The XRP Ledger Foundation has put forward an amendment that closes gaps in how the ledger enforces issuer restrictions on tokens, but the public record so far covers only half of the package โ and none of it has been independently verified.
The XRP Ledger is moving to patch a set of loopholes in the machinery that lets issuers restrict who can hold, transfer, and redeem tokens on the network. The fix arrives as amendment fixCleanup3_5_0, a bundled change that, according to reporting from Bitcoinist, contains four separate corrections to the ledger's restricted-token behavior. Two of those corrections have been described in public: one concerning Automated Market Maker liquidity provider tokens, and one concerning trust lines that carry a non-zero balance at the moment a restriction is applied.
The proposal has not been merged and has not been activated. As of an October 30 report on the matter, the amendment was still in the validator-support phase, needing roughly two weeks of sustained support before it could be enabled on the network. The underlying issues were addressed in August 2025, according to the same reporting, which places the disclosure and the remediation on separate timelines โ a gap of roughly two to three months between the code being written and the network being told about the class of problem it was written to solve.
That gap matters for issuers. Any party running a regulated asset on the XRP Ledger โ a stablecoin, a tokenized fund, a permissioned security โ has been operating on the assumption that the ledger's freeze and authorization flags mean what the documentation says they mean. The amendment implies that, for some configurations, they did not.
What `fixCleanup3_5_0` Actually Is
The XRP Ledger does not ship protocol changes the way most networks do. There is no single core team that pushes a release and declares the rules changed. Instead, changes to transaction processing, ledger state, and the semantics of existing flags arrive as amendments: code paths that lie dormant in the server software until a supermajority of trusted validators signals support for long enough to cross a defined threshold. Only then does the amendment activate, retroactively changing how the ledger behaves for everyone.
fixCleanup3_5_0 follows the naming convention the XRP Ledger community uses for housekeeping amendments โ a batch of small, largely independent corrections grouped under a single identifier rather than shipped one at a time. The convention exists for practical reasons. Each amendment carries governance overhead: validator coordination, monitoring, communications, and the risk that a contentious item drags an uncontroversial one down with it. Bundling lets the network clear a backlog of narrow fixes in a single activation event.
The trade-off is opacity. When four fixes travel together, the public conversation tends to collapse into a single line item โ "the restricted-token amendment" โ even though the four components may have nothing to do with one another beyond their release vehicle. In this case, the reporting describes only the two components that touch restricted tokens. The other two have not been characterized in public at all, and the reporting contains no link to the pull request, the amendment specification, or the discussion thread where the change was reviewed.
That is not a criticism of the fix. It is a statement about what can be verified from the outside. A reader who wants to know precisely what code is being voted on cannot get there from the public record described so far.
How the XRP Ledger Restricts a Token
To understand why the two disclosed fixes matter, it helps to be precise about how restriction works on this ledger, because the XRP Ledger's model is not the account-balance model most developers know from Ethereum or Solana.
On the XRP Ledger, the native asset is XRP, which exists in accounts directly. Every other asset โ stablecoins, tokenized treasuries, wrapped assets, governance tokens โ exists as an issued currency, and holding it requires a trust line: a two-party ledger object between a holder and an issuer that records both a limit and a balance. A trust line can hold a positive balance (the holder has some of the asset), a negative balance (the issuer has paid out more than the limit allows in the other direction), or zero.
This structure gives issuers a set of controls that are native to the protocol rather than implemented in a smart contract:
Authorized trust lines. An issuer can set a flag requiring authorization for every trust line. When that flag is on, a holder can create a trust line to the issuer, but the trust line is unauthorized and cannot hold a balance until the issuer explicitly authorizes it. This is the foundation of any know-your-customer regime on the ledger: the issuer decides who is allowed to hold the asset, and can revoke that permission later.
Individual freeze. An issuer can freeze a specific trust line, preventing the holder from moving that asset. Freeze is the enforcement mechanism for sanctions compliance, for court orders, and for the ordinary operational cases โ a compromised account, a dispute, a suspected fraud โ where an issuer needs to stop a specific holder without touching anyone else.
Global freeze. An issuer can freeze every trust line to itself at once, effectively halting the asset. This is the emergency brake.
Deep freeze. A stricter variant of individual freeze, intended to prevent a holder from acquiring more of an asset they can no longer redeem with the issuer. The normal freeze leaves open the possibility that the holder still has some path back to the issuer; deep freeze is designed to close it, on the theory that an asset nobody can redeem with its issuer should not command a market price.
