XRP Ledger Resolves Disclosed Bug That Could Have Allowed Attackers to Mint New Tokens

The XRP Ledger has implemented a security upgrade to resolve a protocol vulnerability that could have allowed accounts with authorization to burn an issuer’s tokens to create new ones under specific conditions. The issue did not affect the network’s native XRP token.

The amendment, called fixCleanup3_4_0, was activated on Wednesday at 14:52 UTC, reaching ledger 108,112,129, according to XRP Ledger explorer XRPLWin. The deployment came after the amendment maintained validator approval for 14 consecutive days, following an interruption to an earlier activation attempt in October.

The vulnerability was linked to XRPL’s permission delegation mechanism, which allows account holders to authorize other accounts to execute specific operations without transferring complete control of their wallets.

For instance, a stablecoin issuer could grant a payment processor permission to destroy tokens when customers redeem them for dollars. This limited authorization is not supposed to include the ability to issue additional tokens.

However, a weakness in the previous protocol rules could have enabled accounts holding token-burning permissions to mint new tokens under certain circumstances. The latest amendment resolves the issue by enforcing a stricter separation between token creation and destruction privileges.

The flaw affected assets issued on the XRP Ledger, including stablecoins and other tokens, but left XRP itself untouched. No publicly confirmed exploitation incidents have been reported.

The software release also includes accounting updates for XRPL’s planned lending system and Single Asset Vaults, which are designed to allow users to deposit assets into pools that support lending activities.

Among the improvements are revised calculations for vault deposits and withdrawals, along with adjustments to how overdue loans are classified when borrowers miss payments.

Other changes address token recovery from automated trading pools, permission-based trading and transaction-signing processes.

The upgrade’s activation was subject to the XRP Ledger’s amendment voting requirements. Under the network’s governance framework, proposed changes must receive approval from more than 80% of trusted validators for 14 consecutive days before they can be activated.