Introducing XRP Ledger version 3.3.0

Version 3.3.0 of xrpld, the reference server implementation of the XRP Ledger protocol, is now available.

This release introduces several new amendments alongside bug fixes and build improvements. The new amendments are:

• BatchV1_1: Atomic batch transactions (XLS-56).
• ConfidentialTransfer: Privacy-preserving Multi-Purpose Token transfers (XLS-0096).
• DynamicMPT: Multi-Purpose Token properties that issuers can make permanently immutable (XLS-94).
• PermissionDelegationV1_1: Granular account permission delegation.
• Sponsor: Reserve and transaction sponsoring (XLS-68).
• fixCleanup3_3_0: A bundle of amendment-gated bug fixes.

It also retires the long-active Clawback, fixDisallowIncomingV1, fixInnerObjTemplate, fixNFTokenReserve, and fixUniversalNumber amendments, making them a permanent part of the protocol.

If you run an XRP Ledger server, upgrade to version 3.3.0 as soon as possible to ensure service continuity.

On supported platforms, see the instructions on installing or updating xrpld.

For other platforms, please build from source. The most recent commit in the git log should be the change setting the version:

commit 00a178fb92ca49521b937ae1a99d863765ea8a90
Author: Ayaz Salikhov <[email protected]>
Date:   Thu Aug 6 17:34:39 2026 +0100

    chore: Bump version to 3.3.0

• BatchV1_1: Adds the Batch transaction, which lets an account submit up to 8 inner transactions, enabling patterns such as atomic swaps. This amendment fixes and replaces the original Batch amendment disabled in v3.1.1. (#6446)
• ConfidentialTransfer: Adds private transfers for Multi-Purpose Tokens, using advanced cryptography (EC-ElGamal and ZKPs). Balances and transfer amounts remain verifiable on-ledger, while shielding the actual amounts from the public. (#5860)
• DynamicMPT: Extends Multi-Purpose Tokens by making specific properties mutable by default: the on-chain metadata, the transfer fee, and the ability to enable MPT issuance capability flags. (#7439)
• PermissionDelegationV1_1: Allows accounts to delegate some permissions to other accounts. This amendment replaces the original PermissionDelegation amendment, fixing a critical bug discovered in the original implementation of the feature. (#6613)
• Sponsor: Enables companies, token issuers, and other entities to subsidize transaction costs and reserve requirements for end users. Sponsors can co-sign transactions or pre-fund sponsorships, covering fees and reserves, while sponsees retain full control of their accounts and keys. (#5887)
• fixCleanup3_3_0: Bundles these fixes for the 3.3.0 release:
  • Unifies freeze and deep freeze checks for transfers to and from pseudo-accounts in the VaultDeposit, VaultWithdraw, AMMDeposit, AMMWithdraw, LoanBrokerCoverDeposit, and LoanBrokerCoverWithdraw transactions. (#7382)
  • Changes CheckCash and CheckCancel to reject an all-zero CheckID with temMALFORMED during preflight instead of tecNO_ENTRY during processing. (#7685)
  • Fixes hybrid offers being removed from the open order book when the account that placed them loses access to the permissioned domain. (#6843)
  • Fixes Automated Market Maker liquidity being included in quality estimates for permissioned DEX order books. (#6853)
  • Changes AMMWithdraw to return tecAMM_FAILED instead of dividing by zero for the one EPrice value at which the computation's denominator becomes zero. Without this amendment, the division throws and the transaction fails with tefEXCEPTION. (#6989)
  • Adds a precision loss check to AMMDeposit, AMMWithdraw, and AMMClawback when the fixAMMv1_3 amendment is also enabled.
  • Changes the ValidAMM invariant to ensure an AMM can only be deleted by an AMMWithdraw, AMMClawback, or AMMDelete transaction. (#7295)
  • Adds the ObjectHasPseudoAccount invariant, which checks that deleting a ledger entry backed by a pseudo-account also deletes that pseudo-account. (#7445)
  • Adds further precision and rounding fixes for Single Asset Vaults and the Lending Protocol.
  • Changes transactions signed by a pseudo-account to fail with tefBAD_AUTH. This check also takes effect if the LendingProtocol or BatchV1_1 amendment is enabled.
  • Changes CredentialCreate to reject a pseudo-account in the Subject field with tecPSEUDO_ACCOUNT. (d569f7d)
  • Changes DepositPreauth to reject a pseudo-account in the Authorize field with tecPSEUDO_ACCOUNT. (a12ab04)
• The following amendments are retired:
  • Clawback (#7353)
  • fixDisallowIncomingV1 (#7364)
  • fixInnerObjTemplate (#7368)
  • fixNFTokenReserve (#7367)
  • fixUniversalNumber (#5962)

• Added a delegate filter parameter to the account_tx method. (#6126)
• Packaged validator-keys inside the server distribution. (3ad6ce2)

