XRPL fix would bar unauthorised accounts from AMM tokens of restricted assets

Serguey Asael Shinder31 October 2026, 10:352 min read

Issuers on the XRP Ledger can set RequireAuth, so that only accounts they approve may hold their token. A pull request opened in the rippled repository on 27 October (https://github.com/XRPLF/rippled/pull/8648) describes a gap in that control around automated market makers and proposes a fix.

An AMM liquidity token, or LPToken, is a claim on both assets in its pool, and LPTokens can be transferred freely. Depositing into a pool already requires authorisation for both assets. But according to the pull request, an account never authorised for a RequireAuth asset could still receive the LPToken another way: through a payment, a cashed check, an offer, an NFT offer or a refund from an AMM auction slot. If the issuer of the other asset then used AMMClawback, the paired restricted asset would land in that account as a real balance on a trust line its issuer never approved. The pull request cites XLS-0073, which states that a wallet not authorised for one AMM asset must not gain exposure to it through the AMM.

Under a placeholder amendment, fixCleanup3_5_0, a new check called checkLPTokenAuthorization would require authorisation for both pool assets on every path by which an account acquires an LPToken. Payments delivering one to an unauthorised account are rejected, offers to buy one are refused and resting ones removed instead of crossed, NFT offers priced in LPTokens are blocked, and an outbid AMM auction holder that is no longer authorised forfeits its refund. Getting out stays allowed: returning an LPToken to its AMM or withdrawing one asset is not gated, and AMMClawback itself is unchanged.

The pull request is open and is the first of two split from a larger change; a second, #8650, is stacked on it.

What it means

The fix matters most to issuers of regulated tokens, such as stablecoins and tokenised securities, who rely on RequireAuth to know exactly who holds their asset. It would change ledger behaviour only after the amendment is released and voted in by validators, so nothing is different on mainnet today.