RLUSDFiat-backedRank #8
Ripple USD
Standard Custody & Trust Company, LLC (Ripple subsidiary)
Market cap: $1.4B
Overview
Ripple's USD-backed stablecoin, approved by NYDFS and DFSA (Dubai). Launched December 2024, natively issued on Ethereum and XRP Ledger. Purpose-built for cross-border payments with six-role access control (admin, minter, burner, pauser, clawbacker, upgrader), account-level freeze, clawback (seize), and UUPS upgradeability. V2 upgrade (September 2025) added EIP-2612 gasless permit.
Features
Engineering-oriented breakdown of capabilities: standards, who they matter for, integration rationale, per-feature risks, and vetted external references (specs, docs, verified source).
Protocol repo: github.com/ripple/RLUSD-ImplementationPrimary Ethereum verified source: Etherscan
| Feature | Standards | Audience | Why it matters | Risk / caveat | References |
|---|---|---|---|---|---|
EIP-2612 permit() authorization | User | Gasless approval via signed message. Added in V2 upgrade (September 2025). Compliance-gated — reverts if owner, spender, or msg.sender is frozen, or if contract is globally paused. | Signing/permit bugs or bad UX can strand users or leak allowances. | — | |
Account freeze compliance | — | Corporate | PAUSER_ROLE can freeze individual addresses via pauseAccounts(address[]). Frozen accounts cannot send, receive, or approve. Custom AccountPausableUpgradeable with ERC-7201 namespaced storage. | Issuer/admin controls; integrations must handle freezes, pauses, and revert paths. | — |
Clawback (seize) compliance | — | Corporate | CLAWBACKER_ROLE can burn tokens from any address including frozen accounts via clawback(address, uint256). More powerful than USDC's freeze-only — tokens are permanently destroyed. | Issuer/admin controls; integrations must handle freezes, pauses, and revert paths. | — |
Global pause compliance | — | Corporate | PAUSER_ROLE can halt ALL transfers, mints, burns, approvals, and permits contract-wide via pause()/unpause(). | Issuer/admin controls; integrations must handle freezes, pauses, and revert paths. | — |
UUPS upgradeable compliance | — | Corporate | UPGRADER_ROLE can upgrade implementation via upgradeToAndCall(). Already upgraded V1 → V2 (September 2025) to add EIP-2612 permit support. | Issuer/admin controls; integrations must handle freezes, pauses, and revert paths. | — |
Six-role access control compliance | — | Corporate | OpenZeppelin AccessControl with DEFAULT_ADMIN, MINTER, BURNER, PAUSER, CLAWBACKER, UPGRADER roles. BURNER (self-burn for redemption) and CLAWBACKER (seize from any address) are separate capabilities. | Issuer/admin controls; integrations must handle freezes, pauses, and revert paths. | — |
EIP / ERC support matrix
Standards & compliance support for RLUSD. Click an EIP to jump to the global deep-dive section.
| Standard | Status | Notes |
|---|---|---|
| Core | ||
| ERC-20 Fungible token standard | Implemented | Standard ERC-20 interface works with all EVM wallets, DEXes, and DeFi protocols. The 18-decimal precision is critically different from most USD stablecoins (USDC/USDT/PYUSD all use 6 decimals) — integrators must account for this. |
| Signatures & typed data | ||
| EIP-712 Typed structured data signing | Implemented | Prerequisite for EIP-2612 permit. Signatures are bound to the proxy address and chain ID. Use the proxy address (0x8292Bb45...) as verifyingContract for off-chain verification. |
| EIP-2612 Permit — gasless ERC-20 approval | Implemented | Enables gasless approval for DeFi flows. Compliance checks on permit() mean frozen accounts cannot have approvals changed even via gasless signatures. Smart contract wallets cannot sign permits (no EIP-1271). |
| EIP-3009 transferWithAuthorization | Not implemented | No single-call gasless transfers. Must use permit() + transferFrom() as two separate calls. No random-nonce concurrent authorization support — permits use sequential nonces only. |
| EIP-1271 Signature validation for smart contracts | Not implemented | Smart contract wallets cannot sign RLUSD permit messages — limits gasless flows to EOAs. Institutional custody using multisigs must use on-chain approve() or Permit2. |