• Added a zero NFT offer ID check for NFTokenCancelOffer. (#7391)
• Disabled AMM creation using vault shares as a pool asset. (#7666)
• Rejected delegating permissions to pseudo-accounts. (#7597)
• Blocked delegated transactions from being queued. (#7640)
• Used trust line balance direction to validate IOU PaymentMint/PaymentBurn. (#7584)
• Strengthened Clawback invariant checks for MPT balances. (#7285)
• Moved AMMInvariant weakInvariantCheck logic into the transaction. (#7032)
• Added RPC validation checks on the amm_info account and amm_account fields. (#7324)
• Added an amendment sponsor for the AccountRootsDeletedClean invariant. (#7801)
• Documented and asserted that after is never null in invariants. (#7354)
• Handled rounding just above kMaxRep more accurately. (#7389)
• Improved Number addition and subtraction rounding. (#7369)
• Fixed the Number comparison operator. (#7406)
• Refactored Batch transaction IDs. (#7736)
• Capped the number of untrusted validator manifests accepted per message and dropped oversized ones. This is the fix released in version 3.2.1. (#7925)
• Increased the validator manifest protocol message size cap and corrected manifest relay. (54cfdda)
• Bounded the untrusted validator manifest cache and reduced its cap. (68a765d, c50edf5)
• Rejected oversized validator manifests before decoding them. (7877ee4)
• Rejected oversized peer protocol ping messages. (6c793ed)
• Bounded and offloaded per-connection subscription cleanup. (1dcaf4b)
• Computed the validation suppression key over the canonical serialization. (7d3611d)
• Set request size limits and differential pricing for get-object-by-hash calls. (e290005)
• Charged the heavy-burden RPC fee in the channel_verify method. (a5af6b4)
• Corrected the transaction type check performed before reading RawTransactions. (faca302)
• Used a weighted median when aggregating close-time offsets. (981c256)
• Handled malformed ledger replay responses. (4a9ee54)
• Improved lookup performance when assembling ledger deltas. (846369c)
• Acquired a lock on getClosedLedgerHash. (d60955e)
• Re-stored nodes missing from both backends during online_delete rotation. (#7763)
• Allocated TaggedCache::getKeys() memory outside of the lock. (#7567)
• Fixed peer resource charges to always run on the peer's strand, so a Drop disposition now correctly disconnects the peer. (#7422)
• Stopped creating a data directory for in-memory databases. (#7323)
• Disabled transaction invariants. (#7409)
• Added [[maybe_unused]] to fix320Enabled for assert=OFF builds. (#7446)
• Adjusted the xrpld systemd service to allow up to five minutes for graceful shutdown, restart only on failure, and reduced the auto-update randomized delay. (#7374)
• Ensured xrpld service directories exist at startup. (#7565)

• Used STLedgerEntry type aliases instead of std::shared_ptr. (#7282)
• Replaced intr_ptr::SharedPtr<SHAMapTreeNode> with SHAMapTreeNodePtr. (#7396)
• Used const function arguments where possible. (#7423)
• Used std::move and std::string_view where possible. (#7424)
• Used std::ranges where possible. (#7634)
• Used std::from_chars/std::to_chars for JSON double parsing and formatting. (#7735)
• Changed config section and key string literals into constants. (#7095)
• Introduced XRPL_ASSERT_IF for amendment-gated assertions. (#7378)
• Cleaned up tec object deletion logic. (#6588)
• Used dispatch instead of post. (#7438)
• Removed the const_cast in TaggedCache::canonicalize_replace_cache. (#5638)
• Renamed keylet functions to more closely match the docs. (#7059)
• Unified the style for all Doxygen comments. (#7776)
• Removed redundant enable checks in confidential MPT transactions. (#7809)
• Moved the jss.h include out of Indexes.h. (#7799)
• Deleted dead code. (#7718)
• Explicitly trimmed the heap after cache sweeps. (#6022)
• Cleaned up pong replies. (5ab9574)
• Dispatched hasInvalidAmount() on type tag instead of dynamic_cast. (#7402)

• Rewrote the build environment docs. (#7533)
• Fixed some comments to improve readability. (#7405)
• Added more information about pre-commit hooks and how to set them up. (#7802)

• Migrated resource and shamap Beast tests to GTest. (#7133)
• Migrated basics Beast tests to GTest. (#7136)
• Added a null-check unit test for Oracle::aggregatePrice. (#7306)
• Added a test for the permissioned domain sequence fix. (#7591)
• Added tests for TMProofPathResponse and TMReplayDeltaResponse invalid hash and key sizes. (#7593)
• Added unit tests for IP address related functions. (#7744)
• Added JSON array size tests. (#7592)
• Added tests for the doxygen style check. (#7795)
• Published test changes held back from 3.1.3. (#7570)
• Suppressed invariant-failure logs in Vault and LoanBroker bug-regression tests. (#7379)
• Fixed LCOV_EXCL_END to LCOV_EXCL_STOP. (#7407)

