Five Programmatic Safety Checks for XRPL Tokens

#crypto #javascript #security #tutorial

20,265 tokens are issued on the XRP Ledger. 1,424 traded in the last 24 hours. Anyone can issue one in seconds without permission, so the entire burden of screening sits with whoever is reading the data.

Here are five checks you can automate, in rough order of how much they save you.

1. Depth, not market cap

Market cap on a thin token is the last trade price times supply, and the last trade may have been for a handful of dollars. It is the most quoted number and the least useful.

The question that matters is: if you sold a position this size, where would it fill? Anything else is decoration.

2. Volume per unique trader

const { tokens } = await (await fetch(
  'https://api.xrpl.to/v1/tokens?limit=100&sortBy=vol24hxrp&sortType=desc'
)).json();

const suspicious = tokens.filter(t => {
  const perTrader = t.vol24hxrp / Math.max(t.uniqueTraders24h, 1);
  return t.vol24hxrp > 10000 && perTrader > 50000;
});

High volume divided by very few distinct traders is what wash trading looks like from the outside. This single ratio removes most of the noise.

3. Holders against trustlines

const stickiness = t.holders / Math.max(t.trustlines, 1);

Because XRPL trustlines cost the holder a locked reserve, holder counts are meaningfully harder to inflate than wallet counts elsewhere. A very low stickiness ratio means most accounts that ever opened a line have since emptied it.

4. Issuer flags — the one not in the API

This check needs a rippled call rather than the token endpoint, and it is the one that prevents the worst outcomes:

const res = await fetch('https://xrplcluster.com/', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    method: 'account_info',
    params: [{ account: ISSUER_ADDRESS, ledger_index: 'validated' }],
  }),
});
const { result } = await res.json();
const flags = result.account_data.Flags;

Two things to read out of that:

Blackholed — the issuing account's master key is disabled and its regular key removed, so no further supply can ever be minted
Freeze authority — whether the issuer can freeze individual balances, or globally freeze the token

Neither is automatically disqualifying. Regulated stablecoin issuers legitimately need freeze powers. But you should know which situation you are in before you hold the token.

5. Concentration

Check how much of the float sits in the top handful of accounts. A token where a few wallets hold most of the supply is one decision away from a much lower price, and concentration quietly distorts every other metric you might compute.

What none of this does

It does not predict a price. A token can pass all five checks and still go to zero, and plenty that fail them went up first.

What it removes is the category of loss that was knowable in advance: the exit that was impossible because there were no bids, the supply that expanded because the issuer was never blackholed, the volume that was three accounts trading with themselves.

Those are the ones worth refusing to take.

Live prices, holder counts, trustlines and order-book depth for every XRPL token are at xrpl.to.

DEV Community