SeametryOpen-AP ETF

How it works

What a tokenized stock really is, why a bundle of them is not an ETF, and how the Hall turns constituents into shares and back.

A bundle assembles tokens. An ETF adds a share whose creation and redemption loop remains open to participants on both sides of the market. The basket is a mechanism. This page takes that apart one question at a time, and every instrument on it runs the same arithmetic and reads the same evidence as the product.

What do I actually hold when I buy a tokenized stock?

A claim, not the share itself. The token in your wallet is a promise from whoever issued it, and different issuers make different promises under similar symbols.

So two tokens with the same ticker can carry different rights: who owes you, whether you can redeem for the share, and who can freeze or reissue the token. The Grade states which of those rights a given token carries.

GradeWhat the token gives youCaptured
EntitlementRedeemable one to one into a security entitlement through a regulated broker.20
CertificateA tracker certificate that settles to cash through its issuer.26
InterestA proportional interest in a vehicle holding private shares.0
UngradedThe legal shape has not been classified.0
Policy engine policy-2026.10.1, 46 captured instruments, decisions resolved at 23 Sep 2026 (41d ago).

The Grade describes the legal shape of the claim. It is never a score of quality, and Seametry does not turn it into one.

WarnGrade describes legal shape, never quality.

What can the issuer still do to my token?

More than most people expect. A token built on Solana's Token-2022 standard can carry powers its issuer keeps after you buy it: freezing it where it sits, pausing every transfer, taking it back from any wallet, changing how many you appear to hold. These powers are written into the token's mint account, so they can be read directly instead of taken on trust.

Seametry reads them for every instrument it captures. Here is how often each power appears:

The issuer can…, by number of instruments (46 captured)

  1. freeze this where it sits46 of 46
  2. pause all movement of this46 of 46
  3. take this back from any wallet46 of 46
  4. switch on a check of who may receive this46 of 46
  5. change how many of these you appear to hold46 of 46
  6. create more of these46 of 46
Policy engine policy-2026.10.1, 46 captured instruments, decisions resolved at 23 Sep 2026 (41d ago). Each power is decoded from the mint account's bytes, not from the issuer's description.

Pick any captured instrument to read its record exactly as the policy engine wrote it:

CertificateWarnAdmitted, with the issuer's powers stated.
AAPLx  Backed Finance (xStocks)
mint      XsbEhLAtcf6HdfpFZ5xEMdqW8nfAvcsP5bdudRLJzJp
captured  slot 449,580,424, Wed, 23 Sep 2026 03:25:33 GMT
grade     Certificate

the issuer can:
  freeze this where it sits
  pause all movement of this
  take this back from any wallet
  switch on a check of who may receive this
  change how many of these you appear to hold
  create more of these

decision  WARN
capacity  10,000 USDC
Policy engine policy-2026.10.1, 46 captured instruments, decisions resolved at 23 Sep 2026 (41d ago).

None of this says anything about what an issuer intends. It describes what the issuer is able to do, which is what decides whether a basket can still be redeemed on a bad day.

Why is a bundle of tokens not an ETF?

Because a bundle stops when the tokens arrive. You hold several tokens, and that is all. There is no separate share, no fixed recipe behind that share, and no way for anyone else to close a gap between the price of the parts and the price of the whole.

An ETF has a loop. Participants can turn the underlying assets into fund shares (creation) and fund shares back into the underlying assets (redemption). That loop is what keeps a share honest to its contents.

A bundle compared with an AlloyOn the left, three tokens arrive in a wallet and nothing else happens. On the right, constituents enter the Hall through Strike and become shares; shares return through Melt and become Claims on every constituent; the loop is open to any wallet.A bundleToken 1Token 2Token 3WalletAssembly is the end. No share, no Formula, no way back.An AlloyConstituentsthe FormulaSharesfixed quantities eachStrikeMelta Claim on every legAny wallet can enter from either side. No approval list.
Strike deposits the Formula and mints shares. Melt burns shares and records a Claim on every constituent, which is withdrawn leg by leg.

The Hall is that loop, on chain. A Strike deposits the recipe, which Seametry calls the Formula, and issues shares. A Melt destroys shares and records a Claim on every constituent.

