Amendments

Introduced in: rippled 0.31.0

The Amendments system provides a means of introducing new features to the decentralized XRP Ledger network without causing disruptions. The amendments system works by utilizing the core consensus process of the network to approve any changes by showing continuous support before those changes go into effect. An amendment normally requires 80% support for two weeks before it can apply.

When an Amendment has been enabled, it applies permanently to all ledger versions after the one that included it. You cannot disable an Amendment, unless you introduce a new Amendment to do so.

Background

Any changes to transaction processing could cause servers to build a different ledger with the same set of transactions. If some validators (rippled servers participating in consensus) have upgraded to a new version of the software while other validators use the old version, this could cause anything from minor inconveniences to full outages. In the minor case, a minority of servers spend more time and bandwidth fetching the actual consensus ledger because they cannot build it using the transaction processing rules they already know. In the worst case, the consensus process might be unable to validate new ledger versions because servers with different rules could not reach a consensus on the exact ledger to build.

Amendments solve this problem, so that new features can be enabled only when enough validators support those features.

Users and businesses who rely on the XRP Ledger can also use Amendments to provide advance notice of changes in transaction processing that might affect their business. However, API changes that do not impact transaction processing or the consensus process do not need Amendments.

About Amendments

An amendment is a fully-functional feature or change, waiting to be enabled by the peer-to-peer network as a part of the consensus process. A rippled server that wants to use an amendment has code for two modes: without the amendment (old behavior) and with the amendment (new behavior).

Every amendment has a unique identifying hex value and a short name. The short name is for human use, and is not used in the amendment process. Two servers can support the same amendment ID while using different names to describe it. An amendment's name is not guaranteed to be unique.

By convention, Ripple's developers use the SHA-512Half hash of the amendment name as the amendment ID.

See also: Known Amendments

Amendment Process

Every 256th ledger is called a "flag" ledger. The process of approving an amendment starts in the ledger version immediately before the flag ledger. When rippled validator servers send validation messages for that ledger, those servers also submit votes in favor of specific amendments. If a validator does not vote in favor of an amendment, that is the same as voting against the amendment. (Fee Voting also occurs around flag ledgers.)

The flag ledger itself has no special contents. However, during that time, the servers look at the votes of the validators they trust, and decide whether to insert an EnableAmendment pseudo-transaction into the following ledger. The flags of an EnableAmendment pseudo-transaction show what the server thinks happened:

  • The tfGotMajority flag means that support for the amendment has increased to at least 80% of trusted validators.
  • The tfLostMajority flag means that support for the amendment has decreased to less than 80% of trusted validators.
  • An EnableAmendment pseudo-transaction with no flags means that support for the amendment has been enabled. (The change in transaction processing applies to every ledger after this one.)

A server only inserts the pseudo-transaction to enable an amendment if all of the following conditions are met:

  • The amendment has not already been enabled.
  • A previous ledger includes an EnableAmendment pseudo-transaction for this amendment with the tfGotMajority flag enabled.
  • The previous ledger in question is an ancestor of the current ledger.
  • The previous ledger in question has a close time that is at least two weeks before the close time of the latest flag ledger.
  • There are no EnableAmendment pseudo-transactions for this amendment with the tfLostMajority flag enabled in the consensus ledgers between the tfGotMajority pseudo-transaction and the current ledger.

Theoretically, a tfLostMajority EnableAmendment pseudo-transaction could be included in the same ledger as the pseudo-transaction to enable an amendment. In this case, the pseudo-transaction with the tfLostMajority pseudo-transaction has no effect.

Amendment Voting

Each version of rippled is compiled with a list of known amendments and the code to implement those amendments. By default, rippled supports known amendments and opposes unknown amendments. Operators of rippled validators can configure their servers to explicitly support or oppose certain amendments, even if those amendments are not known to their rippled versions.

