Paying someone else's reserve means you cannot always walk away

Victoria Shinder27 September 2026, 11:402 min read

Letting one account pay another's fees and reserves sounds like a convenience feature. A vulnerability disclosure published on 21 September by the XRP Ledger's developers shows that it is also a design problem with no perfect solution.

The feature is XLS-68, Sponsored Fees and Reserves, carried by the Sponsor amendment, which is not active on mainnet. It lets a sponsor cover the XRP reserve that every ledger object - a trust line, an offer, a token holding - normally requires, so that end users can transact without holding XRP. The disclosure credits Kris Dangerfield and Andrew Spencer, who found during Devnet testing that a sponsor could end sponsorship of an object without anyone checking that the owner could cover its reserve. The reserve simply disappeared, the object stayed, and the sponsor's capital came back to be reused. In testing, 30 permanent unbacked objects were created for about 20 drops each. No funds were at risk and the fix shipped in xrpld 3.4.0 on 17 September.

The trilemma

The report names the underlying tension the "Reserve Exit Trilemma". Three properties are desirable: either party can exit a sponsorship at any time; every ledger object's reserve is always backed by someone; and sponsored users can operate with zero XRP. You cannot have all three. If the sponsor can leave freely and the user holds nothing, there is a moment when an object exists with no reserve behind it - which is exactly what the bug exploited.

The developers chose to give up free exit. A sponsor can now end reserve sponsorship only if the user funds the reserve themselves, another sponsor takes over the obligation, or the object or account is deleted. They checked the choice with early customers and pilots, and found that Stellar's CAP-33, its sponsored-reserves design, imposes an equivalent constraint.

Why it matters beyond one ledger

Reserves exist to make state cost something, so that nobody can fill a ledger with objects for free. Any mechanism that lets a third party pay that cost has to decide who is left holding it when the third party leaves, and "nobody" reopens the attack reserves were meant to close. The honest answer is a lock-in: a sponsor is committed until someone else can carry the object.

For institutions building on sponsorship - the disclosure notes that regulated entities often cannot hold crypto directly - that commitment is a real term of the arrangement, not an edge case. It should be priced and written into agreements with the users being sponsored. The developers say they may explore mechanisms that loosen the lock-in later, such as grace periods or reserve insurance pools, with no timeline; until then, sponsoring means staying.