Three amendments that change what one signature can do are now enabled on the XRP Ledger mainnet:
- Batch (XLS-56): several transactions under one signature;
- permission delegation (XLS-75): another account signs for yours;
- Multi-Purpose Tokens (MPTs, XLS-33): a second kind of token next to trust lines, with the issuer's rules built in.
An AI agent that signs XRPL transactions, or a wallet that shows them to a person, has to read them differently now. A check that only looks at the outer TransactionType sees Batch and misses what is inside.
Batch: read every inner transaction
A Batch wraps 2 to 8 inner transactions under one signature. A mode flag decides what happens when one fails: all or nothing (tfAllOrNothing), only the first that succeeds (tfOnlyOne), until the first failure (tfUntilFailure), or each on its own (tfIndependent). Inner transactions can come from other accounts too; they sign in BatchSigners.
What it can hide: everything an ordinary transaction can do, next to something harmless. A small payment plus a SetRegularKey to someone else's key gives the account away, just as the SetRegularKey alone would. So does a SignerListSet with other signers, or an AccountDelete.
What to check:
- Judge every inner transaction as if it were signed on its own.
- When inner transactions come from more than one account, check the mode. Anything but all-or-nothing means your part can go through while the other account's part fails.
- A Batch must hold 2 to 8 transactions, set exactly one mode flag and contain no other Batch.
This is what our pre-sign check, presign-guard, returns for a Batch that pays a shop and sets a regular key (run against mainnet, other reasons left out):
{
"verdict": "red",
"reasons": [
{ "code": "XRPL_BATCH", "severity": "info",
"details": { "mode": "tfAllOrNothing", "transactions": ["Payment", "SetRegularKey"] } },
{ "code": "XRPL_REGULAR_KEY_CHANGE", "severity": "red",
"subject": "rPT1Sjq2YGrBMTttX4GZHjKu9dyfzbpAYe",
"details": { "inner": 1,
"effect": "the regular key can sign every transaction for the account, including moving all its funds" } }
]
}
details.inner is the place of the inner transaction in RawTransactions.
Permission delegation: who may sign for you
DelegateSet lets another account, the delegate, sign certain transaction types for yours, spending your funds, until you remove the permission. It takes up to 10 permissions: transaction types such as Payment, or granular ones such as TrustlineAuthorize. The ledger refuses account-level types (SetRegularKey, SignerListSet, AccountSet, AccountDelete), and an empty list removes them all.
What it can hide: a delegate needs no key of yours. With Payment it can pay itself; with CheckCreate, EscrowCreate or a payment channel it writes you a check, escrow or channel it can claim; with OfferCreate or an NFT offer it trades your funds against its own offer at any price.
What to check: who the delegate is, and whether any permission moves funds. Delegating those makes sense only to an account you control, such as your own agent's account with a small budget. presign-guard calls them red (XRPL_DELEGATE_FUNDS) and other permissions orange (XRPL_DELEGATE_SET).
MPTs: tokens with the issuer's rules built in
An MPT is issued once with its rules as flags: whether the issuer can claw tokens back, lock them, require authorisation, and whether holders may transfer them to each other, plus a transfer fee of up to 50%. A holder opts in with MPTokenAuthorize. The issuance ID is the issuer's sequence number plus its account ID, so the issuer can be read from the ID itself.
- Before opting in: can the issuer claw back, has it locked the token, what fee does it take, and does the issuance exist? A ticker of RLUSD from anyone but Ripple is a fake.
- Before paying in an MPT: the payment fails when the issuer has locked the token or the destination's balance, when transfers between holders aren't allowed, or when the destination hasn't opted in or isn't authorised.
How an agent can check
-
Free, verdict only: presign-guard's MCP server (
https://presign-guard.fizzl.eu/mcp) has a free tool,presign_quick_check, that takes{"type": "xrpl", "tx": {…}}. -
With the reasons, $0.01:
presign_check, orPOST https://presign-guard.fizzl.eu/v1/check, paid over x402 in RLUSD on the XRP Ledger or in USDC on Base, Solana, Algorand or Stellar. -
In your agent's wallet: presign-guard-wallet 0.23 runs the check before every XRPL signature.
xrplSigner(signer, { any: true })signs trust lines, DEX orders and Batches only after the check, and counts what they can take out toward the agent's spending limits.
Sign on green; on orange, read the reasons first; on red, don't sign.
The full guide, with an FAQ and links to the xrpl.org references: fizzl.eu/guides/xrpl-batch-delegation-mpt.
Originally published at fizzl.eu.
