Skip to content
Web3 Academy

Tokenized Treasury fund

A tokenized Treasury fund gives an on-chain holder a programmable claim whose value is linked through a fund, official ownership records, custody, and redemption procedures to cash and short-term U.S. government debt.

The token is not a Treasury security merely because its interface says “Treasury.” This generic educational composition models an on-chain wrapper holding issuer-sponsored tokenized fund shares. Direct fund ownership, third-party custodial receipts, synthetic tokens, stable-NAV distribution funds, and other jurisdictions require different claim and accounting models. This page is not legal, tax, or investment advice.

Objective and system boundary

Section titled “Objective and system boundary”

The objective is to give on-chain users exposure to short-term government debt without pretending that issuance, custody, banking, legal ownership, or redemption has moved entirely into a smart contract.

User --stablecoin--> Wrapper --cash subscription--> Fund issuer
User <--wrapper share-- Wrapper <--tokenized fund share-- Fund issuer
Fund --portfolio cash--> Custodian / broker --purchase--> Treasuries
U.S. Treasury --interest + principal--> Custody chain --> Fund
Fund --redemption cash--> Wrapper --stablecoin or cash--> User

The system boundary includes the stablecoin and its issuer, wrapper contracts, wallet eligibility, fund legal entity and governing documents, investment manager, transfer agent and official shareholder record, administrator, custodian, broker, bank and payment rails, Treasury securities and issuer, auditor and valuation sources, regulators and courts, and every governance, freeze, recovery, and upgrade authority.

Selected structure and non-goals

Section titled “Selected structure and non-goals”

This study chooses one inspectable structure:

  1. The on-chain user owns a wrapper share.
  2. The wrapper is the eligible investor of record in a tokenized fund.
  3. The wrapper owns tokenized fund shares issued by or for that fund.
  4. The fund owns portfolio assets through its custodian and broker records.
  5. The portfolio contains cash, short-term Treasury securities, and any expressly permitted instruments or receivables.

If the user instead owns fund shares directly, the wrapper layer disappears. If an unaffiliated third party issues a receipt or synthetic exposure, the issuer, counterparty, bankruptcy, and redemption analysis changes materially. The example does not classify any unnamed product or determine which law applies.

Layer mapping

Section titled “Layer mapping”

Tokenization changes recordkeeping and programmability. It does not make the wrapper the issuer of Treasuries, make token holders direct Treasury creditors, or make off-chain performance machine-enforceable.

Actors, assets, claims, and obligations

Section titled “Actors, assets, claims, and obligations”

The wrapper share is a pooled share and conditional redeemable claim on wrapper net assets. The tokenized fund share is a separate pooled share under the fund’s documents and official records. The Treasury security is a debt claim held in the custody chain. A stablecoin is a direct asset at its on-chain ledger layer and may also carry an issuer redemption claim; it is not the portfolio security. Collapsing those four objects hides different issuers, holders, priorities, transfer rules, and remedies.

Section titled “Legal, issuer, recordkeeping, and custody boundary”

“On-chain ownership” is incomplete unless the issuer states how wallet addresses map to holders, which record controls, how restricted transfers are recognized, and what happens after key loss, sanctions, court order, bankruptcy, chain reorganization, or disagreement between records.

Step-by-step mechanism

Section titled “Step-by-step mechanism”
  1. Qualify and map the holder. The wrapper or distributor verifies required eligibility and maps the user’s wallet to the applicable account and transfer rules.
  2. Deposit and mint wrapper shares. The user transfers an approved stablecoin. The wrapper mints shares using pre-deposit net asset value, eligible supply, fees, and rounding.
  3. Cross into cash settlement. An authorized provider converts or settles stablecoins into bank cash. Until settlement is final, the wrapper may hold a provider or bank claim rather than spendable cash.
  4. Subscribe to the fund. The wrapper sends a valid order and cash. The fund or transfer agent accepts the subscription, records the wrapper as holder, and issues tokenized fund shares under the selected official-record model.
  5. Acquire portfolio assets. The manager directs the custodian or broker to purchase eligible short-term Treasuries or other expressly permitted assets.
  6. Accrue value and obligations. Treasury interest, discount accretion, maturities, portfolio price changes, cash, receivables, fund expenses, wrapper fees, taxes, and impairments enter NAV at stated recognition times.
  7. Reconcile records. Token supply, the transfer-agent file, wrapper assets, custody statements, bank cash, portfolio holdings, liabilities, and eligible share supply reconcile before prices or redemptions are published.
  8. Request redemption. A user submits wrapper shares. The wrapper checks eligibility, cut-off time, liquidity, queue, limits, and the applicable NAV.
  9. Source and settle cash. The wrapper redeems fund shares; the fund uses cash, maturities, or asset sales; intermediaries settle bank cash; an authorized provider transfers cash or stablecoins to the user.
  10. Burn and finalize exactly once. Wrapper and fund-share records change in the documented order. A failure after lock or burn remains a visible pending claim and cannot be mistaken for a completed payment.