To become enabled, an amendment must be supported by at least 80% of trusted validators continuously for two weeks. If support for an amendment goes below 80% of trusted validators, the amendment is temporarily rejected. The two week period starts over if the amendment regains support of at least 80% of trusted validators. (This can occur if validators vote differently, or if there is a change in which validators are trusted.) An amendment can gain and lose a majority any number of times before it becomes permanently enabled. An amendment cannot be permanently rejected, but it becomes very unlikely for an amendment to become enabled if new versions of rippled do not have the amendment in their known amendments list.

As with all aspects of the consensus process, amendment votes are only taken into account by servers that trust the validators sending those votes. At this time, Ripple (the company) recommends only trusting the default validators that Ripple operates. For now, trusting only those validators is enough to coordinate with Ripple on releasing new features.

Configuring Amendment Voting

You can temporarily configure an amendment using the feature command. To make a persistent change to your server's support for an amendment, change your server's rippled.cfg file.

Use the [veto_amendments] stanza to list amendments you do not want the server to vote for. Each line should contain one amendment's unique ID, optionally followed by the short name for the amendment. For example:

[veto_amendments]
C1B8D934087225F509BEB5A8EC24447854713EE447D277F69545ABFA0E0FD490 Tickets
DA1BD556B42D85EA9C84066D028D355B52416734D3283F85E216EA5DA6DB7E13 SusPay

Use the [amendments] stanza to list amendments you want to vote for. (Even if you do not list them here, by default a server votes for all the amendments it knows how to apply.) Each line should contain one amendment's unique ID, optionally followed by the short name for the amendment. For example:

[amendments]
4C97EBA926031A7CF7D7B36FDE3ED66DDA5421192D63DE53FFB46E43B9DC8373 MultiSign
42426C4D4F1009EE67080A9B7965B44656D7714D104A72F9B4369F97ABF044EE FeeEscalation

Amendment Blocked

When an amendment gets enabled for the network after the voting process, servers running earlier versions of rippled that do not know about the amendment become "amendment blocked" because they no longer understand the rules of the network. Servers that are amendment blocked:

  • Cannot determine the validity of a ledger
  • Cannot submit or process transactions
  • Do not participate in the consensus process
  • Do not vote on future amendments

Becoming amendment blocked is a security feature to protect backend applications. Rather than guessing and maybe misinterpreting a ledger after new rules have applied, rippled reports that it does not know the state of the ledger because it does not know how the amendment works.

The amendments that a rippled server is configured to vote for or against have no impact on whether the server becomes amendment blocked. A rippled server always follows the set of amendments enabled by the rest of the network, to the extent possible. A server only becomes amendment blocked if the enabled amendment is not included in the amendment definitions compiled into the server's source code -- in other words, if the amendment is newer than the server.

If your server is amendment blocked, you must upgrade to a new version to sync with the network.

Testing Amendments

If you want to see how rippled behaves with an amendment enabled, before that amendment gets enabled on the production network, you can run use rippled's configuration file to forcibly enable a feature. This is intended for development purposes only.

Because other members of the consensus network probably do not have the feature enabled, you should not use this feature while connecting to the production network. While testing with features forcibly enabled, you should run rippled in Stand-Alone Mode.

To forcibly enable a feature, add a [features] stanza to your rippled.cfg file. In this stanza, add the short names of the features to enable, one per line. For example:

[features]
MultiSign
TrustSetAuth

Known Amendments

[Source]

The following is a comprehensive list of all known amendments and their status on the production XRP Ledger:

Name Introduced Status
FlowCross v0.70.0 Planned: TBD
SHAMapV2 v0.33.0 Planned: TBD
OwnerPaysFee N/A Planned: TBD
Tickets N/A Planned: TBD
SortedDirectories v0.80.0 Enabled: 2017-11-14
fix1201 v0.80.0 Enabled: 2017-11-14
fix1512 v0.80.0 Enabled: 2017-11-14
fix1523 v0.80.0 Enabled: 2017-11-14
fix1528 v0.80.0 Enabled: 2017-11-14
EnforceInvariants v0.70.0 Enabled: 2017-07-07
fix1373 v0.70.0 Enabled: 2017-07-07
fix1368 v0.60.0 Enabled: 2017-03-31
PayChan v0.33.0 Enabled: 2017-03-31
Escrow v0.60.0 Enabled: 2017-03-31
TickSize v0.50.0 Enabled: 2017-02-21
SusPay v0.31.0 Vetoed: Removed in v0.60.0
CryptoConditions v0.50.0 Enabled: 2017-01-03
Flow v0.33.0 Enabled: 2016-10-21
FlowV2 v0.32.1 Vetoed: Removed in v0.33.0
TrustSetAuth v0.30.0 Enabled: 2016-07-19
MultiSign v0.31.0 Enabled: 2016-06-27
FeeEscalation v0.31.0 Enabled: 2016-05-19

Note: In many cases, an incomplete version of the code for an amendment is present in previous versions of the software. The "Introduced" version in the table above is the first stable version. The value "N/A" indicates that the amendment is not yet considered stable.

CryptoConditions

Amendment ID Status
1562511F573A19AE9BD103B5D6B9E01B3B46805AEC5D3C4805C902B514399146 Enabled

Although this amendment is enabled, it has no effect unless the SusPay amendment is also enabled. Ripple does not expect SusPay to become enabled. Instead, Ripple plans to incorporate crypto-conditions in the Escrow amendment.

EnforceInvariants

Amendment ID Status
DC9CA96AEA1DCF83E527D1AFC916EFAF5D27388ECA4060A88817C1238CAEE0BF Enabled

Adds sanity checks to transaction processing to ensure that certain conditions are always met. This provides an extra, independent layer of protection against bugs in transaction processing that could otherwise cause exploits and vulnerabilities in the XRP Ledger. Ripple expects to add more invariant checks in future versions of rippled without additional amendments.

Introduces two new transaction error codes, tecINVARIANT_FAILED and tefINVARIANT_FAILED. Changes transaction processing to add the new checks.

Examples of invariant checks:

Escrow

Amendment ID Status
07D43DCE529B15A10827E5E04943B496762F9A88E3268269D69C44BE49E21104 Enabled

Replaces the SusPay and CryptoConditions amendments.

Provides "suspended payments" for XRP for escrow within the XRP Ledger, including support for Interledger Protocol Crypto-Conditions. Creates a new ledger object type for suspended payments and new transaction types to create, execute, and cancel suspended payments.

FeeEscalation

Amendment ID Status
42426C4D4F1009EE67080A9B7965B44656D7714D104A72F9B4369F97ABF044EE Enabled

Changes the way the transaction cost applies to proposed transactions. Modifies the consensus process to prioritize transactions that pay a higher transaction cost.

This amendment introduces a fixed-size transaction queue for transactions that were not able to be included in the previous consensus round. If the rippled servers in the consensus network are under heavy load, they queue the transactions with the lowest transaction cost for later ledgers. Each consensus round prioritizes transactions from the queue with the largest transaction cost (Fee value), and includes as many transactions as the consensus network can process. If the transaction queue is full, transactions drop from the queue entirely, starting with the ones that have the lowest transaction cost.

While the consensus network is under heavy load, legitimate users can pay a higher transaction cost to make sure their transactions get processed. The situation persists until the entire backlog of cheap transactions is processed or discarded.

A transaction remains in the queue until one of the following happens:

  • It gets applied to a validated ledger (regardless of success or failure)
  • It becomes invalid (for example, the LastLedgerSequence causes it to expire)
  • It gets dropped because there are too many transactions in the queue with a higher transaction cost.

fix1201

Amendment ID Status
B4D44CC3111ADD964E846FC57760C8B50FFCD5A82C86A72756F6B058DDDF96AD Enabled

Correctly implements a limit on transfer fees to a 100% fee, represented by a maximum TransferRate value of 2000000000. (A 100% fee in this case means you must send 2 units of the issued currency for every 1 unit you want to deliver.) Without the amendment, the effective limit is a TransferRate value of 232-1, for approximately a 329% fee.

