XRP Ledger Patches Disclosed Vulnerability That Could Have Enabled Unauthorized Token Creation

The XRP Ledger activated the security fix on Wednesday after validator approval restarted the amendment’s activation countdown in October. The native XRP token was not affected by the vulnerability.

The XRP Ledger has successfully deployed a software update to eliminate a security loophole that could have allowed an account authorized to burn an issuer’s tokens to create new tokens under specific circumstances.

The amendment, named fixCleanup3_4_0, became active at 14:52 UTC on Wednesday at ledger 108,112,129, according to data from XRP Ledger explorer XRPLWin. Its activation followed 14 consecutive days of validator approval after an earlier activation attempt was disrupted in October.

The vulnerability was associated with the network’s permission delegation mechanism, which enables one account to grant another account authority to carry out selected operations without transferring full account control.

For example, a stablecoin issuer could authorize a payment processor to burn tokens when customers exchange them for U.S. dollars. This arrangement would allow the processor to destroy tokens without granting it the ability to issue additional ones.

However, under certain conditions, the previous protocol rules could have allowed an account with restricted token-burning privileges to mint new tokens as well. The latest patch addresses this weakness by maintaining a clear distinction between the two permissions.

The issue applied to assets issued on the XRP Ledger, including stablecoins and other tokens, rather than XRP itself. No publicly verified incidents of the vulnerability being exploited have been reported.

The software update also introduces several accounting improvements related to the network’s upcoming lending functionality and Single Asset Vaults. These features are designed to allow users to deposit assets into pools that can subsequently support lending activities.

Additional corrections address the calculation of vault deposits and withdrawals, along with the classification of loans when borrowers miss scheduled payments.

The release also includes other improvements covering token recovery from automated market-making pools, permission-controlled trading and transaction signing.

The amendment’s activation was delayed by the XRP Ledger’s governance and voting mechanism. Under the network’s rules, proposed changes must receive approval from more than 80% of trusted validators and maintain that level of support for 14 consecutive days before activation.