Clawback and AMMClawback

Clawback lets an issuer take its tokens back from a holder. The usual example: tokens reached an account sanctioned for illegal activity, and the issuer must recover them.

Clawback is off by default, and the timing rule is strict. An issuer can turn it on only while its account owns nothing: no trust lines, offers, escrows, payment channels, checks or signer lists. So it must decide before anyone holds the token. After that:

• Clawback can never be turned off.
• The issuer can never set No Freeze. The two settings exclude each other.

The timing rule protects holders. An issuer cannot add clawback to a token you already hold. If a token can be clawed back, that was true before its first holder, and the flag shows it.

Clawback works even on a frozen line. XRP can never be clawed back.

Pools. Tokens in an AMM pool belong to the pool's own account, not to you. Regular clawback cannot reach them. AMMClawback, live since 2025-01-30, lets the issuer pull its token out of a pool in proportion to your share. The other asset in your share comes back to you.

Before AMMClawback, a new AMM pool could not be created with a token from a clawback-enabled issuer.

Enable. AccountSet with SetFlag: 16 (asfAllowTrustLineClawback). Stored as lsfAllowTrustLineClawback (0x80000000).

• Fails with tecOWNERS if the owner directory is not empty.
• Fails with tecNO_PERMISSION if lsfNoFreeze is set. Setting No Freeze afterwards fails the same way.

Clawback (XLS-39, enabled 2024-02-08):

{
  "TransactionType": "Clawback",
  "Account": "r...issuer",
  "Amount": { "currency": "FOO", "issuer": "r...holder", "value": "314.159" }
}

• Amount.issuer names the holder, not the issuer.
• If value exceeds the holder's balance, the whole balance is clawed back.
• The Holder field is for MPTs only. Omit it for trust line tokens.
• If the holder is an AMM, the result is tecAMM_ACCOUNT. Use AMMClawback instead.
• If the line ends in its default state, the transaction removes it.

AMMClawback (XLS-73, enabled 2025-01-30):

• Fields: Holder, Asset (issued by the sender), Asset2, and an optional Amount. Without Amount, all of the holder's share of Asset is clawed back.
• Without flags, the matching share of Asset2 goes back to the holder.
• tfClawTwoAssets (0x00000001) claws back both assets. It works only when the sender issued both.
• tecAMM_BALANCE means the holder has no LP tokens in that pool.
• It ignores the holder's reserve, so removing a trust line does not block it.

The AMMClawback amendment also stops AMMDeposit from depositing frozen tokens.

For Multi-Purpose Tokens, clawback is a per-issuance setting called Can Clawback.