Checking a token before you trust it

Anyone can create a token on the XRP Ledger and give it any name. A token called USD, or named after a famous project, may have no link to the real thing. The name proves nothing. The issuer address is what counts.

Before you add a trust line:

1. Find the issuer address on the project's own website.
2. Compare it with the address in your wallet, character by character.
3. Look the issuer up on an explorer. Check its domain and settings.
4. Check whether the issuer can freeze or claw back. See Freeze, Deep Freeze and Clawback.

The domain check. An issuer can write a website domain into its account. Anyone can type any domain there. So a careful app also fetches a file from that website, called xrp-ledger.toml, and looks for the address in it. When the account points to the site and the site points back, the same people most likely control both. That tells you who runs the issuer. It does not tell you the token is worth holding.

Why unknown airdrops are bait. No one can drop a new token into your account, because you have to add a trust line first. So fake airdrops ask you to act:

• A post says an airdrop is live and links to a claim page.
• The page asks you to connect your wallet and sign.
• The transaction you sign sends your funds away or hands over control of your account.

Other bait arrives as tiny payments. It might be 1 drop of XRP with a link in the memo, or one unit of a token you already hold. The amount does not matter. The goal is to get you to the link. Ignore it, and do not send anything back.

Each trust line you add also locks 0.2 XRP. If you cannot explain a transaction in one sentence, do not sign it.

Domain. account_info returns the issuer's Domain as hex of the lowercase ASCII domain. 6578616D706C652E636F6D decodes to example.com.

xrp-ledger.toml. Served over HTTPS at https://{DOMAIN}/.well-known/xrp-ledger.toml. Relevant tables:

• [[ACCOUNTS]] with address.
• [[CURRENCIES]] with code and issuer.

Account verification needs both links. The file lists the address, and the account's Domain matches the serving domain exactly, subdomains included. The spec says either link alone should not be treated as authoritative.

Flags. account_info returns account_flags with booleans such as allowTrustLineClawback, globalFreeze, noFreeze, requireAuthorization and disableMasterKey.

Blackholed issuers. A blackholed account can never sign again, so it cannot issue more tokens or change its settings. Check all of these:

• lsfDisableMaster is set.
• RegularKey is rrrrrrrrrrrrrrrrrrrrrhoLvTp or rrrrrrrrrrrrrrrrrrrrBZbvji.
• account_objects shows no SignerList and no Delegate entry.

Offers and other entries made before blackholing can still complete, so some new tokens could still be issued that way.

Spam. A spam payment cannot spend your XRP, change your settings or give anyone access. It only adds an entry to your history.

Wallet warnings. Xaman shows the same warning for every token, because it does not vet tokens or issuers.