With this amendment enabled, an AccountSet transaction that attempts to set TransferRate higher than 2000000000 fails with the result code temBAD_TRANSFER_RATE. Any existing TransferRate which was set to a higher value under the previous rules continues to apply at the higher rate.

fix1368

Amendment ID Status
E2E6F2866106419B88C50045ACE96368558C345566AC8F2BDF5A5B5587F0E6FA Enabled

Fixes a minor bug in transaction processing that causes some payments to fail when they should be valid. Specifically, during payment processing, some payment steps that are expected to produce a certain amount of currency may produce a microscopically different amount, due to a loss of precision related to floating-point number representation. When this occurs, those payments fail because they cannot deliver the exact amount intended. The fix1368 amendment corrects transaction processing so payments can no longer fail in this manner.

fix1373

Amendment ID Status
42EEA5E28A97824821D4EF97081FE36A54E9593C6E4F20CBAE098C69D2E072DC Enabled

Fixes a minor bug in transaction processing that causes failures when trying to prepare certain payment paths for processing. As a result, payments could not use certain paths that should have been valid but were invalidly prepared. Without this amendment, those payments are forced to use less-preferable paths or may even fail.

The fix1373 amendment corrects the issue so that the paths are properly prepared and payments can use them. It also disables some inappropriate paths that are currently allowed, including paths whose steps include conflicting fields and paths that loop through the same object more than once.

fix1512

Amendment ID Status
6C92211186613F9647A89DFFBAB8F94C99D4C7E956D495270789128569177DA1 Enabled

Fixes a bug in transaction processing that causes some invalid PaymentChannelClaim transactions to fail with the wrong error code. Without this amendment, the transactions have a tec-class result code despite not being included in a ledger and therefore not paying the transaction cost.

With this amendment, the transactions fail with a more appropriate result code, temBAD_AMOUNT, instead.

fix1523

Amendment ID Status
B9E739B8296B4A1BB29BE990B17D66E21B62A300A909F25AC55C22D6C72E1F9D Enabled

Adds tracking by destination account to escrows. Without this amendment, pending escrows are only tracked by sender. This amendment makes it possible to look up pending escrows by the destination address using the account_objects command, excluding any pending escrows that were created before this amendment became enabled. This amendment also makes EscrowCreate transactions appear in the destination's transaction history, as viewed with the account_tx command.

With this amendment, new escrows are added to the owner directories of both the sender and receiver. This amendment also adds a new DestinationNode field to Escrow ledger objects, indicating which page of the destination's owner directory contains the escrow.

fix1528

Amendment ID Status
1D3463A5891F9E589C5AE839FFAC4A917CE96197098A1EF22304E1BC5B98A454 Enabled

Fixes a bug where validators could build consensus ledgers with different timestamps, potentially delaying the process of declaring validated ledgers. The circumstances for this to occur require precise timing, so validators are unlikely to encounter this bug outside of controlled test conditions.

This amendment changes how validators negotiate the close time of the consensus ledger so that they cannot reach a consensus on ledger contents but build ledger versions with different timestamps.

Flow

Amendment ID Status
740352F2412A9909880C23A559FCECEDA3BE2126FED62FC7660D628A06927F11 Enabled

Replaces the payment processing engine with a more robust and efficient rewrite called the Flow engine. The new version of the payment processing engine is intended to follow the same rules as the old one, but occasionally produces different results due to floating point rounding. This Amendment supersedes the FlowV2 amendment.

The Flow Engine also makes it easier to improve and expand the payment engine with further Amendments.

