XRP Ledger developers have introduced four proposed fixes aimed at tightening authorization rules for restricted tokens, addressing gaps that could allow unapproved accounts to receive or trade assets without issuer approval. The changes are included in the planned fixCleanup3_5_0 network update, which has not yet been activated and still requires validator approval.
Under current XRPL rules, issuers of stablecoins and tokenized funds can limit ownership to approved accounts. Approval is tied to a trust line connecting a holder to an issuer’s token, and issuers commonly use these checks to verify customers before transfers. The proposed fixes would extend these checks to more transactions, including automated trading pools and trust lines with existing balances.
One proposed change would block accounts from joining automated trading pools unless they have issuer approval for both assets in the pool. Another would prevent unapproved accounts that already hold balances on existing trust lines from receiving additional restricted tokens. A wider rule would also apply to future network features.
The XRP Ledger Foundation reported no known outside exploitation of the remaining gaps. Hussein 'Vet' Zangana, the Foundation's director of community and product, said developers were reviewing protocol rules rather than responding to affected users, and that any unapproved balances came from issuers or already authorized accounts. 'The issuer can approve the holder’s trust line at any time, which restores full use,' Zangana said.
Under the proposal, unapproved holders could only return restricted tokens to their issuer and would not be able to trade or send them elsewhere. The Foundation described the work as routine maintenance unrelated to any security incident. Separately, Coinbase added support for Ripple's RLUSD stablecoin, including transfers through the network. For the XRPL fixes to take effect, the update must receive more than 80% support from trusted validators for two consecutive weeks. Voting has not begun, and no activation date has been confirmed.