On top of these, the ledger has added a compliance toolchain over the past several years: a clawback capability that lets an issuer revoke tokens from a holder's trust line under defined conditions, decentralized identifiers for issuer and holder credentials, and โ in amendments that have been in flight through 2025 โ permissioned domains and a permissioned decentralized exchange that would let issuers restrict which counterparties can trade against their assets. Taken together, the direction of travel is unmistakable: the XRP Ledger is building the primitives for regulated issuance, and it is doing so at the protocol layer rather than leaving it to third-party contracts.
Every one of those primitives depends on the same assumption: that the restriction flags are enforced consistently, across every code path that can move an asset. The amendment exists because, in at least two cases, they were not.
Fix One: Liquidity Provider Tokens and the AMM Side Door
The first disclosed fix concerns Automated Market Maker liquidity provider tokens.
The XRP Ledger's native AMM, which went live in 2024, lets users deposit pairs of assets into a pool and receive LP tokens representing their share. Those LP tokens are themselves issued currencies on the ledger, created by the AMM's own account, and holding them requires a trust line just like any other issued asset. This design is elegant โ LP positions are composable with the rest of the ledger, transferable, and usable in other contexts โ but it creates a path by which an asset can move without the issuer's restriction flags being consulted at every step.
The concern is straightforward. If an issuer freezes a holder's trust line, the holder should not be able to convert that frozen balance into something else of value and walk away with the proceeds. In an AMM, a holder who is blocked at the trust-line level may still be able to interact with a pool holding the issuer's asset, because the pool and the LP token sit between the holder and the issuer. The question the amendment resolves is whether the restrictions attached to the underlying asset propagate correctly to the LP token trust line, and whether the deposit and withdrawal paths through the pool respect the frozen or unauthorized state of the assets involved.
If they did not, the consequence is not theoretical. A frozen holder could deposit the frozen asset into a pool, receive an LP token, and later withdraw a different asset โ effectively laundering a restricted balance into an unrestricted one through a liquidity pool. Even where the AMM's own accounting prevents full extraction, partial exposure is enough to undermine the compliance guarantee an issuer believed it had purchased when it enabled freeze.
The fix, as described in the reporting, closes this path by making the restriction state of the underlying assets relevant to the LP token position and to the AMM interactions built on top of it. That is the correct shape of the correction, and it is the kind of bug that is easy to miss precisely because the AMM is a separate subsystem with its own ledger objects and its own transaction types. Restriction logic that was written before the AMM existed had no reason to consider LP tokens; the AMM, in turn, had no reason to consider itself a compliance boundary.
Fix Two: The Non-Zero Balance Problem
The second disclosed fix concerns trust lines that hold a non-zero balance at the moment a restriction is applied.
This is the retroactivity problem, and it is the harder of the two conceptually. The clean case in any permissioned token system is the trust line created after the rules are in place: the issuer requires authorization, the holder requests it, the issuer approves or declines, and the trust line's state is unambiguous from the first unit of balance onward. The messy case is the trust line that already exists, already holds a balance, and then encounters a restriction for the first time โ because the issuer newly enabled authorization, because the issuer froze the line, or because the holder's status changed for reasons outside the ledger.
In that transition, the ledger has to answer a question the documentation does not always spell out: what happens to the balance that is already there? Two failure modes are possible, and they point in opposite directions. In one, the restriction is applied too weakly โ the trust line is marked restricted, but the existing balance remains movable through paths that do not check the marking, so the restriction is cosmetic. In the other, the restriction is applied too bluntly โ the balance becomes inaccessible in a way that traps funds and creates a custodial problem for the issuer, who now holds an asset it cannot return and a holder who cannot redeem.
The reporting indicates the fix concerns the interaction between non-zero balances and restriction enforcement. What it does not specify is which of these failure modes was observed, whether both were, and whether any balance was ever in a state that the corrected code would now treat differently. That distinction matters enormously to an issuer doing a remediation analysis: a bug that let restricted funds move is a compliance incident, while a bug that made restricted funds unrecoverable is an operational one, and the two demand very different responses.
