From 9c967f83be2f8dba9e3c69323f6679c8b8a7e743 Mon Sep 17 00:00:00 2001
From: Bronek Kozicki <brok@incorrekt.com>
Date: Mon, 7 Apr 2025 13:01:02 +0100
Subject: [PATCH] Disallow deleting locked MPToken

---
 src/test/app/MPToken_test.cpp                | 20 ++++++++++++++++++++
 src/xrpld/app/tx/detail/MPTokenAuthorize.cpp |  3 +++
 2 files changed, 23 insertions(+)

diff --git a/src/test/app/MPToken_test.cpp b/src/test/app/MPToken_test.cpp
index a20ce56c6d..d66d051d65 100644
--- a/src/test/app/MPToken_test.cpp
+++ b/src/test/app/MPToken_test.cpp
@@ -621,6 +621,25 @@ class MPToken_test : public beast::unit_test::suite
 
         // locks up bob's mptoken again
         mptAlice.set({.account = alice, .holder = bob, .flags = tfMPTLock});
+        if (!features[featureSingleAssetVault])
+        {
+            // Delete bobs' mptoken even though it is locked
+            mptAlice.authorize({.account = bob, .flags = tfMPTUnauthorize});
+
+            mptAlice.set(
+                {.account = alice,
+                 .holder = bob,
+                 .flags = tfMPTUnlock,
+                 .err = tecOBJECT_NOT_FOUND});
+
+            return;
+        }
+
+        // Cannot delete locked MPToken
+        mptAlice.authorize(
+            {.account = bob,
+             .flags = tfMPTUnauthorize,
+             .err = tecNO_PERMISSION});
 
         // alice unlocks mptissuance
         mptAlice.set({.account = alice, .flags = tfMPTUnlock});
@@ -2297,6 +2316,7 @@ public:
         // MPTokenIssuanceSet
         testSetValidation(all);
         testSetEnabled(all);
+        testSetEnabled(all | featureSingleAssetVault);
 
         // MPT clawback
         testClawbackValidation(all);
diff --git a/src/xrpld/app/tx/detail/MPTokenAuthorize.cpp b/src/xrpld/app/tx/detail/MPTokenAuthorize.cpp
index 6e35b134f0..aec5b0f760 100644
--- a/src/xrpld/app/tx/detail/MPTokenAuthorize.cpp
+++ b/src/xrpld/app/tx/detail/MPTokenAuthorize.cpp
@@ -164,6 +164,9 @@ MPTokenAuthorize::authorize(
                 return tecOBJECT_NOT_FOUND;
             if ((*sleMpt)[sfMPTAmount] != 0)
                 return tecHAS_OBLIGATIONS;
+            if (view.rules().enabled(featureSingleAssetVault) &&
+                (sleMpt->getFlags() & lsfMPTLocked))
+                return tecNO_PERMISSION;
 
             if (!view.dirRemove(
                     keylet::ownerDir(args.accountID),