The XRP Ledger rolled out a security update on Wednesday, closing a protocol vulnerability that could have allowed accounts with permission to burn tokens to issue new ones under specific conditions. The native XRP asset remained unaffected.
The amendment, identified as fixCleanup3_4_0, went live at 14:52 UTC at ledger 108,112,129, according to XRP Ledger explorer XRPLWin. Its activation followed two consecutive weeks of validator approval after an earlier attempt was delayed in October.
The security issue originated in XRPL’s permission delegation system, which allows account holders to authorize other accounts to perform selected operations without handing over complete control of their wallets.
For example, a stablecoin issuer may grant a payment processor permission to destroy tokens when customers redeem them for dollars. Under the intended rules, that authorization should not include the ability to create additional tokens.
However, the previous protocol contained a loophole that could potentially allow accounts with token-burning privileges to mint new tokens in certain situations. The latest amendment corrects the issue by separating token destruction and issuance permissions.
The vulnerability affected assets issued on the XRP Ledger, including stablecoins and other tokens, rather than XRP itself. No confirmed cases of exploitation have been publicly disclosed.
The update also introduces accounting adjustments for the network’s planned lending features and Single Asset Vaults. These mechanisms are designed to let users deposit assets into pools that can be used to facilitate lending.
Other improvements include revised calculations for vault deposits and withdrawals, as well as changes to how loans are classified when repayments become overdue.
The release additionally addresses issues involving token recovery from automated trading pools, permission-based trading and transaction signing.
The deployment followed XRPL’s amendment approval procedure, which requires a proposed change to receive backing from more than 80% of trusted validators for 14 consecutive days before activation.
