Mechanism snapshot: XAUT is “allocated gold,” but the token is not self-sovereign
XAUT is a simple product with a complicated trust boundary. Each token is meant to represent ownership of one fine troy ounce of physical gold on a specific gold bar, as described in the issuer whitepaper PDF.
The clean part is the unit. XAUT is natively fractional to 6 decimals on Ethereum, so it can represent increments as small as 0.000001 troy ounce.
The messy part is enforcement. The token’s backing and redemption are not enforced by an on-chain collateralization rule. They are enforced by (1) off-chain custody and (2) a centralized issuer that controls minting, burning, transfers for blocked addresses, and even a “destruction” burn of blocked balances.
That means XAUT tokenomics is less about emissions or staking and more about who can change supply, who can move value, and what frictions exist at the redemption boundary. If you’re new to this framing, our tokenomics FAQ covers the basics.
For a useful comparison point, see how another collateral-linked asset frames its design in Legacy FRAX tokenomics.
Supply control: owner-minted, owner-burned, and not capped in code
On Ethereum, the XAUT token contract is presented on Etherscan as a proxy, with a separate implementation contract; see the proxy token address.
In the implementation contract, minting is onlyOwner. The function signature is mint(address _destination, uint256 _amount) and it calls the standard ERC-20 _mint.
Burning for “redemption” is also onlyOwner. The function redeem(uint256 _amount) burns tokens from the owner’s own balance, which implies the operational flow is “get tokens back to an issuer-controlled address, then burn.”
CoinGecko lists XAUT’s Max Supply as ∞ (no fixed cap), and tracks total supply and circulating supply as on-chain observable quantities rather than a predetermined issuance schedule; see the supply snapshot.
As a snapshot on March 5, 2026, CoinGecko reports: Circulating Supply 564,548 XAUT and Total Supply 712,747 XAUT.
- Circulating supply (public float, snapshot): 564,548 XAUT (as tracked by CoinGecko on March 5, 2026).
- Non-circulating / treasury labeling (observable holding, snapshot): CoinGecko labels a “Treasury” address and shows - 148,198 XAUT for that treasury figure on March 5, 2026.
Two design consequences follow.
First, there is no “emission policy” to model. Supply expands and contracts at issuer discretion based on primary-market flows. You can still reason about incentives, but they live in fees, redemption thresholds, and compliance controls, not in an algorithm.
Second, supply integrity is a governance problem. The chain enforces “only the owner can mint.” The chain does not enforce “mints only happen when gold is acquired.” That linkage is contractual and operational.
Primary-market rules: KYC gating and redemption is sized to a bar, not an ounce
The whitepaper is explicit that purchase and redemption with the issuer require identity verification and acceptance of XAUT-specific terms.
XAUT’s redemption boundary is engineered around professional bullion logistics, not retail convenience. As of the whitepaper date (January 23, 2020), buying directly required a minimum purchase of 50 XAUt.
Redemption for physical gold required a minimum of 430 XAUt.
That 430 figure is not because bars are “430 ounces.” The whitepaper says redemptions can only occur with full bars and that bars typically range from ~385 to ~415 fine troy ounces, which creates an operational mismatch that the redeemer must settle via extra XAUT or fiat, depending on bar size and the redemption request.
This is an underappreciated tokenomics lever. The minimum redemption size and bar granularity convert “legal right to gold” into “practical ability to take delivery” only for large holders. For everyone else, the realistic exit is secondary-market sale, not physical redemption.
Fees and fiscal flows: 25 bps is the headline, but the real cost is the off-chain boundary
As of the whitepaper date, the fee schedule is simple and mostly one-time:
To buy XAUt directly, verified users pay the Swiss gold market purchase cost plus a 25 bp fee.
To redeem and take physical delivery in Switzerland, the fee is 25 bp plus the cost of physical delivery to the selected location in Switzerland.
If a holder requests the issuer to attempt to sell the gold and remit fiat proceeds, the fee is 25 bp on the sale proceeds (assuming sale succeeds).
The whitepaper also states fees and minimums may change, with current values to be reflected in terms of sale and service.
On-chain transfers, at least on the Ethereum implementation shown on Etherscan, look like standard ERC-20 transfers without an embedded issuer “take rate.” The contract adds a restriction that prevents sending tokens to the token contract itself, and it gates transfers behind a “not blocked” modifier.
Mechanically, the business model is straightforward. Primary-market fees monetize net inflows and outflows. Secondary-market trading mostly monetizes exchanges and market makers, not the issuer. That creates a predictable incentive for the issuer to (a) keep secondary liquidity healthy and (b) keep primary rails available for large actors, since that is where fee extraction is cleanest.
Governance and parameter control: one key controls monetary policy, censorship policy, and upgrades
XAUT does not have token-holder governance. There are no on-chain votes, no fee switches governed by DAO, no emission committees. Its “governance” is contract ownership plus corporate policy.
