- XRP Ledger developers proposed two changes to prevent unauthorized token receipts.
- The proposals target loopholes involving AMM pool shares and existing token balances.
- Proposed changes would require issuer approval for pool shares and block unauthorized token payments.
Developers working on the XRP Ledger have proposed two changes to prevent accounts from receiving tokens without approval from their issuers. The proposals target gaps in the network’s authorization checks involving automated market maker (AMM) pool shares and existing token balances. The XRP Ledger Foundation said it knows of no case in which outsiders exploited these gaps to obtain unauthorized token balances.
The Problem
Some tokens on the network carry a condition: the company that created them decides who may hold them. Developers found two ways an unapproved account could still end up with a balance.
- Pool shares. People who put two tokens into a trading pool receive a share that represents a claim on both. Depositing already required approval for both tokens, but the share could be sent on to an account that lacked it. If one token’s issuer later pulled funds back out of the pool, the other token could be paid to that account, even though its issuer never approved it.
- Existing balances. An account with an existing unauthorized balance could continue receiving additional tokens because the authorization check applied only when its balance was zero.
Follow us on X for real-time crypto updates.
What Changes For Users
Two open proposals on GitHub, submitted by contributor ckeshava, address the gaps:
- Receiving a pool share would require approval for both tokens, whether it arrives by payment, trade, NFT sale, or auction refund.
- A payment to an unapproved account would fail outright instead of being held for a retry.
Existing unauthorized balances would remain spendable, but the proposed changes would prevent those balances from growing through further unauthorized receipts. Holders could also return pool shares to the AMM or withdraw their underlying assets. The changes would take effect only through an amendment, the validator vote the network uses for protocol changes.
The proposals were initially submitted as a single proposal, but reviewers asked the team to split them into two.
What the Foundation Says
Hussein “Vet” Zangana, the Foundation’s director of community and product, said the discussion concerns “what the protocol should guarantee, not a report of affected users.” He said any unapproved balance today traces to payments made by issuers themselves or by accounts they had approved. The Foundation described the work as routine and unrelated to any security incident.
Under the proposals, an issuer could approve a holder at any time to restore full use of the tokens, Zangana said.
A Separate Fix
On October 12, the Foundation highlighted an earlier update, version 3.4.1, which fixed a different vulnerability involving a potential bypass of XRP’s 100 billion supply cap. The flaw could have allowed an attacker to create spendable XRP through a specially constructed transaction. However, the Foundation said it found no evidence that the vulnerability had been exploited on any public network.
Subscribe to our YouTube channel for the latest crypto news.
Related: Ripple and BNY Explore XRP Ledger to Speed Up Invoice Payments
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
