Fiat / issuer reservesRank #8
RLUSDRipple USD
Standard Custody & Trust Company, LLC (Ripple subsidiary)
- Market cap
- $1.5B
- Circulating supply
- 1.5B
- Networks
- 2
EIP/ERC standards & compliance
Full RLUSD profile: ERC-20, permit, proxy patterns, cross-chain, flash loans, and compliance EIPs — with implementation notes and verified contract context.
Overview
Ripple's USD-backed stablecoin, approved by NYDFS and DFSA (Dubai). Launched December 2024, natively issued on Ethereum and XRP Ledger. Purpose-built for cross-border payments with six-role access control (admin, minter, burner, pauser, clawbacker, upgrader), account-level freeze, clawback (seize), and UUPS upgradeability. V2 upgrade (September 2025) added EIP-2612 gasless permit.
Supply by chain
Market cap
$1.5B
Circulating supply
1.5B
Supply chains
2
| Chain | Supply | Market cap | Share |
|---|---|---|---|
| Ethereum | 1.2B | $1.2B | 74.9% |
| XRPL | 386.2M | $386M | 25.1% |
| Current circulating supply by chain from DeFiLlama. Small supply footprints are grouped after the top 12 chains and may include bridged or non-curated deployments. | |||
Features
Engineering-oriented breakdown of capabilities: standards, who they matter for, integration rationale, per-feature risks, and vetted external references (specs, docs, verified source).
Protocol repo: github.com/ripple/RLUSD-ImplementationPrimary Ethereum verified source: Etherscan
| Feature | Standards | Audience | Why it matters | Risk / caveat | References |
|---|---|---|---|---|---|
EIP-2612 permit() authorization | User | Gasless approval via signed message — added in the V2 upgrade (September 2025). Compliance-gated: reverts if owner, spender, or msg.sender is frozen, or if the contract is globally paused. | Permit reverts silently for frozen parties — callers relying on bool returns will misinterpret failure. No EIP-1271 support, so smart-contract wallets need Permit2 or an EOA signer. | ||
Account freeze compliance | — | Corporate | PAUSER_ROLE can freeze individual addresses via `pauseAccounts(address[])`. Frozen accounts cannot send, receive, or approve — integrations must surface failures to users. | Custom AccountPausableUpgradeable with ERC-7201 namespaced storage. Freeze risk applies to every flow including permit and burn-for-redemption. | |
Clawback (seize) compliance | — | Corporate | CLAWBACKER_ROLE can burn tokens from any address — including frozen accounts — via `clawback(address, uint256)`. More powerful than USDC's freeze-only: tokens are permanently destroyed rather than held pending unfreeze. | Irreversible supply reduction from an arbitrary address. Custody products must disclose this to end users; DeFi integrations must assume supply can be removed at any time. | |
Global pause compliance | — | Corporate | PAUSER_ROLE can halt all transfers, mints, burns, approvals, and permits contract-wide via `pause()` / `unpause()` — useful during incidents, but every dependent protocol stalls. | A single role can brick the token globally; design for sudden total illiquidity and avoid time-sensitive unwinds that assume transfers work. | — |
UUPS upgradeable compliance | Corporate | UPGRADER_ROLE can upgrade implementation via `upgradeToAndCall()`. Already exercised: V1 → V2 upgrade (September 2025) added EIP-2612 permit support — monitor implementation slot and diff bytecode on upgrades. | UUPS without a public `upgradeTo()` becomes permanently non-upgradeable if an implementation without it is deployed — standard UUPS footgun. Governance/admin compromise can alter token logic. | ||
Six-role access control compliance |
| Corporate | DEFAULT_ADMIN, MINTER, BURNER, PAUSER, CLAWBACKER, UPGRADER are separated so capabilities can be distributed. BURNER is self-burn for redemption; CLAWBACKER can seize from any address — distinct responsibilities worth monitoring independently. | Six roles mean six admin attack surfaces; compromise of CLAWBACKER or UPGRADER is catastrophic. Verify role holders on-chain rather than trusting disclosure. |
EIP / ERC support matrix
Standards & compliance support for RLUSD. Click an EIP to jump to the global deep-dive section.
