From dcfcb1f3fd4919e8627aa3c7444fccc72120d628 Mon Sep 17 00:00:00 2001
From: tequ <git@tequ.dev>
Date: Wed, 18 Feb 2026 16:33:32 +0900
Subject: [PATCH] audit 13

---
 src/libxrpl/tx/transactors/Escrow.cpp |  8 ++++--
 src/test/app/Sponsor_test.cpp         | 41 ++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/src/libxrpl/tx/transactors/Escrow.cpp b/src/libxrpl/tx/transactors/Escrow.cpp
index a4ef7a81ba..2f36eb0619 100644
--- a/src/libxrpl/tx/transactors/Escrow.cpp
+++ b/src/libxrpl/tx/transactors/Escrow.cpp
@@ -834,7 +834,8 @@ escrowUnlockApplyHelper<MPTIssue>(
 
     auto const mptID = amount.get<MPTIssue>().getMptID();
     auto const issuanceKey = keylet::mptIssuance(mptID);
-    if (!view.exists(keylet::mptoken(issuanceKey.key, receiver)) && createAsset && !receiverIssuer)
+    auto const mptKeylet = keylet::mptoken(issuanceKey.key, receiver);
+    if (!view.exists(mptKeylet) && createAsset && !receiverIssuer)
     {
         auto const sponsor = getTxReserveSponsor(view, tx);
         if (auto const ret = checkInsufficientReserve(view, tx, sleDest, xrpBalance, sponsor, 1); !isTesSuccess(ret))
@@ -847,10 +848,11 @@ escrowUnlockApplyHelper<MPTIssue>(
 
         // update owner count.
         adjustOwnerCount(view, tx, sleDest, sponsor, 1, journal);
-        addSponsorToLedgerEntry(sleDest, sponsor);
+        auto mptSle = view.peek(mptKeylet);
+        addSponsorToLedgerEntry(mptSle, sponsor);
     }
 
-    if (!view.exists(keylet::mptoken(issuanceKey.key, receiver)) && !receiverIssuer)
+    if (!view.exists(mptKeylet) && !receiverIssuer)
         return tecNO_PERMISSION;
 
     auto const xferRate = transferRate(view, amount);
diff --git a/src/test/app/Sponsor_test.cpp b/src/test/app/Sponsor_test.cpp
index a40a56436f..e841d51de3 100644
--- a/src/test/app/Sponsor_test.cpp
+++ b/src/test/app/Sponsor_test.cpp
@@ -2531,6 +2531,45 @@ public:
 
             BEAST_EXPECT(env.le(keylet::line(bob, gw, USD.currency))->getAccountID(sfHighSponsor) == sponsor2.id());
         }
+        {
+            // MPT Escrow
+            Env env{*this, testable_amendments()};
+            env.fund(XRP(1000000), bob, sponsor);
+            env.close();
+
+            MPTTester mptGw(env, gw, {.holders = {alice}});
+            mptGw.create({.ownerCount = 1, .holderCount = 0, .flags = tfMPTCanEscrow | tfMPTCanTransfer});
+            mptGw.authorize({.account = alice});
+            auto const MPT = mptGw["MPT"];
+            env(pay(gw, alice, MPT(10'000)));
+            env.close();
+            return;
+
+            // create Escrow from alice to bob
+            auto const seq = env.seq(alice);
+            env(escrow::create(alice, bob, MPT(100)),
+                escrow::condition(escrow::cb1),
+                escrow::cancel_time(env.now() + 100s));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 2);
+            BEAST_EXPECT(ownerCount(env, bob) == 0);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
+
+            // finish Escrow
+            env(escrow::finish(bob, alice, seq),
+                escrow::condition(escrow::cb1),
+                escrow::fulfillment(escrow::fb1),
+                sponsor::as(sponsor, tfSponsorReserve),
+                sig(sfSponsorSignature, sponsor),
+                fee(XRP(1)));
+            env.close();
+
+            BEAST_EXPECT(ownerCount(env, alice) == 1);
+            BEAST_EXPECT(ownerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoredOwnerCount(env, bob) == 1);
+            BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 1);
+        }
     }
 
     void
@@ -3384,7 +3423,7 @@ public:
                 BEAST_EXPECT(sponsoringOwnerCount(env, sponsor) == 0);
                 BEAST_EXPECT(sponsoringOwnerCount(env, sponsor2) == ocount);
 
-                // disolve sponsor
+                // dissolve sponsor
                 env(sponsor::transfer(alice, keylet::oracle(alice, 1).key));
                 env.close();