The XRP Ledger community has completed a comprehensive security review of XRPL 3.3.0, identifying 96 valid findings across all five proposed amendments. According to the XRPL Operations account, Ripple partnered with Web3 security firm Sherlock to conduct adversarial testing before the proposed amendments reach activation. The program invited security researchers and community members to examine each feature under competitive conditions, with participants earning $309,000 in RLUSD rewards for their contributions. Every proposed amendment received at least one verified report during the assessment, with researchers focusing on Batch Transactions, Permission Delegation, MPT decentralized exchange functionality, Confidential Transfers for Multi-Purpose Tokens, and Sponsored Fees and Reserves.
Ripple has voted to support two XRP Ledger amendments designed to introduce single-asset vaults and fixed-term institutional lending directly at the network's protocol level. According to the latest voting data, XLS-65, which would introduce Single Asset Vaults, has reached approximately 40% support, while XLS-66, covering the proposed Lending Protocol, has received more than 37% support. Both amendments require over 80% support for two consecutive weeks before activation, with the current totals remaining well below the activation threshold. Based on the current default Unique Node List configuration, the proposals would need support from at least 28 of 35 validators for activation. Ripple's vote carries attention because the company remains a major contributor to XRPL development, but it cannot activate the proposals by itself.
Confidential Transfers for Multi-Purpose Tokens (MPTs), the most privacy-focused proposal in version 3.3.0, would allow users to encrypt balances and payment amounts while keeping accounts and token types visible. The feature targets institutions that need transaction confidentiality while operating on a shared ledger, using cryptographic proofs to confirm validity without publicly revealing underlying figures. According to RWA.xyz data, XRP Ledger hosts approximately $1.38 billion in distributed real-world assets, with Ripple's RLUSD stablecoin accounting for $845.7 million. Removing RLUSD leaves more than $530 million in other distributed tokenized assets that could potentially use the privacy feature, including Ondo Finance at $212.6 million, VERT Capital at $116.1 million, and Archax at $55.4 million. The privacy amendment would initially apply only to direct MPT payments between accounts, excluding exchange trades, escrow arrangements, and checks.
The lending code has undergone several security reviews ahead of the validator decision, with blockchain security firm Halborn completing a comprehensive re-audit covering transaction checks, accounting rules, access controls, parameter limits, and consistency between protocol states. The review found no critical or high-risk vulnerabilities, identifying only five issues: one medium-risk finding, two low-risk findings, and two informational findings. Ripple addressed, accepted, or acknowledged all five findings, with the medium-risk issue involving a way loan interest could cause a vault to exceed its maximum asset limit. The audit does not eliminate default, underwriting, liquidity, or implementation risks, but cleared another technical requirement as validators assess whether the amendments are ready for mainnet use. The separation between off-chain underwriting and on-chain execution is designed to accommodate regulated lenders that cannot rely entirely on anonymous borrowers and automated liquidations.
Sponsor, based on XLS-68, allows third parties to cover transaction fees or reserve requirements while users retain full account control. According to XRPL Operations, this feature could enable applications to onboard users without requiring them to acquire XRP solely for network costs. Permission Delegation gives institutions the ability to assign limited transaction permissions without exposing full signing authority, providing enhanced control over institutional access. DynamicMPT targets token issuers through the XLS-94 proposal, letting issuers designate selected MPT properties as mutable when creating tokens, then update those fields later to accommodate changing business or compliance requirements. The Batch Transactions allow users to execute up to eight transactions across different accounts within one atomic operation, enabling developers to build more complex applications while reducing settlement risks.
The Confidential Transfers feature targets the growing market for tokenized real-world assets on XRPL, where about $1.38 billion is already issued across multiple institutional issuers. According to RWA.xyz data aggregator, $845.7 million of RLUSD accounts for the largest portion, followed by Ondo at $212.6 million, VERT Capital at $116.1 million, and Archax at $55.4 million. Societe Generale holds $11.6 million in tokenized assets, leaving more than $530 million of tracked tokenized assets outside RLUSD. Ripple has been actively pushing XRPL deeper into tokenized finance throughout 2026, with Aviva Investors launching a tokenized share class of its U.S. Dollar Liquidity Fund on the ledger after announcing the project with Ripple in February. The privacy proposal could be relevant to U.S.-linked tokenized securities, as demonstrated by the May test involving JPMorgan, Mastercard, Ripple and Ondo with a tokenized U.S. Treasury fund. Developers are already testing possible applications on XRPL's Lending DevNet, with yield protocol SOIL planning to become one of the first applications built on the Single Asset Vault and Lending Protocol framework.
