it, and whether an outsider can check that it has not been used.

Six lines of code, one role, and one key above it

Securitize is the SEC-registered transfer agent and tokenization platform behind BUIDL, and DS Protocol is its own architecture rather than a public standard: the code carries an UNLICENSED header and belongs to no EIP, yet it is verified on-chain and readable. Its forced transfer is six lines of Solidity that move the balances and emit a Seize event next to the standard Transfer.

The modifier on seize is onlyTransferAgentOrAbove, not onlyMaster. DS Protocol numbers four roles, MASTER (1), ISSUER (2), EXCHANGE (4) and TRANSFER_AGENT (8), and the second-lowest of them is enough to take a holder's tokens. Burning from someone else's address runs through a different modifier, onlyIssuerOrTransferAgentOrAbove, and that circle is wider: the ISSUER role is enough to burn from any address and not enough to force a transfer. Reading the roles on-chain on 4 September 2026, eight entities in all held one of the roles that can burn from any address, two of them controlled by keys and six of them system contracts.

Two properties of seize point in opposite directions. The _reason recorded with a seizure is an arbitrary string with no reference to a document hash or an order registry, so the justification for taking someone's shares is a free-text field. The separate Seize event, though, means the operation cannot be hidden, because every use appears in indexers immediately.

An externally owned account, usually shortened to EOA, is an address controlled by a private key rather than by code, which is what distinguishes it from a contract or a multisig wallet. This is what held BUIDL's powers on the Trust Service contract 0x3a68756d0335e75c909ba1e8fefc1d4832c36c60 when I read it on 4 September 2026.

The last row carries the finding that outranks the rest. A proxy is a small contract that stores the address of another contract and forwards every call to it, so the logic can be replaced while the balances stay where they are. BUIDL's proxy 0x7712c34205737192402172409a8F7ccef8aA2AEc is not the OpenZeppelin pattern but a forty-line contract of Securitize's own, whose setTarget assigns a new implementation in one call. A timelock is an enforced delay between ordering an administrative change and that change taking effect, which gives holders time to leave. This proxy has none, no separation between proxy administrator and logic owner, and no multisig. One private key can swap the whole implementation in one transaction, and getRole() returns 1 for that same key.

The deployment history shows the opposite habit. The contract went live in block 19,343,277 on 1 March 2024 at 22:20 UTC, and the deployer renounced the MASTER role 22 minutes later, handing it to the address above.

The same power, built two other ways

OUSG does not have the function at all

Ondo Finance is a crypto-native issuer without a transfer agent registration of its own, and OUSG is its tokenized Treasury product. Its implementation 0x1CEB44b6E515aBf009E0CCb6ddaFD723886cf3Ff is a minimal extension of OpenZeppelin with a hook that checks the KYC status of the sender, the recipient and whoever submitted the transaction. Reading the full list of mutating functions from its ABI on 4 September 2026, there is no seize, no forcedTransfer, no freeze, no setAddressFrozen and no recoveryAddress. The contract cannot move a holder's tokens to another address, because nobody wrote a function that does it.

Burning from someone else's address is possible in principle, through burn(address,uint256) behind a BURNER_ROLE. That role has never been granted. Two methods agree: a scan of every RoleGranted event since the deployment block 16,234,210 shows not one grant of it, and hasRole() returns false for every address that has ever held any role at all.

That is a third state, and most analysis of these products knows only two. A power can be absent from the code, or present with nobody authorized, or present with authorized holders standing by. For OUSG the distance from the second state to the third is one grantRole call approved by a 4-of-7 multisig.

A multisig is a wallet that executes only when a set number of named signers approve, written as X of Y. Ondo split OUSG's powers across three of them at three thresholds: token administration on a 4-of-7 Safe, the identity registry on a 3-of-5 Safe, and the emergency pause on a 1-of-9 Safe. The lowest threshold is a design decision rather than an error, because any one of nine people can halt the token alone while destructive changes need four signatures.

Control over a holder runs through the KYC registry rather than any freeze function. The transfer hook requires a registry status for all three parties, so removing an address makes its transfer revert. That is a freeze in effect, and it is harder to spot from outside than an explicit flag: there is no event saying an address was frozen, only a registry removal that looks like routine compliance work.

