XRPL Escrow Guide Crypto-Conditional Security

XRPL escrow is a native feature of the XRP Ledger that locks XRP in a trustless holding pattern until specific conditions are met. Unlike smart contract platforms where escrow requires deploying custom code, XRPL escrow is a first-class transaction type built directly into the ledger protocol.

When an escrow is created, XRP leaves the sender's account and enters a ledger object that no one controls — not the sender, not the recipient, and not any third party. The funds can only move when the conditions encoded in the escrow object are satisfied, as verified by the consensus protocol itself.

This makes XRPL escrow fundamentally different from traditional escrow services. There is no company holding the funds, no human making release decisions, and no possibility of unauthorized access. The escrow is enforced by mathematics and distributed consensus across 150+ independent validators worldwide.

XRPL escrow operates through three transaction types, each serving a distinct role in the escrow lifecycle:

EscrowCreate — The sender submits this transaction to lock XRP into an escrow object on the ledger. The transaction specifies the recipient address, the amount of XRP to lock, and one or both release conditions: a FinishAfter time (the earliest the escrow can be released) and/or a Condition (a cryptographic hash that must be fulfilled). An optional CancelAfter time sets a deadline after which the sender can reclaim the funds if the escrow was never completed.

EscrowFinish — The recipient (or any account) submits this transaction to release the escrowed funds. If the escrow has a FinishAfter time, this transaction can only succeed after that time has passed. If the escrow has a crypto-condition, the transaction must include the matching Fulfillment preimage. Both conditions must be satisfied for the release to succeed.

EscrowCancel — If the escrow has a CancelAfter time and that deadline has passed without the escrow being finished, anyone can submit this transaction to return the XRP to the original sender. This is the safety mechanism that prevents funds from being locked indefinitely.

The entire lifecycle — creation, release, and cancellation — is executed on-ledger in 3-5 seconds per transaction, with a network fee of approximately $0.0002. No off-chain computation, no oracle feeds, and no external dependencies.

XRPL escrow supports two distinct types of release conditions, which can be used independently or combined for maximum security.

Time-based escrow

Uses the FinishAfter and CancelAfter fields to create a time window. The escrow cannot be released before FinishAfter and cannot be canceled before CancelAfter. This is useful for scheduled payments, vesting schedules, and any scenario where the release timing is known in advance.

Time values are specified in Ripple Epoch seconds (seconds since January 1, 2000 00:00 UTC), which is 946684800 seconds before Unix epoch.

Condition-based escrow (crypto-conditions)

Uses the Condition field to require a cryptographic proof for release. The condition is a SHA-256 hash, and the fulfillment is the preimage that produces that hash. Only someone who knows the preimage can release the escrow.

XRPL implements the Crypto-Conditions specification (RFC draft), specifically the PREIMAGE-SHA-256 type. The condition is included in the EscrowCreate transaction, and the matching fulfillment must be provided in the EscrowFinish transaction.

Combined conditions

The most secure escrow uses both time and crypto-conditions together. For example, marketplace escrows typically set a CancelAfter deadline (e.g., 45 days), a FinishAfter time (to give shipping time), and a crypto-condition (so only the authorized party can trigger release). All conditions must be satisfied simultaneously for the EscrowFinish to succeed.

Every escrow transaction follows a predictable structure. Here is a simplified view of an EscrowCreate transaction:

{
  "TransactionType": "EscrowCreate",
  "Account": "rSenderAddress...",
  "Destination": "rRecipientAddress...",
  "Amount": "10000000",
  "FinishAfter": 835015200,
  "CancelAfter": 838908000,
  "Condition": "A0258020...",
  "DestinationTag": 12345
}

Key fields explained:

• Amount — XRP in drops (1 XRP = 1,000,000 drops). 10000000 drops = 10 XRP.
• FinishAfter — Ripple Epoch timestamp. The earliest the escrow can be released.
• CancelAfter — Ripple Epoch timestamp. After this time, the escrow can be canceled and funds returned to sender.
• Condition — Hex-encoded PREIMAGE-SHA-256 crypto-condition. The EscrowFinish must provide the matching fulfillment.
• DestinationTag — Optional tag to identify the purpose or associate with an off-ledger record.

The corresponding EscrowFinish transaction references the original escrow by the sender's account and the sequence number of the EscrowCreate:

{
  "TransactionType": "EscrowFinish",
  "Account": "rRecipientAddress...",
  "Owner": "rSenderAddress...",
  "OfferSequence": 42,
  "Condition": "A0258020...",
  "Fulfillment": "A0228020..."
}

The ledger validates that the Fulfillment produces the Condition hash and that the FinishAfter time has passed. If both checks succeed, the XRP transfers to the Destination in the same ledger close — typically under 4 seconds.

XRPL escrow is versatile far beyond marketplace transactions. Here are the primary use cases enabled by the protocol:

Peer-to-peer marketplaces

The most immediate application. Buyers lock payment in escrow, sellers ship goods, and funds release upon delivery confirmation. The crypto-condition ensures only the authorized party can trigger release. This is how Meridian's escrow system works — with the addition of community dispute resolution and 12-hour auto-release for unresponsive buyers.

Cross-border payments

Time-based escrow enables trustless international transfers. A sender locks funds with a FinishAfter condition timed to when the recipient's bank processes the corresponding fiat payment. No correspondent banking fees, no 3-5 business day delays for the XRP side — settlement happens in seconds once conditions are met.

Payroll and vesting

Companies paying contractors or distributing token vesting schedules can use time-based escrows to lock funds with monthly or quarterly release dates. The employee is guaranteed payment — the employer cannot pull the funds back once the escrow is created.

Subscription and recurring payments

A series of time-based escrows can simulate a subscription model. The subscriber locks N months of payment upfront, each with a sequential FinishAfter date. The service provider can claim each payment as it becomes available, with the remaining escrows cancellable if the subscription ends.

Crowdfunding and milestones

Project fundraising can use condition-based escrow tied to milestone completion. Backers lock funds, and the project releases each tranche by providing the fulfillment (proof of milestone). If milestones aren't met before the CancelAfter date, backers reclaim their funds automatically.

Traditional escrow services like Escrow.com, PayPal, or bank escrow accounts serve a similar purpose but with fundamentally different trust models, costs, and speeds.

The key difference is the trust model. Traditional escrow requires trusting a company to hold and release funds honestly. XRPL escrow requires trusting only the mathematics of SHA-256 hashing and the distributed consensus of 150+ validators — a fundamentally stronger guarantee.

Sources: XRPL Escrow Documentation, XRPL Transaction Costs

Meridian applies XRPL escrow to real-world asset trading with additional layers built on top of the protocol:

• Crypto-conditional escrow — Every purchase creates an escrow with a PREIMAGE-SHA-256 condition. The fulfillment secret is stored server-side and released only after delivery confirmation.
• 45-day CancelAfter — Buyers can reclaim funds if the seller never ships. This is enforced by the ledger, not by Meridian.
• 12-hour auto-release — After delivery is confirmed, buyers have 12 hours to inspect and accept. If they take no action, the platform wallet releases escrow to the seller automatically.
• Community dispute resolution — If the buyer disputes before auto-release, a panel of community voters reviews evidence and votes. The outcome (refund or release) is executed on-chain.
• Atomic settlement — Escrow release, NFT transfer, and platform fee payment execute as three sequential on-chain transactions, each individually signed and verified.

For a complete walkthrough of Meridian's escrow flow, see the Escrow Protection page or the How It Works guide.