FlowCross

Amendment ID Status
3012E8230864E95A58C60FD61430D7E1B4D3353195F2981DC12B0C7C0950FFAC Released but not enabled

Streamlines the offer crossing logic in the XRP Ledger's decentralized exchange. Uses the updated code from the Flow amendment to power offer crossing, so OfferCreate transactions and Payment transactions share more code. This has subtle differences in how offers are processed:

  • Rounding is slightly different in some cases.
  • Due to differences in rounding, some combinations of offers may be ranked higher or lower than by the old logic, and taken preferentially.
  • The new logic may delete more or fewer offers than the old logic. (This includes cases caused by differences in rounding and offers that were incorrectly removed as unfunded by the old logic.)

FlowV2

Amendment ID Status
5CC22CFF2864B020BD79E0E1F048F63EF3594F95E650E43B3F837EF1DF5F4B26 Withdrawn

This is a previous version of the Flow amendment. It was rejected due to a bug and removed in version 0.33.0.

MultiSign

Amendment ID Status
4C97EBA926031A7CF7D7B36FDE3ED66DDA5421192D63DE53FFB46E43B9DC8373 Enabled

Introduces multi-signing as a way to authorize transactions. Creates the SignerList ledger object type and the SignerListSet transaction type. Adds the optional Signers field to all transaction types. Modifies some transaction result codes.

This amendment allows addresses to have a list of signers who can authorize transactions from that address in a multi-signature. The list has a quorum and 1 to 8 weighted signers. This allows various configurations, such as "any 3-of-5" or "signature from A plus any other two signatures."

Signers can be funded or unfunded addresses. Funded addresses in a signer list can sign using a regular key (if defined) or master key (unless disabled). Unfunded addresses can sign with a master key. Multi-signed transactions have the same permissions as transactions signed with a regular key.

An address with a SignerList can disable the master key even if a regular key is not defined. An address with a SignerList can also remove a regular key even if the master key is disabled. The tecMASTER_DISABLED transaction result code is renamed tecNO_ALTERNATIVE_KEY. The tecNO_REGULAR_KEY transaction result is retired and replaced with tecNO_ALTERNATIVE_KEY. Additionally, this amendment adds the following new transaction result codes:

  • temBAD_SIGNER
  • temBAD_QUORUM
  • temBAD_WEIGHT
  • tefBAD_SIGNATURE
  • tefBAD_QUORUM
  • tefNOT_MULTI_SIGNING
  • tefBAD_AUTH_MASTER

OwnerPaysFee

Amendment ID Status
9178256A980A86CF3D70D0260A7DA6402AAFE43632FDBCB88037978404188871 In development

Fixes an inconsistency in the way transfer fees are calculated between OfferCreate and Payment transaction types. Without this amendment, the holder of the issuances pays the transfer fee if an offer is executed in offer placement, but the initial sender of a transaction pays the transfer fees for offers that are executed as part of payment processing. With this amendment, the holder of the issuances always pays the transfer fee, regardless of whether the offer is executed as part of a Payment or an OfferCreate transaction. Offer processing outside of payments is unaffected.

This Amendment requires the Flow Amendment to be enabled.

Note: An incomplete version of this amendment was introduced in v0.33.0 and removed in v0.80.0. (It was never enabled.) Ripple plans to re-add the amendment when the code is stable enough.

PayChan

Amendment ID Status
08DE7D96082187F6E6578530258C77FAABABE4C20474BDB82F04B021F1A68647 Enabled

Creates "Payment Channels" for XRP. Payment channels are a tool for facilitating repeated, unidirectional payments or temporary credit between two parties. Ripple expects this feature to be useful for the Interledger Protocol. One party creates a Payment Channel and sets aside some XRP in that channel for a predetermined expiration. Then, through off-ledger secure communications, the sender can send "Claim" messages to the receiver. The receiver can redeem the Claim messages before the expiration, or choose not to in case the payment is not needed. The receiver can verify Claims individually without actually distributing them to the network and waiting for the consensus process to redeem them, then redeem the batched content of many small Claims later, as long as it is within the expiration.