The non-zero balance case is also the one most likely to have been hit in production rather than in testing. Test environments tend to start clean: a fresh issuer, a fresh set of trust lines, authorization enabled from the beginning. Real deployments do not. An issuer that launched before enabling authorization, then enabled it later as its compliance posture matured, would have exactly the configuration the fix targets โ trust lines with balances that predate the rule.
The Two Fixes Nobody Has Described
The reporting says four fixes. It describes two. The remaining pair has not been characterized in public, and the source material contains no link to the amendment specification, the pull request, or the standards discussion where the change would have been reviewed.
There are benign explanations. Housekeeping amendments routinely bundle changes that are uninteresting individually โ a rounding correction, an edge case in fee accounting, a state-transition fix that only appears under a specific sequence of transactions. Many such fixes are never discussed publicly at all, because nobody outside the small group of people who read the diff has any reason to care. It is entirely possible that the other two items in fixCleanup3_5_0 fall into that category.
But the bundling means the public cannot confirm that. And the specific context โ an amendment whose headline purpose is closing restricted-token loopholes โ raises the stakes on the unknown components. If one of the undescribed fixes touches the same enforcement logic, an issuer reading the coverage has no way to know whether it is affected, whether it needs to audit its own deployment, or whether the guarantee it is making to its regulator is now accurate.
There is a second, subtler gap. The reporting does not include validator counts, current support levels, or historical activation timelines for comparable amendments. Without those, it is not possible to estimate the probability that the amendment activates on schedule, or to calibrate how unusual the current delay is. Amendment activations on the XRP Ledger have historically ranged from quick consensus to multi-month stalemates, and the difference is usually political rather than technical. A number would have been useful. None was provided.
The Validator Politics
The mechanism itself is worth stating plainly, because it is the part of the story that determines whether any of this takes effect.
An XRP Ledger amendment activates when a supermajority of trusted validators โ currently 80 percent โ has voted in favor across a continuous two-week window. Validators signal support by running server software that includes the amendment and configuring it to vote yes. If support falls below the threshold, the clock resets. If support never reaches it, the amendment sits in the codebase indefinitely, dormant and harmless.
The two-week window is a deliberate friction. It ensures that a change cannot be pushed through by a single operator, and it gives the ecosystem time to notice, review, and object. But it also means an amendment's fate is a function of social coordination as much as code quality. Validators are run by exchanges, by infrastructure providers, by the foundation, and by independent operators, and their voting behavior is not always visible in advance.
As of the October 30 report, fixCleanup3_5_0 was in that window and had not cleared it. The reporting gives the requirement โ two weeks of validator support โ without giving the current tally. That leaves the amendment's near-term trajectory genuinely unknown.
For issuers, this is the operative uncertainty. An amendment that has not activated is not a fix; it is an intention. The vulnerable behavior, whatever its exact scope, remains the behavior of the live network until the threshold is crossed. Any issuer that believes it may be affected should be treating the current state as unfixed and planning accordingly, rather than waiting for activation and then auditing.
Why Regulated Issuers Are Watching
The XRP Ledger's institutional pitch rests on a specific claim: that compliance can be enforced at the protocol level, by the ledger itself, rather than by a smart contract that the issuer hopes is correct. That claim is the differentiator. Plenty of chains can host a tokenized money market fund. Very few can offer an issuer a freeze flag enforced by the consensus layer, with no contract to audit and no upgrade path to worry about.
That pitch has been getting louder. Ripple's stablecoin, RLUSD, launched in late 2024 on both the XRP Ledger and Ethereum, and the XRP Ledger has been positioned as the venue for tokenized real-world assets, payments corridors, and institutional issuance. Every one of those use cases depends on the issuer being able to answer a regulator's question โ "can you stop a sanctioned holder from moving this asset?" โ with an unconditional yes.
An AMM path around a freeze is exactly the kind of finding that turns an unconditional yes into a qualified one. It does not require that anyone actually used the path. It requires only that the path existed, because the compliance representation made to the regulator was that it did not. The remediation burden lands on the issuer regardless of whether the exploit was exercised: disclosures, control reviews, and in some jurisdictions, notification obligations that are triggered by the existence of the gap rather than by any loss.
The non-zero balance fix creates a similar but more administrative burden. Issuers who enabled authorization after their token had already circulated now have a population of trust lines whose treatment under the corrected code may differ from their treatment under the old code. Understanding which of their holders fall into that population is a data problem the ledger does not solve for them.