BENJI puts the rules in the network instead of the contract

Franklin Templeton took the oldest route of the three. BENJI has no compliance smart contract, only flags on a Stellar issuer account, enforced by the network rather than by the issuer's code. The account GBHNGLLIE3KWGKCHIKMHJ5HVZHYIK7WTBE4QF5PLAKL4CJGSEU7HZIW5 verifies through its home_domain of www.franklintempleton.com, and on 4 September 2026 all three control flags were set: auth_required, so nobody holds BENJI without explicit authorization, auth_revocable, so authorization can be withdrawn and a balance frozen, and auth_clawback_enabled, so tokens can be taken from any account. The fourth flag, auth_immutable, is false, so the flags themselves can still be changed.

The signing model is where this gets interesting. The account's master key has weight 0 and cannot sign anything alone. Ten signers carry weight 3 and four carry weight 1, for a total weight of 34, against thresholds of 2 for low operations, 2 for medium and 6 for high. A clawback falls under the medium threshold, which a single weight-3 signer already clears, so one signer out of ten can take BENJI from any account or deauthorize it without consulting anyone. Changing the rules through SetOptions needs 6, which is two of those signers. Operations inside the rules are cheap and changes to the rules are expensive, the same asymmetry Ondo built with its 4-of-7 and 1-of-9 thresholds, expressed in a different system.

One share class, four chains, four mechanisms

Everything above rests on Ethereum, and for BUIDL that is the largest hole in the argument, because each deployment is a separate contract rather than a copy. I read BUIDL's powers on Ethereum on 4 September 2026 and then directly on Avalanche, Solana and Aptos on 5 September 2026. That is four of the eight or nine chains the sources give for this product; Arbitrum, Optimism, Polygon, BNB Chain and Tempo were not read. Addresses came from CoinGecko's platform mapping and each was then verified by calling symbol(), name() or reading metadata on the target chain, because an address from a third-party service is not yet evidence that the contract being read is the right one.

One result is the same everywhere: an equivalent of seize exists on every chain I read, and I found a multisig on none of them.

On Avalanche the token 0x53fc82f14f009009b440a706e31c9021e1196a2f points at an implementation whose bytecode carries selectors for seize(address,address,uint256,string) and omnibusSeize, and none for forcedTransfer, freeze, unfreeze, mint or setTarget. This deployment does not repeat the Ethereum proxy pattern: it uses a standard ERC-1967 layout with an empty admin slot and upgrades through upgradeToAndCall in the implementation itself, and owner() returns an address with no code behind it.

On Solana the mint GyWgeqpy5GueU2YbkE8xqUeVEokCMMCEeUrfbtMw6phr runs on Token-2022 with the permanentDelegate extension enabled, which lets the named delegate move or burn tokens from any holder's account and cannot be revoked the way an ordinary approval can. The delegate APm3MWbXfMMKAWgsDVnxcAGbLjvRxubPu1A8a5SA2kbJ is not a private key: it holds 73 bytes of data and belongs to the program 7tXjmbkZVY3Gmg9kDBebcNXT1yC5pyoxxXVLwdbv9tvP. That is one level better than Ethereum and only one, because the upgrade authority of both relevant programs is 8d36iv2YUD8yDChuVZchx1NqE4qkDWCAEgsUEEUqzbB6, a plain system account with zero bytes of data. Whoever controls it cannot seize tokens with one signature, and can replace the code that does.

On Aptos the powers are expressed in a way no EVM chain offers. The fungible-asset object carries an Untransferable resource, which switches off ordinary transfers at the level of the standard itself, so the token moves only through the issuer's dispatch functions. The seizure function is named exactly as in Solidity, ds_token::seize(&signer, address, address, u64, String), an entry function with the same free-text reason. The module account is an object account whose sequence_number is 0, meaning it has never signed a transaction itself, and its owner holds no multisig resource.

The supplies rearrange the picture as well. Of the four classes I read, Solana holds 51.1% against Ethereum's 11.1%, which makes the Solana class 4.6 times the size of the Ethereum one. Any statement about this product drawn only from Ethereum describes about a ninth of the supply it can see, including the statements earlier in this chapter.

When the register and the chain disagree, the register wins

Code is not the top of this stack. Steakhouse Financial, reading BUIDL's offering memorandum in April 2024, reports that ownership of class A shares is visible on Ethereum while legal title and beneficial ownership are reflected in a register of members kept by the transfer agent, that this register governs legal ownership in all circumstances, and that where the register and the blockchain disagree the register decides. That reading quotes a document the author of this series has not seen.