Creates three new transaction types:PaymentChannelCreate, PaymentChannelClaim, and PaymentChannelFund. Creates a new ledger object type, PayChannel. Defines an off-ledger data structure called a Claim, used in the ChannelClaim transaction. Creates new rippled API methods: channel_authorize (creates a signed Claim), channel_verify (verifies a signed Claim), and account_channels (lists Channels associated with an account).

For more information, see the Payment Channels Tutorial.

SortedDirectories

Amendment ID Status
CC5ABAE4F3EC92E94A59B1908C2BE82D2228B6485C00AFF8F22DF930D89C194E Enabled

Sorts the entries in DirectoryNode ledger objects and fixes a bug that occasionally caused pages of owner directories not to be deleted when they should have been.

Warning: Older versions of rippled that do not know about this amendment may crash when they encounter a DirectoryNode sorted by the new rules. To avoid this problem, upgrade to rippled version 0.80.0 or later.

SHAMapV2

Amendment ID Status
C6970A8B603D8778783B61C0D445C23D1633CCFAEF0D43E7DBCD1521D34BD7C3 Released but not enabled

Changes the hash tree structure that rippled uses to represent a ledger. The new structure is more compact and efficient than the previous version. This affects how ledger hashes are calculated, but has no other user-facing consequences.

When this amendment is activated, the XRP Ledger will undergo a brief scheduled unavailability while the network calculates the changes to the hash tree structure.

SusPay

Amendment ID Status
DA1BD556B42D85EA9C84066D028D355B52416734D3283F85E216EA5DA6DB7E13 Enabled on TestNet; not intended for production.

This amendment is currently enabled on the Ripple Test Net. In production, Ripple expects to enable similar functionality with the Escrow amendment instead.

TrustSetAuth

Amendment ID Status
6781F8368C4771B83E8B821D88F580202BCB4228075297B19E4FDC5233F1EFDC Enabled

Allows pre-authorization of accounting relationships (zero-balance trust lines) when using Authorized Accounts.

With this amendment enabled, a TrustSet transaction with tfSetfAuth enabled can create a new RippleState ledger object even if it keeps all the other values of the RippleState node in their default state. The new RippleState node has the lsfLowAuth or lsfHighAuth flag enabled, depending on whether the sender of the transaction is considered the low node or the high node. The sender of the transaction must have already enabled lsfRequireAuth by sending an AccountSet transaction with the asfRequireAuth flag enabled.

TickSize

Amendment ID Status
532651B4FD58DF8922A49BA101AB3E996E5BFBF95A913B3E392504863E63B164 Enabled

Changes the way Offers are ranked in order books, so that currency issuers can configure how many significant digits are taken into account when ranking Offers by exchange rate. With this amendment, the exchange rates of Offers are rounded to the configured number of significant digits, so that more Offers have the same exact exchange rate. The intent of this change is to require a meaningful improvement in price to outrank a previous Offer. If used by major issuers, this should reduce the incentive to spam the ledger with Offers that are only a tiny fraction of a percentage point better than existing offers. It may also increase the efficiency of order book storage in the ledger, because Offers can be grouped into fewer exchange rates.

Introduces a TickSize field to accounts, which can be set with the AccountSet transaction type. If a currency issuer sets the TickSize field, the XRP Ledger truncates the exchange rate (ratio of funds in to funds out) of Offers to trade the issuer's currency, and adjusts the amounts of the Offer to match the truncated exchange rate. If only one currency in the trade has a TickSize set, that number of significant digits applies. When trading two currencies that have different TickSize values, whichever TickSize indicates the fewest significant digits applies. XRP does not have a TickSize.

Tickets

Amendment ID Status
C1B8D934087225F509BEB5A8EC24447854713EE447D277F69545ABFA0E0FD490 In development

Introduces Tickets as a way to reserve a transaction sequence number for later execution. Creates the Ticket ledger object type and the transaction types TicketCreate and TicketCancel.

Caution: This amendment is still in development.