No Evidence of Exploitation โ and What That Does and Does Not Cover
The XRP Ledger Foundation's position, as relayed through CoinDesk and picked up in the subsequent reporting, is that no external party has been found to have exploited the issues.
That is the right thing to say, and it is almost certainly true as far as it goes. It is also a statement with a specific scope that is easy to over-read. "No evidence of exploitation found" is an assertion about what the foundation has observed, based on the monitoring and analysis available to it. It is not the same as "no exploitation occurred," and the difference is not pedantry. Detection of a subtle state-manipulation bug on a public ledger depends on someone having looked for it, with the right tooling, across the right time window. The reporting does not describe that investigation, its scope, or whether any third party has independently replicated it.
There is also a definitional question the reporting leaves open. Does "exploitation" mean extracting value โ profiting from the lapse โ or does it include any transaction sequence that produced a ledger state the corrected code would now prevent? A holder who moved a frozen balance through a pool without intending to circumvent anything, and without profiting, still produced a state that the issuer believed was impossible. Whether that counts depends on who is asking and why.
The practical guidance for issuers is to treat the foundation's statement as a useful data point rather than a clean bill of health, and to do their own reconciliation against their own transaction history for the relevant period.
The Wider Pattern
It would be a mistake to read this as an XRP Ledger story specifically. The class of bug โ a compliance control that holds on the direct path and leaks on an adjacent one โ is native to the entire enterprise blockchain category.
Ethereum's permissioned token standards, ERC-1400 and ERC-3643 among them, push the same enforcement logic into smart contracts, where the surface area is larger and the interactions more numerous. A token contract that correctly checks an allowlist on transfer may not check it on a transfer executed through a decentralized exchange router, or through a wrapper, or through a lending pool that holds the token as collateral. Solana's token extensions moved a set of these controls into the runtime, with default-frozen states, transfer hooks, and permanent delegates โ a design that narrows the surface but does not eliminate the problem, because every program that touches the token becomes part of the trust boundary.
The common lesson is that compliance enforcement is only as strong as the least-checked path into the asset, and that new financial primitives โ AMMs, lending markets, restaking layers, vaults โ create new paths faster than issuers can audit them. A protocol-level flag is stronger than a contract-level check, but it is only stronger to the extent that the protocol's own subsystems honor it.
The XRP Ledger's advantage here is that the fix is a protocol fix. Once fixCleanup3_5_0 activates, every node enforces the corrected behavior, including nodes that never heard of the issue. There is no contract to upgrade, no issuer-by-issuer migration, no long tail of unpatched deployments. That is what protocol-level compliance is supposed to buy, and this amendment is a demonstration of it working โ slowly, through governance, but working.
What to Watch
Four things will determine how this story resolves.
Activation. Whether fixCleanup3_5_0 reaches 80 percent validator support within the two-week window, and if not, how long the retry takes. Until it activates, the live network retains whatever behavior the fixes were written to correct.
The other two fixes. Whether the remaining components of the amendment are described publicly, and whether they touch the same enforcement logic. The bundling convention makes this a legitimate question rather than a demand for a full disclosure of every line changed.
A post-mortem. Whether the foundation publishes a technical account of the two disclosed issues โ how they were found, what the affected configurations were, and what the corrected behavior is. The reporting to date is a summary of a statement, not an engineering write-up, and issuers need the latter to complete a remediation analysis.
Issuer action. Whether any issuer on the ledger publicly confirms it was exposed to either condition. Given the reputational asymmetry โ a compliance incident disclosed is a cost, a compliance incident discovered later is a crisis โ silence should not be read as absence.
The Bottom Line
The XRP Ledger has spent several years assembling the most complete set of protocol-native compliance primitives in the public blockchain space: authorized trust lines, three tiers of freeze, clawback, credentials, and a permissioned exchange in the pipeline. fixCleanup3_5_0 is what maintenance on that edifice looks like. Two holes are being closed in the AMM's interaction with restricted assets and in the treatment of balances that predate a restriction. Two more are being closed without public description.
The amendment is the correct response and, in the disclosed parts, the correct fix. What is missing is not the engineering but the record: no links to the specification, no validator counts, no independent verification of the non-exploitation claim, and no account of half the package. For a network whose institutional value proposition is that compliance is enforced by the protocol rather than promised by an operator, the completeness of that record is not a nice-to-have. It is part of the product.