XRP Ledger activates patch that plugs token-minting loophole — XRP safe The XRP Ledger has activated a software amendment that closes a vulnerability which, under certain conditions, could have allowed accounts with burn-only permission to create issued tokens. The fix — named fixCleanup3_4_0 — went live on November 4 at 14:52 UTC at ledger 108,112,129, according to the XRPLWin amendment tracker. What the bug was - The flaw involved the Ledger’s permission-delegation system and a delegated permission called PaymentBurn. PaymentBurn lets an approved account destroy tokens issued by another account (a common pattern for payment services that redeem stablecoins). - Under the old rules, a PaymentBurn-only account could, in some edge cases when a payment crossed a zero-balance boundary, end up creating issued tokens instead of just burning them. - That behavior could have impacted issued assets on the ledger — stablecoins, trust-line tokens, and Multi-Purpose Tokens — but not the native XRP, which sits outside this permission model. Was the vulnerability exploited? - No public reports have confirmed any exploitation, and disclosures to date do not identify any issuer that suffered unauthorized token creation. How the fix works - The amendment rejects “PaymentBurn payments that cross a zero balance,” effectively separating token destruction from issuance and preventing the boundary-crossing condition that allowed accidental minting. - The change was bundled into XRP Ledger server v3.4.0 in September, but protocol amendments require a validator voting process before they alter network rules. Validator voting and activation timeline - Protocol amendments need support from more than 80% of trusted validators for 14 consecutive days to activate. With 35 validators on the tracked default list, that means at least 29 must signal support continuously. - The first approval window began on October 9 but was interrupted when support dipped below the threshold on October 21 (the first attempt lasted 12 days and 3 hours). A new majority formed later that day, starting a second 14-day countdown that ran 14 days and 5 minutes and allowed activation on November 4. - XRPL’s voting requires uninterrupted support, so even a temporary decline can delay an upgrade. Other corrections included in fixCleanup3_4_0 Beyond the PaymentBurn fix, the amendment bundles several maintenance and safety fixes that affect transaction behavior and accounting: - Automated market maker (AMM) clawbacks: Prevents a transaction from destroying a liquidity provider’s tokens when rounding would otherwise leave the issuer with no underlying assets. - Permissioned trading rules: Stops accounts from receiving certain tokens through offers when issuer restrictions should block those transfers. - Escrow reserves, Multi-Purpose Token authorization and transaction signature handling: Introduces distinct signing prefixes to prevent signatures for one transaction role being reused for another. - Accounting corrections for Single Asset Vaults and the proposed lending protocol: Adjusts how deposits, withdrawals, recoverable assets, overdue payments and impaired loans are calculated. These corrections prepare the ledger for future lending features but do not activate those features — each lending amendment still needs separate validator approval. Context and next steps - Developers urged server operators to upgrade to the v3.4.0 code before the amendment took effect. The activation follows earlier disclosures about the token-minting flaw; crypto.news covered the issue when the amendment was still awaiting activation on November 2. - Proposed lending features (Single Asset Vaults and LendingProtocolV1_1) remain subject to independent voting and will only become active on mainnet if they each secure the required validator support. Why it matters - The patch removes a credible edge-case risk for issued tokens on the XRP Ledger and tightens multiple transaction and accounting behaviors — an important step for issuer confidence, stablecoin integrity, and future protocol features. Read more AI-generated news on: https://app.chaingpt.org/news