Overview
- Developers proposed the four-change amendment, called fixCleanup3_5_0, on Friday, October 30, 2026 to close gaps that let issuer‑restricted tokens reach accounts without explicit issuer approval.
- One fix would stop accounts from gaining liquidity‑provider (LP) tokens unless they hold authorization for both assets in an automated market maker pool, closing a route that could expose unapproved holders to restricted assets.
- Another change would block trust lines that already have a nonzero balance from receiving additional restricted tokens without issuer authorization, fixing a check that only ran when balances were zero.
- The package is not live on mainnet because it must first be merged into the xrpld release, win sustained support from more than 80% of the network’s trusted validators for two continuous weeks, and require operators to run compatible client upgrades before activation.
- The XRPL Foundation says this is routine protocol hardening with no known outside exploitation and that identified unapproved balances trace back to issuers or previously approved accounts, while issuers could retroactively approve affected holders to restore full use.