Securitize's own filings describe the same construction from the other side. Its Form S-1 and 424B3 for fiscal 2026 say it acts as an SEC-registered transfer agent for most clients and uses a public blockchain as the master securityholder file, holding wallet addresses, balances, share counts, purchase dates, transaction identifiers and investor status on-chain, and names, addresses and tax numbers off-chain. A master securityholder file is a defined regulatory term rather than a marketing one: Rule 17Ad-10(b) makes it the official list of individual securityholder accounts and allows it, for uncertificated shares of registered funds, to consist of several linked automated files. The chain is one of those files, not a replacement for the set.

The newer generation of filings words the same architecture the other way round. BlackRock's Form 485APOS of 8 May 2026 introduces an OnChain Shares class whose official record of ownership is kept on a public blockchain by the transfer agent, BNY Mellon Investment Servicing (US) Inc., and states that the blockchain records together with the off-chain register mapping wallets to shareholder identities conclusively govern record ownership, absent a technical failure of either system. A prospectus of the same date for the BlackRock Daily Reinvestment Stablecoin Reserve Vehicle puts that official record with Securitize Transfer Agent, LLC instead, across Ethereum, Tempo and Solana. One manager, two transfer agents, two register architectures.

Franklin Templeton's FOBXX shows what a regulator accepts and why. On 12 August 2026 the SEC's Division of Investment Management issued a no-action letter allowing Franklin's registered funds to hold FOBXX shares through the linked blockchain system without complying with paragraphs (b), (e) and (f) of Rule 17f-2, under 12 conditions covering account segregation and transaction controls. The staff's stated reason is that the transfer agent retains unilateral control over the official record of ownership. Permissioning is what makes that acceptance possible.

For a holder this reverses the instinct that the chain is the source of truth. If a contract shows a balance and the transfer agent's register does not, the register binds, and after a technical failure or a contract bug the reconstruction runs from the register. Chapter 6 meets the same asymmetry in the data layer, where the authoritative number also lives off-chain and the on-chain copy is the thing that goes stale.

What the chain settles and what it leaves open

Three things are settled by reading. The first is the rule set, because the parameters that sit in an offering document for a traditional fund sit in a contract here, in BUIDL's case ComplianceConfigurationService at 0x1dc378568cefd4596c5f9f9a14256d8250b56369.

Those readings contradict two common descriptions of these funds at once. The investor limit was used at 4.5% on 4 September 2026, so capacity is not what keeps retail out, and the lock-up is 24 hours rather than a year. This is a product locked to a narrow group, not locked for a long time.

The second settled thing is cost. BUIDL's checks run across eleven separate contracts on every transfer, among them InvestorLockManager and ComplianceServiceRegulated, and the median gas used by an identical transfer call on Ethereum mainnet on 4 September 2026 was 4.07 times that of USDC.

The third is whether the powers have been used here. Scanning BUIDL's logs by event topic from the deployment block 19,343,277 to 4 September 2026 returns the following.

The forced-transfer power has existed since 1 March 2024 and has not been used once on this chain, and the token has never been paused. On OUSG the role that burns from other addresses has never been granted to anyone.

What the chain leaves open is larger. The 208 Burn events cannot be split into redemptions and confiscations, because both emit the same event and the contents of the _reason strings were not read; reading them as redemptions is consistent with how this fund settles a withdrawal, and it is an interpretation rather than a measurement. On BENJI I found no clawback operation, in a sample of the issuer account's last 200 operations covering roughly 7.5 hours, which says nothing about the asset's history since 2021. Use of the seizure power on Avalanche, Solana and Aptos was not evaluated at all: a full log scan on Avalanche alone would take 20,451 requests at the public node's 2,048-block limit across 41,884,144 blocks of history.

Five ways these products have actually failed

Administrative powers are one risk among five, and the other four decide more outcomes. An underlying asset can default, and the loss lands in the NAV, which is how credit exposure is meant to behave. A contract can be hacked, and here the compliance machinery cuts the other way: an attacker in a whitelisted product ends up holding tokens the contract will not let him send to any address off the list, and the transfer agent can usually reverse the theft with the same forced transfer that makes the product uncomfortable to hold.

The issuer can go bankrupt, and whether the holder has a claim on segregated fund assets or a place in a creditor queue depends on the legal level rather than the code. The custodian can go bankrupt, and the question there is whether assets were segregated or sat on the custodian's balance sheet. The fifth is the one that keeps happening: the issuer decides to stop. USDM is the case that shows it, because nothing broke. From 22 August 2025 the token was no longer backed by Treasury bills or redeemable at 1 USD from the issuer, and its backing became another stablecoin in a Uniswap pool. The bills were sound throughout, and the issuer used a right it had held from the start.