• Adopted the C++23 standard. (#7431)
• Created a single test binary, xrpl_tests. (#7327)
• Added a verify-headers target to clean up headers. (#7670)
• Added a pragma-once checker. (#7580)
• Aligned xrpld RPM packaging with the DEB package. (#7529)
• Updated workflows and conan to use VS2026 and grpc 1.81.0. (#7550)
• Updated mpt-crypto to 1.0.2. (06a9b1b)
• Uploaded codecov results for the whole XRPLF organization. (bf65e5f)
• Marked secp256k1 and mpt-crypto as transitive headers. (#7658)
• Switched to a new conan XRPLF remote. (#7622, #7638)
• Stopped reusing binaries between different C++ versions. (#7681)
• Fixed the unity build. (#7730)
• Disabled assertions on Release builds. (#7443)
• Ran sanitizers on release builds too. (#7527)
• Silenced UBSan diagnostics in the ubsan build config. (#7531)
• Made sanitizer flags a list in the profile instead of a string. (#7449)
• Redesigned the matrix configuration based on nix images. (#7385)
• Refactored build-related nix, docker, and workflow files. (#7408)
• Checked binaries separately from building them. (#7355)
• Patched binaries in nix-based images and tested in every distro. (#7376)
• Patched nix binaries in CMake. (#7539)
• Patched the conan recipe for nix so it can be used on macOS. (#7532)
• Removed the conan patch in nix. (#7534)
• Updated flake.lock to allow conan with clang-22 support. (#7390)
• Installed gcov, nettools, and cacert in nix images. (#7398)
• Fixed clang ASan include dirs in nix images and added curl and gnupg. (#7400)
• Improved sanitizer libs and added doxygen, dpkg, and rpm in nix. (#7403)
• Added gh and file to nix packages. (#7444)
• Added ClangBuildAnalyzer to nix. (#7538)
• Added zip to nix images. (#7551)
• Added git-lfs to nix images. (#7561)
• Added graphviz to nix images. (#7566)
• Added protobuf dependencies to nix. (#7706)
• Added Rust to the nix docker image. (#7571)
• Added an .envrc for automatic devshell switching via direnv. (#7756)
• Used the same compiler in the nix devshell as in CI. (#7751)
• Used new packaging images and stopped canceling develop builds. (#7417)
• Used the XRPLF/actions build-multiarch-image workflow. (#7428)
• Built and pushed docker images in forks too. (#7588)
• Launched upload-conan-deps on profile change. (#7442)
• Made configurations launch on certain event types. (#7447)
• Ran the full matrix only on Ready to merge or Full CI build labeled PRs. (#7689)
• Fixed workflow launch on matrix-unrelated labels. (#7812)
• Stopped running the conflict checker when a label is applied. (#7774)
• Checked that more tools are available. (#7600)
• Used macOS 26 Tahoe with apple-clang 21. (#7601)
• Updated clang-tidy to nix-based v22. (#7412)
• Used clang-tidy v22 new features. (#7427)
• Better determined when a full clang-tidy run is needed. (#7635)
• Made clang-tidy workflow adjustments to stay in sync with Clio. (#7563)
• Added a script to format clang-tidy output. (#7650)
• Ran clang_tidy_check with pass_filenames: false from pre-commit. (#7800)
• Made clang-tidy happy on macOS. (#7701)
• Enabled groups of clang-tidy checks by default. (#7637)
• Enabled most bugprone clang-tidy checks. (#7643)
• Enabled most modernize clang-tidy checks. (#7664)
• Enabled most misc clang-tidy checks. (#7663)
• Enabled most cppcoreguidelines clang-tidy checks. (#7660)
• Enabled most performance clang-tidy checks. (#7727)
• Enabled most readability clang-tidy checks. (#7772)
• Enabled the modernize-unary-static-assert clang-tidy check. (#7705)
• Enabled the modernize-use-auto clang-tidy check. (#7707)
• Enabled the modernize-avoid-bind clang-tidy check. (#7711)
• Enabled the modernize-use-constraints clang-tidy check. (#7715)
• Improved pre-commit hooks. (#7702)
• Added a pre-commit hook to check doxygen style. (#7794)
• Updated pre-commit hooks and actions. (#7686)
• Used multiple directories in the dependabot config. (#7413)
• Bumped eps1lon/actions-label-merge-conflict from 3.0.3 to 3.1.0. (#7375)
• Bumped actions/checkout from 6.0.2 to 6.0.3. (#7414)
• Bumped actions/checkout from 6.0.3 to 7.0.0. (#7585)
• Bumped actions/setup-python from 6.2.0 to 6.3.0. (#7657)
• Bumped codecov/codecov-action from 6.0.1 to 7.0.0. (#7426)

The following RippleX teams and GitHub users contributed to this release:

• RippleX Engineering
• RippleX Docs
• RippleX Product
• @Kassaking7
• @TimothyBanks
• @dangell7
• @marek-foss-neti
• @solunolab

We welcome reviews of the xrpld code and urge researchers to responsibly disclose any issues they may find.

For more information, see:

• Ripple's Bug Bounty Program
• xrpld Security Policy