Redemption boundary and failure states

Section titled “Redemption boundary and failure states”

Redemption is a multi-system state machine, not a single token transfer:

requested
→ eligibility and cut-off accepted
→ wrapper shares locked or burned
→ fund order accepted at a named valuation time
→ fund shares canceled
→ portfolio cash sourced
→ bank and conversion settlement final
→ user receives cash or stablecoin
→ pending claim closed exactly once

Every intermediate state needs an owner, amount, deadline, cancellation rule, retry rule, and recovery path. Burning before off-chain payment creates a pending receivable; paying before an irreversible burn can create duplicate value. A quoted NAV is not proof that cash is available immediately or that a particular wallet is eligible to receive it.

The six connecting flows

Section titled “The six connecting flows”

These labels carry meaning without relying on color.

Balance sheet and accounting model

Section titled “Balance sheet and accounting model”

For this composition:

wrapperNetAssetsUsd = eligibleFundShareValueUsd
                    + settledCashUsd
                    + recognizedReceivablesUsd
                    - recognizedLiabilitiesUsd


wrapperNavPerShareUsd = wrapperNetAssetsUsd / eligibleWrapperShares
grossRedemptionUsd = sharesBurned * applicableNavPerShareUsd
netPaymentUsd = grossRedemptionUsd - userAllocatedExitCostsUsd

Fund-share value must already include the portfolio assets, accrued income, fund fees, and fund liabilities recognized in the fund’s NAV. Adding the underlying Treasuries or their interest again at the wrapper layer would double count value. A stable-NAV fund that distributes income and an accumulating fund that raises share value require different state transitions; this example uses the accumulating model.

Numerical NAV and redemption example

Section titled “Numerical NAV and redemption example”

Assume only for an inspectable accumulating-share model:

  • users deposit 1,000,000 stablecoin units, each settled at USD 1;
  • the wrapper and fund each issue 1,000,000 eligible shares at USD 1;
  • subscription settles at par with no opening fee in this example;
  • the portfolio earns USD 50,000 of gross interest and discount accretion from its permitted assets during the period;
  • fund management, administration, custody, and other expenses total USD 3,000;
  • wrapper, banking, conversion, and operating expenses total USD 2,000; and
  • all income, expenses, holdings, cash, and liabilities are recognized before the ending valuation time.
endingWrapperNetAssetsUsd = 1,000,000 + 50,000 - 3,000 - 2,000
                          = 1,045,000
endingWrapperNavPerShareUsd = 1,045,000 / 1,000,000
                            = 1.045

Now one user redeems 100,000 wrapper shares. The applicable NAV is USD 1.045 per share and user-allocated exit costs are USD 200.

The cost assigned to the redeeming user reduces that user’s cash without diluting the remaining holders. If instead the wrapper socializes the cost, the remaining NAV per share falls. The actual product terms must say which model applies.

An accounting NAV of USD 104,500 for the redemption does not promise same-day payment. If only USD 60,000 is executable within the product’s deadline and loss limit, the remaining USD 44,500 is a queued or otherwise pending claim—not cash already delivered. If a final custody, issuer, or legal recovery estimate falls by USD 50,000 before redemption, the loss belongs in NAV; absent junior capital, insurance, or a valid service-provider claim, wrapper shareholders absorb it.

Return source and loss allocation

Section titled “Return source and loss allocation”

The smart contract does not create Treasury yield. The U.S. government pays interest and principal on Treasury debt to the holder through the custody chain. A repo or cash counterparty pays any separately permitted income. Managers, administrators, transfer agents, custodians, banks, auditors, conversion providers, and wrappers receive disclosed fees or costs. What reaches shareholders is the portfolio’s realized and accrued value after all recognized expenses, taxes, impairments, and losses.

Loss or delay can arise from market-price changes, early sale, stablecoin or bank failure, fund or wrapper insolvency, custody shortfall, record mismatch, unauthorized transfer, stale NAV, legal ineligibility, sanctions, settlement failure, smart-contract defect, or unavailable liquidity. Treasury’s payment obligation does not guarantee the solvency, liquidity, or operational performance of every intermediary and wrapper above it. The residual loss reaches the holder whose claim sits at the affected layer unless governing documents, law, insurance, reserves, indemnity, or junior capital allocate it elsewhere.

Control and integration boundaries

Section titled “Control and integration boundaries”

Before treating the wrapper share as “on-chain Treasury cash,” inspect:

  • the wrapper issuer, fund legal entity, jurisdiction, governing documents, offering or eligibility basis, shareholder rights, and investor remedies;
  • whether the chain is the official holder record, part of that record, or an instruction source for a separate master file;
  • the exact owner or entitlement holder at each bank, transfer agent, custodian, broker, central securities depository, and payment provider;
  • permitted portfolio assets, maturity and liquidity limits, valuation policy, income recognition, fees, taxes, impairment, audit, and reporting cadence;
  • subscription and redemption cut-offs, cash-versus-stablecoin settlement, queues, minimums, caps, notice, cancellation, finality, and recovery paths;
  • wallet eligibility, transfer restrictions, freeze, forced transfer, key recovery, sanctions, pause, upgrade, mint, burn, and emergency authorities; and
  • which court, regulator, insolvency rule, insurance, reserve, indemnity, or wind-down process applies when on-chain and off-chain records disagree.

