Transactions, costs and the vote

Using a confidential balance is a short loop.

1. Convert in. Move tokens from your public balance to confidential form. The amount you convert is visible. The first conversion also registers your encryption key.
2. Merge. Converted and received funds wait in your inbox. Merge them into your spending balance.
3. Send. Pay another holder who has registered a key. The amount is hidden.
4. Convert back. Move tokens to public form again. This amount is visible too.

The issuer has a fifth action, clawback.

Confidential transactions cost more than normal ones. Checking the proofs is extra work for every server, so the fee is higher. It is still a small fraction of one XRP.

Where it stands. The feature shipped in server version 3.3.0 in August 2026. It is not active. Validators vote on it like any other amendment. It needs more than 80% of trusted validators, held for two weeks.

Even after it activates, nothing changes for a token until its issuer switches the feature on. Wallets also need to add support, since they create the keys and proofs.

Notes:

• The issuer account cannot send the four holder transactions. They fail with temMALFORMED.
• ConfidentialMPTConvert and ConfidentialMPTConvertBack include a BlindingFactor. Validators use it to check that the ciphertexts match the plaintext amount.
• Only the spending balance can be converted back. Inbox funds must be merged first.
• All five fail with temDISABLED until the amendment is enabled.

Cost. Before load scaling, a single-signed confidential MPT transaction costs 100 drops. Multi-signed, it costs 10 drops × (10 + number of signatures). The XRP is destroyed, as with every transaction cost.

Amendment.

With a default vote of No, each validator operator has to opt in. Support must stay above 80% of trusted validators for two weeks. A drop below that restarts the clock. A server without the code for an enabled amendment becomes amendment blocked until it upgrades.

DynamicMPT is a separate amendment with its own vote. Without it, an issuer can enable confidential balances only when creating a token.

See How amendments happen.

Live count: Amendments page. Live count: Amendments page.