The XRP Ledger deployed the security patch on Wednesday after validator support triggered a fresh activation countdown in October. The vulnerability did not affect the XRP cryptocurrency.
The XRP Ledger has activated a protocol upgrade to address a security weakness that could have enabled accounts authorized to destroy an issuer’s tokens to create additional tokens under certain circumstances.
Known as fixCleanup3_4_0, the amendment became active at 14:52 UTC on Wednesday, reaching ledger 108,112,129, according to XRP Ledger explorer XRPLWin. The deployment came after the amendment secured uninterrupted validator support for two weeks, following an earlier activation delay in October.
The vulnerability involved XRPL’s permission delegation framework, which allows account holders to assign specific transaction privileges to other accounts without surrendering complete control.
For instance, a stablecoin issuer could grant a payment processor permission to burn tokens when customers redeem them for dollars. However, the processor would not normally receive authorization to issue new tokens.
The previous protocol rules contained a loophole that could allow an account with token-burning privileges to mint additional tokens under certain conditions. The newly activated fix closes this gap and ensures that burning and issuing permissions remain separate.
The vulnerability affected tokens issued on the XRP Ledger, including stablecoins, but did not impact XRP itself. There are currently no publicly confirmed reports of the flaw being exploited.
Beyond the security correction, the release introduces accounting improvements for the network’s planned lending infrastructure and Single Asset Vaults. The features will allow users to deposit assets into shared pools that can be used to support lending activities.
The update also improves calculations involving vault deposits and withdrawals and adjusts how overdue loans are categorized when borrowers fail to make payments on time.
Additional changes address token recovery from automated market-making pools, permission-based trading and transaction signing.
The amendment’s activation process was extended because of XRPL’s validator-based governance requirements. Network changes must receive support from more than 80% of trusted validators for 14 consecutive days before they can become active.
