XLS-85 Token Escrow: let a third-party EscrowFinish create the destination trustline (reserve funded from the escrow)

[LeDenti]

Context: dareskro pays wages through XRPL escrows. Today the payroll escrow is in XRP, date-only (FinishAfter, no Condition, no CancelAfter — app/src/xrpl.ts l.10-16), finished by an oracle at the hour. We want the same with a token (RLUSD, EURØP) through XLS-85 (#248).

What we measured (September 2026, private study, summarised in README l.112-118): when the destination has no trustline to the issuer, EscrowFinish submitted by a third party fails with tecNO_LINE. Only the destination itself can finish, and then the line is created. The same tecNO_LINE on a plain Payment is recalled in depot/demo_depot_garantie.mjs l.232.

Why it matters for payroll: the employee's receiving account is fresh for each pay period (privacy: the amount is public, the account must not be linkable). A new account has no trustline, so a third-party finish — the oracle, or anyone, which is the whole safety property of a date-only escrow — is refused. The employer would have to make the employee act before payday, which is exactly what the escrow was meant to avoid.

Proposal, for discussion:

1. Let EscrowFinish by any account create the destination's trustline when it does not exist, with the owner reserve funded from the escrowed amount or from the finisher's fee (the spec could require the destination to have pre-authorised the issuer, or accept the line implicitly as the escrow's Destination).
2. Or: reserve the trustline at EscrowCreate time (the creator pays the increment), so the destination owns a line before the funds are released.

Either keeps the invariant that the destination never has to be online. Happy to provide the transaction set from the testnet study on request.

[mvadari]

This goes against the primary intent of trustlines and of reserves: the user must actively consent to receiving that token (by creating the trustline). Allowing someone else to create trustlines on your behalf, even if they are willing to pay the reserve, can be weaponized in all sorts of ways, such as forcing a regulated entity to hold a noncompliant token.

In this case, you can verify that the employee has the right trustlines set up when registering their account, instead of waiting til escrow time to do so. This already has its Web2 analogs: you need to set up your bank account properly and register it with your employer.

[LeDenti]

Thanks for the clear pushback on consent. Agreed: a third party must not create trustlines on someone else's behalf.

Our constraint is privacy: each pay period uses a fresh destination account so public escrow amounts are not linkable across months. Registration can therefore require the employee to create the token trustline on that new account before payday (RLUSD or EURØP once their issuers enable AllowTrustLineLocking; a test issuer for now). That keeps active consent, and the oracle can still EscrowFinish later without the employee being online.

For reference, measured today on testnet (5 Nov 2026) with a test issuer that has AllowTrustLineLocking set (rwcFTR67npu19pwgtDKyxYzZZJxGAj6WDt), time-based escrows (FinishAfter only, no Condition), 100 USD each:

• third party finishes, destination has no trustline → tecNO_LINE
  https://testnet.xrpl.org/transactions/6E7D259C505DD2DDCAA3334D59B26BB3670707F5EA23FA43476A1DCA806B41BD
• destination finishes itself, no trustline → tesSUCCESS, line auto-created
  https://testnet.xrpl.org/transactions/9B691C6905382B983F4333F476D60F5B967571F74F52C441762560377246D653
• third party finishes, trustline opened beforehand → tesSUCCESS
  https://testnet.xrpl.org/transactions/22C0C39015194A992A1814C513F3DEB4ECD61044C2F222F7079B64217C8861AB

So the line is only auto-created when the destination signs, which is exactly your consent point.

What would still help payroll integrators is documenting that pattern (register → trustline → escrow → third-party finish) in the XLS-85 guidance, and stating the tecNO_LINE case explicitly. The full set (issuer setup, escrow creates, finishes) is in a small JSON I can attach if useful.