For a contrasting governance surface, see our ENS governance design.
From a mechanism design standpoint, you should treat XAUT as a centralized system with deterministic execution after discretionary decisions. The contract enforces the rules, but an owner decides when to apply them.
Control surface on Ethereum (implementation contract):
Minting is owner-controlled, via mint(...) with an onlyOwner gate.
Supply reduction is owner-controlled via redeem(...) (burn from owner balance).
Censorship / freezing exists as a blocked list. The contract includes addToBlockedList(address) and removeFromBlockedList(address), both onlyOwner. Transfers are gated by an onlyNotBlocked modifier, and transferFrom also checks the sender is not blocked.
Confiscation-by-burn is present as destroyBlockedFunds(address), which burns the entire balance of a blocked user, and is onlyOwner.
Upgradability matters. The XAUT proxy points to a separate implementation address, which implies the logic can be changed by whoever controls the proxy admin; the relevant verified contract code shows the privileged controls described here.
This is the central trade-off: adaptability versus predictability. A proxy lets the issuer patch bugs and add features. It also means you are not buying a fixed monetary constitution. You are buying a policy regime enforced by code today, which can be different code tomorrow.
Risk analysis: where the mechanism strains
One important document-level constraint: the whitepaper itself states it is a marketing document and is not intended to be legally binding.
If you are trying to model XAUT with high confidence, that sentence should change your posture. Tokenomics is not just math. It is enforceable commitments. When the primary doc frames itself as non-binding, the modelability of parameter stability drops.
Top 3 risks
If you want a place to track and compare these kinds of indicators across assets, we publish ongoing crypto research.
Issuer control risk (censorship + confiscation). Trigger: the issuer (or a compelled issuer) decides an address should be blocked. Mechanism: addToBlockedList gates transfers via onlyNotBlocked, and destroyBlockedFunds can burn a blocked balance. Who bears it: holders who custody XAUT in self-hosted wallets and rely on permissionless transferability. Measurable indicators: on-chain BlockPlaced events, blocked-list status changes, and DestroyedBlockedFunds events on the implementation contract.
Upgrade/parameter drift risk. Trigger: proxy admin upgrades the implementation, or changes admin control. Mechanism: proxy-based deployment means contract behavior can be modified without changing the token address users interact with. Who bears it: everyone holding XAUT, plus integrators (exchanges, DeFi protocols) that assume specific ERC-20 behavior. Measurable indicators: implementation address changes on the proxy, proxy admin actions, and new source code verifications for updated implementations.
Redemption boundary risk (liquidity and discount in stress). Trigger: secondary liquidity dries up or trades at a discount, while holders cannot or will not meet redemption minimums or KYC requirements. Mechanism: practical redemption for physical gold is sized to 430 XAUt, and redemptions occur via full bars with size mismatch settlement, which makes “arb to NAV” inaccessible for most holders. Who bears it: smaller holders and anyone forced to exit during market stress. Measurable indicators: persistent price deviation from spot gold, widening spreads on major venues, and growth in issuer-held non-circulating balances that reduce float.
Dominant risk: issuer control risk is the largest because it is not a tail event. It is a built-in operating mode.
The blocked-list mechanism is not an external legal overlay. It is embedded in the transfer path. Transfers execute only if the caller is not blocked, and transferFrom checks the sender is not blocked too. That means “censorship resistance” is not something XAUT can accidentally provide. The contract explicitly prevents it.
Then there is destroyBlockedFunds. Burning a blocked user’s entire balance is a qualitatively stronger lever than freezing. Freeze is a temporary transfer disablement. Burn is finality. Even if the intent is compliance, the mechanism creates a governance fact: the issuer can unilaterally impose an irreversible loss on a specific holder, on-chain, without needing a token-holder vote or a court order embedded in the protocol.
From a mechanism design lens, this collapses a lot of the usual crypto separation of powers. In many protocols, “monetary policy” (mint/burn), “execution policy” (transfer rules), and “constitutional policy” (upgrades) are separated across modules, time-locks, multisigs, and sometimes governance votes. Here, these levers concentrate into a single ownership domain.
That concentration can be rational if your primary goal is regulatory compatibility and operational responsiveness. It is also the main reason XAUT behaves more like a tokenized custody receipt than a credibly neutral monetary asset. The rules are deterministic. The decisions are discretionary.
If you integrate XAUT into DeFi collateral systems, this is the failure mode that matters most. Price volatility in gold is usually not the existential risk. The existential risk is that collateral becomes non-transferable or is burned while your protocol assumes it is a normal ERC-20. You mitigate that with whitelisting, conservative collateral factors, and explicit “issuer action” threat modeling, not with more price oracles.
If you need help pressure-testing this kind of design, this is where tokenomics consulting is actually useful: mapping privileged controls to user loss paths, and turning “centralization risk” into concrete, monitorable invariants you can enforce in integrations.
This article is part of our Tokenomics Deep Dive series.