The composition links existing canonical concepts instead of creating another relationship graph. Its principal dependencies include token, asset versus claim, real-world asset, fund, vault share, fee, governance risk, liquidity risk, accounting risk, smart-contract risk, and integration risk.

Protocol, regulatory, and source boundaries

Section titled “Protocol, regulatory, and source boundaries”

The U.S. Treasury’s marketable-securities FAQ describes Treasuries as debt instruments and explains the government’s interest and principal payment commitment. That commitment belongs to Treasury securities; it is not a guarantee of this generic wrapper, its stablecoin, service providers, liquidity, token price, or redemption timing. The FAQ was reviewed 2026-08-10.

A January 2026 multi-division SEC staff statement on tokenized securities distinguishes issuer-sponsored records from third-party custodial and synthetic models, and explains that on-chain and off-chain records can play different roles. The statement says it represents staff views, has no legal force or effect, and does not replace product-specific legal analysis.

The current Franklin OnChain U.S. Government Money Fund prospectus provides one product-specific example of a registered fund, permitted assets, official recordkeeping, share transactions, NAV calculation, fees, and risks. This generic accumulating-share wrapper is not a reconstruction of that fund; it does not inherit its legal status, USD 1 NAV method, distribution process, eligibility, networks, liquidity, or protections. The prospectus link was reviewed 2026-08-10; readers must consult the then-current prospectus for product-specific terms.

Security properties to test or verify

Section titled “Security properties to test or verify”

These are desired properties, not claims of proof or legal compliance for a deployed product:

  • wrapper shares, fund shares, official holder records, custody positions, bank cash, portfolio assets, income, expenses, liabilities, pending claims, and redemptions reconcile at every named recognition time;
  • a token mint cannot create a fund or wrapper interest unless the issuer’s authorized subscription, eligibility, payment, and official-record rules are satisfied;
  • an on-chain transfer cannot bypass configured eligibility, freeze, forced transfer, sanctions, jurisdiction, or official ownership-update rules;
  • NAV uses assets the correct entity owns or can validly recover, recognized liabilities, compatible units and timestamps, current prices, eligible share supply, fees, impairment, and no double counting across layers;
  • a redemption cannot burn more shares, transfer more value, or settle more times than the holder’s entitlement and executable assets permit;
  • every failed or partial cross-system transition leaves a unique pending claim with deterministic retry, cancellation, timeout, and recovery behavior;
  • issuer, manager, transfer agent, custodian, broker, bank, compliance, governance, guardian, admin, upgrade, legal, and wind-down powers remain explicit and independently inspectable; and
  • disclosures distinguish accounting NAV, official ownership, legal entitlement, executable redemption, secondary-market price, and any assurance or verification status.

Common misunderstandings

Section titled “Common misunderstandings”
  • “The token is a Treasury bill.” The wrapper token, fund share, custody entitlement, and Treasury security are separate assets and claims.
  • “Treasury backing guarantees the wrapper.” Treasury’s obligation does not eliminate fund, issuer, bank, custody, stablecoin, legal, liquidity, or code risk.
  • “A wallet transfer always transfers legal ownership.” Its effect depends on the issuer’s official-record model, restrictions, documents, and law.
  • “On-chain proof of supply proves off-chain assets.” Supply conservation cannot prove title, segregation, valuation, recoverability, or payment.
  • “NAV equals cash available now.” Redemption can face cut-offs, asset sales, queues, caps, banking hours, eligibility checks, costs, or failures.
  • “A smart contract removes the custodian.” Securities, cash, and official records can remain controlled by custodians, brokers, banks, and transfer agents even when the holder interface is on-chain.

Review checklist

Section titled “Review checklist”
  1. What does the user own, who issued it, and which documents and jurisdiction define the entitlement?
  2. Is the user or wrapper the fund shareholder of record, and which on-chain or off-chain record is authoritative after a transfer?
  3. Who owns or controls stablecoins, bank cash, fund shares, custody entitlements, and Treasury securities at each step?
  4. Who pays gross return, who charges each fee, and who absorbs market, custody, legal, issuer, liquidity, and operational loss?
  5. Which prices, timestamps, assets, liabilities, impairments, and share counts produce NAV, and which value is actually redeemable?
  6. What happens after a partial subscription, burn without payment, payment without burn, stale record, rejected holder, frozen account, or insolvent intermediary?
  7. Which technical and legal authorities can transfer, freeze, recover, pause, upgrade, value, liquidate, or wind down the product?

Continue with real-world asset, fund, net asset value, and accounting risk.