Goldfish Gold

On 22 September 2025, I-ON announced that GGBR Inc. would use ION.au, a digital security tied to in-situ gold, to support Goldfish. The announcement spoke of 5:1 collateral and physical redemption through regulated dealers ahead of a planned October launch.

I-ON’s later accounts describe a Master Treasury Lease and Custody Agreement beginning in July 2025. GGBR can lease up to 1,000,000 ION.au for issuance, but I-ON retains ownership or management control and GGBR does not book the leased assets.

Goldfish now identifies GGBR Ltd in the BVI as issuer and GBBR Inc. in Wyoming as manager. The split matters because token code, customer service and reserve ownership do not sit with one legal person.

Goldfish’s June 2026 collateral page says a GGBR Trust holds the Happy 2 claims in Pinal County, Arizona, containing 1,000,000 troy ounces of verified in-situ gold. Against 25,000,000 tokens representing 25,000 ounces, it presents roughly 40:1 ounce coverage.

In-situ means the gold remains in the ground. The page invokes NI 43-101 and S-K 1300 and says holders are trust beneficiaries, yet the reviewed page does not link the trust deed, name the trustee or Qualified Person, or show how the trust claim connects to I-ON’s leased ION.au. The quantity is therefore an attributed reserve claim, not evidence of allocated deliverable bullion.

The website advertises physical redemption through regulated dealers. The audited contracts reveal the operational gate: a requester must pass KYC, then administrators move the request through Pending, Approved, Processing and Completed—or Reject it.

Administrators can change the minimum redemption, basis-point fee and house wallet, and can emergency-withdraw tokens held by the redemption contract. As of this review, the public interface did not reliably disclose a nonzero minimum, a named dealer, delivery countries, timing or a complete fee schedule.

A secondary-market purchase is therefore easier to verify than a physical exit. Holding the ERC-20 does not by itself prove that a particular dealer must hand over a particular bar on demand.

The live UUPS proxy reports 25,000,000 GGBR and is not paused. Its internal maxSupply is 1,000,000,000, despite market pages presenting 25 million as the current outstanding amount; a supply-manager role can alter the cap above current supply.

Other roles can replace the minter, mint and burn through the factory, pause all transfers, freeze or blacklist addresses, force-transfer balances and upgrade the implementation. CertiK recorded three centralization findings and 2-of-3 multisig remediation for two, while Cyfrin plainly warned that admins could seize assets.

Cyfrin and CertiK reviewed the token, factory, KYC and redemption contracts. Their work can show whether the examined code handled known bugs; it does not assay Happy 2, prove title, identify a trustee or guarantee dealer performance.

The project’s Aurum Safeguard is also narrower than insurance language suggests: Goldfish describes a token pool for eligible direct protocol breaches, excluding third-party failures and user error. No reviewed policy promises full reimbursement.

For GGBR, the key monitoring task is documentary: publish the trust instrument and geological report, reconcile them with I-ON’s lease accounting, and post enforceable redemption terms. Until then, the strongest verified fact is administrative programmability, while the strongest property-right claim remains issuer-authored.