| Upgradeability & proxies | ||
| EIP-1967 Standard proxy storage slots | Implemented | Standard EIP-1967 slots mean block explorers and monitoring tools auto-detect the proxy. Always interact with the proxy address, never the implementation. |
| EIP-1822 UUPS — universal upgradeable proxy | Implemented | UUPS is cheaper to deploy than Transparent Proxy (no separate ProxyAdmin). Upgrade authority is a dedicated UPGRADER_ROLE key. Ripple has already used this path once to add features without token migration. |
| Vaults & yield | ||
| ERC-4626 Tokenized yield vault standard | Not implemented | No native yield mechanism. External ERC-4626 vaults must be created by DeFi protocols for yield-bearing RLUSD products. |
| Compliance | ||
| Freeze Address freezing / blacklisting | Implemented | Account freezing blocks ALL value movement including incoming transfers. Check accountPaused() before building payment pipelines. Uses 'pause/accountPaused()' terminology (not 'blacklist/isBlacklisted' like USDC). |
| Seize Fund seizure / clawback | Implemented | totalSupply() can decrease from clawback events. Protocols tracking RLUSD supply should monitor Transfer(from, address(0)) where from != msg.sender. Clawback represents counterparty risk — frozen collateral in lending protocols can be destroyed, causing bad debt. |
| Pause Global transfer pause | Implemented | Global pause freezes ALL RLUSD operations: transfers, DeFi swaps, lending, liquidations. approve() and permit() also revert — protocols cannot even prepare approvals during pause. |
| Cross-chain | ||
| ERC-7802 Crosschain token interface | Not implemented | No permissionless cross-chain transfer capability. Third-party bridges cannot mint canonical RLUSD. Limits composability vs USDC (CCTP) or USDT (OFT). |
| Flash Loans | ||
| ERC-3156 Flash loans | Not implemented | Cannot use RLUSD for single-transaction borrow-use-repay patterns natively. Must rely on external providers. |
| Data sourced from verified Etherscan contract source code. Implementations may differ across networks — always verify on the specific chain you integrate with. | ||
Technical notes
- 18 decimals (unlike USDC/USDT/PYUSD which use 6 — critical integration difference).
- UUPS proxy (EIP-1822) with ERC-1967 storage slots.
- StablecoinProxy (Solidity 0.8.26, OZ v5) wraps StablecoinUpgradeableV2 (Solidity 0.8.29, OZ v5.3.0).
- V2 adds ERC20PermitUpgradeable.
- Custom AccountPausableUpgradeable uses ERC-7201 namespaced storage.
- V2's _update() override allows clawback from frozen accounts while blocking normal transfers.
- No EIP-3009, no EIP-1271, no flash loans.
- Role hashes: MINTER=keccak256('MINTER'), BURNER=keccak256('BURNER'), PAUSER=keccak256('PAUSER'), CLAWBACKER=keccak256('CLAWBACKER'), UPGRADER=keccak256('UPGRADER').
- Security contact: security@ripple.com.
Reserves & peg
- Reserves
- 100% backed by USD deposits, U.S. Treasury Bills, and cash equivalents held in segregated accounts. Primary custody by BNY Mellon (since July 2025). Monthly third-party attestations.
- Collateral
- Fiat and equivalents (off-chain)
- Peg mechanism
- Hard 1:1 via centralized issuer redemption
- Auditor
- Third-party monthly attestations (ripple.com/solutions/stablecoin/transparency/)
Ecosystem
- DeFi integration
- Early-stage — exchange listings (Binance, Bitso, LMAX), BlackRock BUIDL redemption mechanism, SBI Japan integration
- Yield
- None native
Risk factors
mediumCentralization (six-role admin)lowRegulatory exposuremediumClawback — tokens can be seized and destroyedmedium18-decimal integration risk vs 6-decimal norm
Networks & contracts
Deployments by chain — primary rows are highlighted. Always verify addresses against issuer docs before mainnet integrations.
| Network | Standard | Contract | Explorer |
|---|---|---|---|
EthereumPrimary | ERC-20 | 0x8292Bb45bf1Ee4d140127049757C2E0fF06317eDUUPS proxy (StablecoinUpgradeableV2), 18 decimals | View |
XRP LedgerPrimary | IOU (Issued Currency) | 524C555344000000000000000000000000000000.rMxWzuz9LHEFhJgjAB1mfPNHBCnrHTmDjgRLUSD currency code + issuer (livenet.xrpl.org) | View |