Token tools on testnet

Issuer setup, issue, freeze, clawback and AMM create on the XRPL test network. Built and independently reviewed; not yet run on any network.

XRP Ledger test network only. Testnet tokens have no value. Mainnet is not built.

Status

Testnet only. The commands are built, byte-checked against the reference XRPL libraries and reviewed by two independent reviewers. None of them has been run on any network: each testnet transaction needs its own approval first.

Commands

fth-xrpl issuer-setup <wallet> [--allow-clawback] [--yes]
fth-xrpl issue <wallet> to=<address> currency=<code> value=<amount> [--yes]
fth-xrpl freeze <wallet> holder=<address> currency=<code> [--off] [--yes]
fth-xrpl global-freeze <wallet> [--off] [--yes]
fth-xrpl clawback <wallet> holder=<address> currency=<code> value=<amount> [--yes]
fth-xrpl amm-create <wallet> xrp=<amount> currency=<code> issuer=<address> value=<amount> fee=<0-1000> [--yes]

What each sends

Command	Transaction
`issuer-setup`	`AccountSet`: DefaultRipple on; with `--allow-clawback`, clawback enabled
`issue`	`Payment` of an issued token
`freeze`	`TrustSet` that freezes, or with `--off` unfreezes, one holder's trust line
`global-freeze`	`AccountSet` global freeze, or with `--off` its removal
`clawback`	`Clawback` of an issued token from one holder
`amm-create`	`AMMCreate` with XRP and one issued token, trading fee 0 to 1000

The one rule

Without --yes, a command prints the exact transaction and exits 2; nothing is signed or sent. With --yes, it signs locally and submits. The client refuses any server whose network id is not 1.

What one-click means here

One command after the dry run has been read. Nothing more.

Safety limits

amm-create pays the ledger's owner reserve increment as its fee, read from the server when it sends. The fee is refused above 2 XRP (2,000,000 drops), and the dry run states that cap.
Only three account flags can be set: DefaultRipple, global freeze and clawback. Flags that cannot be undone, such as giving up the ability to freeze, are refused.
No transaction can carry an invalid currency code, such as "XRP" or an all-zero code, and an AMM pool cannot use a liquidity-provider token as an asset.
Clawback can only be turned on while the issuer has no trust lines, and cannot be turned off afterwards.

Acceptance tests

Each transaction type serialises byte for byte equal to the reference ripple-binary-codec output for a recorded vector, and its signature verifies.
An issued Payment with an XRP amount where that is invalid is refused.
A freeze without an issued currency is refused.
An AMMCreate with XRP on both sides is refused; a trading fee above 1000 is refused.
Every token command exits 2 without --yes and makes no submit call.
Two independent reviews (codec, and command safety) found no Critical defects; every finding is fixed. One reviewer checked 11 more transactions against the reference library, all byte-exact; the other proved the dry runs make no network call by cutting the network off.

Not built, not available

Mainnet issuance, real freezes and real AMM pools. Any of them would need founder sign-off, with each step approved and run by the owner.

Stablecoins

USDT on TRON, USDC and RLUSD are possible quote assets the engine could be pointed at. On the XRP Ledger the issuer is chosen by address. The engine does not support, hold or move any of them today, and has no TRON connection.

Mint page

The FTH GOLD mint page is a separate system and is not part of this engine.