| Standard | Status | Notes |
|---|---|---|
| Core | ||
| ERC-20 Fungible token standard | Implemented | Standard ERC-20 interface works with all EVM wallets, DEXes, and DeFi protocols. The 18-decimal precision is critically different from most USD stablecoins (USDC/USDT/PYUSD all use 6 decimals) — integrators must account for this. |
| Signatures & typed data | ||
| EIP-712 Typed structured data signing | Implemented | Prerequisite for EIP-2612 permit. Signatures are bound to the proxy address and chain ID. Use the proxy address (0x8292Bb45...) as verifyingContract for off-chain verification. |
| EIP-2612 Permit — gasless ERC-20 approval | Implemented | Enables gasless approval for DeFi flows. Compliance checks on permit() mean frozen accounts cannot have approvals changed even via gasless signatures. Smart contract wallets cannot sign permits (no EIP-1271). |
| EIP-3009 transferWithAuthorization | Not implemented | No single-call gasless transfers. Must use permit() + transferFrom() as two separate calls. No random-nonce concurrent authorization support — permits use sequential nonces only. |
| EIP-1271 Signature validation for smart contracts | Not implemented | Smart contract wallets cannot sign RLUSD permit messages — limits gasless flows to EOAs. Institutional custody using multisigs must use on-chain approve() or Permit2. |
| Upgradeability & proxies | ||
| EIP-1967 Standard proxy storage slots | Implemented | Standard EIP-1967 slots mean block explorers and monitoring tools auto-detect the proxy. Always interact with the proxy address, never the implementation. |
| EIP-1822 UUPS — universal upgradeable proxy | Implemented | UUPS is cheaper to deploy than Transparent Proxy (no separate ProxyAdmin). Upgrade authority is a dedicated UPGRADER_ROLE key. Ripple has already used this path once to add features without token migration. |
| Vaults & yield | ||
| ERC-4626 Tokenized yield vault standard | Not implemented | No native yield mechanism. External ERC-4626 vaults must be created by DeFi protocols for yield-bearing RLUSD products. |
| Compliance | ||
| Freeze Address freezing / blacklisting | Implemented | Account freezing blocks ALL value movement including incoming transfers. Check accountPaused() before building payment pipelines. Uses 'pause/accountPaused()' terminology (not 'blacklist/isBlacklisted' like USDC). |
| Seize Fund seizure / clawback | Implemented | totalSupply() can decrease from clawback events. Protocols tracking RLUSD supply should monitor Transfer(from, address(0)) where from != msg.sender. Clawback represents counterparty risk — frozen collateral in lending protocols can be destroyed, causing bad debt. |
| Pause Global transfer pause | Implemented | Global pause freezes ALL RLUSD operations: transfers, DeFi swaps, lending, liquidations. approve() and permit() also revert — protocols cannot even prepare approvals during pause. |
| Cross-chain | ||
| ERC-7802 Crosschain token interface | Not implemented | No permissionless cross-chain transfer capability. Third-party bridges cannot mint canonical RLUSD. Limits composability vs USDC (CCTP) or USDT (OFT). |
| Flash Loans | ||
| ERC-3156 Flash loans | Not implemented | Cannot use RLUSD for single-transaction borrow-use-repay patterns natively. Must rely on external providers. |
| Data sourced from verified Etherscan contract source code. Implementations may differ across networks — always verify on the specific chain you integrate with. | ||
Technical notes
- 18 decimals (unlike USDC/USDT/PYUSD which use 6 — critical integration difference).
- UUPS proxy (EIP-1822) with ERC-1967 storage slots.
- StablecoinProxy (Solidity 0.8.26, OZ v5) wraps StablecoinUpgradeableV2 (Solidity 0.8.29, OZ v5.3.0).
- V2 adds ERC20PermitUpgradeable.
- Custom AccountPausableUpgradeable uses ERC-7201 namespaced storage.
- V2's _update() override allows clawback from frozen accounts while blocking normal transfers.
- No EIP-3009, no EIP-1271, no flash loans.
- Role hashes: MINTER=keccak256('MINTER'), BURNER=keccak256('BURNER'), PAUSER=keccak256('PAUSER'), CLAWBACKER=keccak256('CLAWBACKER'), UPGRADER=keccak256('UPGRADER').
- Security contact: security@ripple.com.
Reserves & peg
- Reserves
- 100% backed by USD deposits, U.S. Treasury Bills, and cash equivalents held in segregated accounts. Primary custody by BNY Mellon (since July 2025). Monthly third-party attestations.
- Collateral
- Fiat and equivalents (off-chain)
- Peg mechanism
- Hard 1:1 via centralized issuer redemption
- Auditor
- Third-party monthly attestations (ripple.com/solutions/stablecoin/transparency/)
Ecosystem
- DeFi integration
- Early-stage — exchange listings (Binance, Bitso, LMAX), BlackRock BUIDL redemption mechanism, SBI Japan integration
- Yield
- None native
Risk factors
mediumCentralization (six-role admin)lowRegulatory exposuremediumClawback — tokens can be seized and destroyedmedium18-decimal integration risk vs 6-decimal norm
Technical references
Official docs
Ripple USD
ripple.com/solutions/stablecoin/
Compliance & legal
Issuer compliance docs
ripple.com/solutions/stablecoin/
Source code
GitHub repository
ripple/RLUSD-Implementation
Verified contract · Ethereum
StablecoinUpgradeableV2
0x8292…17eD· block 20,492,031
Block explorers
Networks & contracts
Deployments by chain — primary rows are highlighted. Always verify addresses against issuer docs before mainnet integrations.
| Network | Standard | Contract | Explorer |
|---|---|---|---|
EthereumPrimary | ERC-20 | 0x8292Bb45bf1Ee4d140127049757C2E0fF06317eDUUPS proxy (StablecoinUpgradeableV2), 18 decimals | View |
XRP LedgerPrimary | IOU (Issued Currency) | 524C555344000000000000000000000000000000.rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5DeRLUSD currency code + issuer (livenet.xrpl.org) | View |