Entwickler des XRP Ledgers schlagen fixCleanup3_5_0 vor, um zu verhindern, dass beschränkte Token auf nicht autorisierte Konten gelangen

Coinbroid · 2026-10-30T10:32:27.000Z

EINLEITUNG Zwei offene Pull Requests im XRPL-rippled-Repository, die am 27. Oktober 2026 eröffnet wurden, würden Sicherheitslücken schließen, durch die Token mit Genehmigungsregeln des Emittenten (RequireAuth) auf Konten gelangen können, die der Emittent nie autorisiert hat; beide sind an eine neue Amendment gebunden: fixCleanup3_5_0. Nach der ersten Änderung müsste ein Konto für beide Vermögenswerte in einem AMM-Pool autorisiert sein, bevor es über irgendeinen Weg den LP-Token dieses Pools erwerben kann – auch über Zahlungen, DEX-Angebote, NFT-Angebote und Gebote auf AMM-Auktionsplätze. WICHTIGE DETAILS - Zwei offene Pull Requests im XRPL-rippled-Repository, die am 27. Oktober 2026 eröffnet wurden, würden Sicherheitslücken schließen, durch die Token mit Genehmigungsregeln des Emittenten (RequireAuth) auf Konten gelangen können, die der Emittent nie autorisiert hat; beide sind an eine neue Amendment gebunden: fixCleanup3_5_0.

OPENING
Two open pull requests on the XRPL rippled repository, opened October 27, 2026, would close gaps that let tokens with issuer approval rules (RequireAuth) reach accounts the issuer never authorized; both are gated behind a new amendment, fixCleanup3_5_0. Under the first change, an account would need authorization for both assets in an AMM pool before it can acquire that pool's LP token by any route, including payments, DEX offers, NFT offers and AMM auction-slot bids.
KEY DETAILS
- Two open pull requests on the XRPL rippled repository, opened October 27, 2026, would close gaps that let tokens with issuer approval rules (RequireAuth) reach accounts the issuer never authorized; both are gated behind a new amendment, fixCleanup3_5_0.
- Under the first change, an account would need authorization for both assets in an AMM pool before it can acquire that pool's LP token by any route, including payments, DEX offers, NFT offers and AMM auction-slot bids.
- The second change closes an exemption where the payment engine's authorization check only applied when a trust line's balance was exactly zero, so an unauthorized line that already held tokens could keep receiving more.
- Neither change has been merged into rippled; fixCleanup3_5_0 is listed on the develop branch as supported with a default 'no' vote, and like any XRPL amendment it would activate only after holding more than 80% support from trusted validators for two weeks.
- The work was originally split into four pull requests; two further layers, one limiting unauthorized balances to returning funds to the issuer and a trust-line authorization invariant, were closed after review.
WHY IT MATTERS
Stablecoin and tokenized-fund issuers rely on these approval rules. (Analysis, not a confirmed fact.)
IMPORTANT CONTEXT
- Source pull requests: XRPLF/rippled #8648 and #8650, last updated October 28-29, 2026.
- This is a protocol development update, not investment advice.
- This article is informational and is not financial advice. Digital assets are volatile.
SOURCE
- Primary / main source: https://x.com/CoinDesk/status/2116112415096242286
- Supporting: https://github.com/XRPLF/rippled/pull/8648
- Supporting: https://github.com/XRPLF/rippled/pull/8650
- Supporting: https://github.com/XRPLF/rippled/blob/develop/include/xrpl/protocol/detail/features.macro
- Supporting: https://xrpl.org/docs/concepts/networks-and-servers/amendments
- Supporting: https://www.coindesk.com/tech/2026/10/30/xrp-ledger-developers-tighten-the-rules-for-who-can-hold-restricted-tokens
#XRP #XRPL