How does a Strike turn constituents into shares?

You choose how many shares you want, and the Hall works out exactly how much of each constituent that costs. You never choose an amount of money; you choose a number of shares. That rule exists so nobody can be rounded down to zero shares by a clever deposit, which is how a well-known kind of attack on shared vaults works.

For each constituent the Hall computes:

pay   = ceil( shares × held_by_the_hall ÷ shares_in_existence )

and when shares are melted:

claim = floor( shares × held_by_the_hall ÷ shares_in_existence )

Paying rounds up. Receiving rounds down. Every rounding favours the Hall, so the people already holding shares can never be diluted by someone shaving fractions. Move the slider and watch what that means:

Shares in existence
1,000,003
Held by the Hall for them
999,983 atoms
Owed as Claims
0 atoms
1 × 999,983 ÷ 1,000,003
= 0 remainder 999,983
Strike pays  1 atom   (rounded up)
Melt credits 0 atoms   (rounded down)

Strike 1 and Melt them straight back: you pay 1, your Claim gets 0. 1 atom stays with the Hall, so a round trip can never be used to take a fraction for free. That is 0.000001 of a unit at this constituent's 6 decimals.

Starting state and rounding from shared/spec/recipe/vectors.json, “strike and melt with rounding”, the vectors the Hall program is tested against. One constituent shown; a real Alloy repeats this for every leg.

At the starting state, one share costs one atom to Strike, and Melting it straight back credits zero. That is not a fee; it is the fraction that rounding keeps in the Hall, so a round trip can never be used to take value for free.

What happens when I Melt, and what if an issuer freezes one constituent?

This is the question the Hall was built to answer. The obvious way to redeem a basket is to burn the shares and send every constituent back in one transaction. If any single issuer has frozen its token, that one transfer fails, and because it is one transaction, everything fails with it. One issuer's power over one stock becomes a veto over your whole exit.

The Hall splits the exit in two. Melt burns your shares and writes down what you are owed of every constituent; it touches no constituent at all, so no freeze, pause or hook can reach it. Then each constituent is withdrawn on its own. A frozen one stays yours as a named Claim, and the others arrive.

Freeze a leg and try both:

Issuer freezes the Hall's account for

The obvious redemption

Burn the shares and transfer every constituent back, in one transaction.

  1. AAPLxReverts
  2. NVDAxReverts
  3. TSLAxReverts

One frozen leg reverts the whole transaction. You keep your shares and receive nothing, until every issuer allows every transfer at once.

The Hall

Melt first, which moves no constituent. Then withdraw each leg on its own.

  1. AAPLx20.000000 to claim
  2. NVDAx15.000000 to claim
  3. TSLAx2.500000 to claim

Nothing has happened yet.

Illustrative Formula: three constituents, 1,000 shares outstanding, quantities chosen for the example and not a live Alloy. The behaviour is the Hall's: redeem touches no constituent mint, and withdraw delivers one leg at a time (docs/prd/HALL.md, sections 4.3 and 4.6).

The same split shows in the program's own instructions:

redeem    burns shares, credits a Claim on every leg     touches no constituent mint
withdraw  delivers one leg of a Claim                    touches that one mint
create    pulls exactly the required units, mints shares touches every mint

Who is allowed to Strike and Melt?

Anyone. There is no approval list. Any wallet holding the required constituents can Strike shares, and any wallet holding shares can Melt them, without asking Seametry or anyone else.

In a traditional ETF only approved institutions, called authorized participants, may create and redeem. On the Hall the authorized participant set is everyone.

Delivery stays explicit.

A constituent held back by its issuer remains a named Claim and can be withdrawn when delivery resumes.

Does the Hall ever need a price?

No. Strike and Melt move quantities, not values. Neither instruction reads an oracle, a quote or a net asset value, so no stale or manipulated price can change what a Strike costs or what a Melt returns.

Strike 10 shares   pays exact constituent quantities   price never read
Melt 10 shares     credits exact constituent claims    price never read

Prices still matter to you as a buyer; they just never instruct the Hall.

The Hall reads quantities.

Strike and Melt do not use an oracle, a quote or NAV as an instruction input.

Inspect live Alloys