XRP

Two fixes for restricted tokens

XRP Ledger developers have proposed changes that would close the remaining exceptions allowing restricted tokens to reach accounts their issuers never approved, under a single network upgrade called fixCleanup3_5_0 (CoinDesk). CoinDesk counted four changes, but two of them were closed after review on 28 October, leaving pull request 8648 and pull request 8650 open (rippled). Issuers of regulated assets, such as stablecoins or tokenised funds, can require approval before anyone holds their tokens, and that approval sits on the trust line an account sets up to hold someone else's token (CoinDesk).

The payment engine's authorisation gate only fired when a trust line's balance was exactly zero, so a line that already carried a balance kept receiving, which is how an unauthorised position could grow, and a payment crossing zero could turn a holder into an unauthorised holder of the counterparty's issuance (XRPLF's rippled). Pull request 8650 closes that zero-balance exemption, and pull request 8648 checks recipients on every route to an LPToken, including payments, resting offers, NFT offers at creation and acceptance, AMM bids and AMM deposits (PR 8650, PR 8648).

Neither has been merged into the network's main software. Activation would need support from more than 80 percent of trusted validators for two consecutive weeks, and the XRP Ledger Foundation says it knows of no outsider exploiting the remaining exceptions (CoinDesk).

RLUSD reaches Coinbase

Coinbase confirmed on 28 October that customers in supported regions can trade and manage RLUSD through Coinbase Prime, Coinbase Exchange and the Coinbase app, depositing and withdrawing across the XRP Ledger, Base and Ethereum and converting US dollars into RLUSD at a 1:1 rate (Coinbase). Ripple will provide liquidity on Base (Coinbase). Reports of Ripple's figure for RLUSD's market value differ: more than $2.4 billion according to crypto.news, more than $2.6 billion according to The Block.

At Ripple's Swell conference on 28 October the company said it expects to reach an annualised product revenue run rate of about $900 million by the end of 2026, spread across payments, custody, RLUSD and prime brokerage (CryptoBriefing). A run rate annualises a recent period rather than reporting booked revenue (CryptoBriefing).

What to watch

• Whether pull requests 8648 and 8650 are merged, after which fixCleanup3_5_0 needs more than 80 percent validator support for two consecutive weeks (CoinDesk).
• Coinbase Global Exchange support for RLUSD and the terms for using it as collateral, which Ripple said will come later (crypto.news).

On 20 October Ripple filed a 20-page comment letter on the SEC's proposed Regulation Crypto Assets, urging the Commission to adopt it as a final rule, with changes. Chief legal officer Stuart Alderoty argued on X that years of "case by case, coin by coin" enforcement had pushed innovation offshore, as reported by crypto.news.

The contract is the security, not the token

The letter's central claim is that an investment contract involving a crypto asset does not turn the asset into a security: "It is the investment contract, not the crypto asset itself, that is the security," the letter says. Ripple backs the draft's safe harbour, under which an investment contract ends once the issuer has completed or permanently ceased the managerial efforts it promised, but opposes a separate decentralization test, wanting regulators to look at what the issuer expressly promised instead, crypto.news reports.

What Ripple is asking for

Ripple wants intermediaries to be able to rely on a filed Form TR, the proposed filing showing those efforts have ended. It wants the safe harbour extended to the Investment Company Act and Investment Advisers Act. And it wants Rule 500, which preempts state law for some secondary trading, to stop excluding dealers with no end date, according to the letter.

The cost argument

Alderoty wrote that Ripple spent more than $150 million to get clarity. The letter also cites a National Cryptocurrency Association study estimating that rules in place from 2022 to October 2026 would have brought 382 to 1,518 more US token offerings and $325 million to $1.117 billion in capital, CryptoPotato reports.

fixCleanup3_4_0 slips to 4 November

The fixCleanup3_4_0 amendment did not activate on 23 October. Validator support fell to 26 of 35 trusted validators, below the 29 required, at about 12:54 UTC on 21 October and was back above the threshold by 14:46 UTC, which restarted the two-week countdown, Coinpaper reports. Activation is now expected at about 14:46 UTC on 4 November, U.Today and CoinTurk report, with 31 of 35 validators in support as of 22 October.

What to watch

The 4 November activation, and the SEC's revisions to the proposal: the formal comment period closed on 20 October, but the SEC said it would keep accepting comments after the deadline, Cryptonomist reports.

Why it is in the news now

The XRP Ledger is heading for a software upgrade on Oct. 23 that closes a permission loophole that could have allowed certain accounts to mint tokens while only being authorised to destroy them. The fix, called fixCleanup3_4_0, reached the 80 percent validator supermajority it needed on Oct. 9 and is now running through a mandatory two-week countdown, with a target activation time of about 09:34 UTC on Oct. 23. Separately, the same network remains ten votes short of activating the native, uncollateralised lending system Ripple has been pitching to banks and payment companies.

What the patch does

The amendment shipped with version 3.4.0 of `xrpld`, the reference implementation of the XRP Ledger protocol, released on Sep. 17. The most consequential change for ordinary holders is a fix to PermissionDelegationV1_1, a feature that activated on Oct. 8 and lets one account grant another limited authority to act on its behalf. One permission, PaymentBurn, is supposed to let an authorised account destroy certain tokens. A flaw in the code could under specific conditions have produced the opposite outcome, minting tokens instead, according to the GitHub release notes. The official XRPL documentation warned operators against granting that permission until the cleanup activated, according to Bitcoin.com's coverage. The same patch tightens how vaults round withdrawals, changes when the lending code declares a loan late or in default, and prevents certain automated market maker transactions from silently burning liquidity tokens without returning assets. Outright new products are not part of this amendment.

Why the lending system is still on hold

Ripple has pitched a lending protocol in which a lender deposits XRP or another token into a vault and a loan broker lends the balance out for a fixed term, with the ledger recording the loan and tracking repayments. Because borrowers do not post collateral, the broker's credit judgement is the only thing standing between lenders and a default, the pitch explains in the CoinDesk account of the lending design. The LendingProtocolV1_1 amendment, which extends single-asset vaults with closed-ended structures and cash-basis accounting, had about 19 validator votes as of Monday, short of the 29 needed to start a countdown. A separate amendment covering the vaults themselves had about 21 votes. Even if both cleared the threshold today, lending could not go live immediately, because every amendment must serve its own two-week wait, the same CoinDesk report notes.

What to watch

The Oct. 23 09:34 UTC activation is the next dated moment. If validator support slips to 80 percent or below before the countdown ends, the timer resets and the patch waits another two weeks. After activation, node operators need to upgrade to xrpld 3.4.0 to keep following consensus. The lending amendments continue collecting votes, with the lending amendment at 19 and the vault amendment at 21 as of Monday.