XRP Ledger Developers Propose Four Fixes to Tighten Rules on Holding Restricted Tokens

October 30 — According to CoinDesk, XRP Ledger developers have proposed four fixes aimed at closing exceptions that let restricted tokens enter accounts without issuer approval; the changes have been bundled into the network upgrade fixCleanup3_5_0 and have not yet been activated on mainnet. Some restricted tokens on XRP Ledger require the issuer's approval before an account can hold them, but developers found several ways to bypass that approval still exist. The fixes include requiring both tokens in an automated market maker (AMM) pool to be approved before buying into the pool, and fixing an issue where the approval check was triggered only on zero-balance trust lines, letting trust lines that already hold tokens continue to receive more.

The XRP Ledger Foundation said this is routine protocol hardening, not a security incident, and there are no reports of affected users so far. All existing unapproved balances come from the issuer or accounts it previously approved, and no outside party has been found using the remaining exceptions to create balances. Once the fixes take effect, unapproved restricted tokens can only be returned to the issuer, and the issuer can approve the holder's trust line at any time to restore its use. The four changes have not yet been merged into the main software; after merging, activation requires support from more than 80% of trusted validators for two consecutive weeks.