TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The XRP Ledger activated fixCleanup3_4_0 on Wednesday, correcting a permission bug that could have let accounts authorized to destroy an issuer’s tokens create new ones under certain conditions. The flaw affected issued assets, including stablecoins, not XRP itself; no exploitation has been publicly confirmed.
The XRP Ledger activated a software amendment on Wednesday that closes a disclosed permission flaw which could have allowed accounts authorized to destroy an issuer’s tokens to create new tokens under certain conditions. The issue affected assets issued on the network, including stablecoins, rather than XRP itself, and no exploitation has been publicly confirmed.
The amendment, named fixCleanup3_4_0, went live at 14:52 UTC at ledger 108,112,129, according to the XRP Ledger explorer XRPLWin. Its correction enforces a separation between permission to burn an issuer’s tokens and permission to create them. The network’s delegation system lets an account grant another account authority to perform specified actions without transferring full control.
That separation matters for arrangements such as a stablecoin issuer authorizing a payment processor to destroy tokens when customers redeem them for dollars. Under the earlier rules, the disclosed flaw could, in certain conditions, have allowed an account with that limited burning authority to mint tokens as well. The software change addresses that potential; the source report does not say the flaw was used to create tokens.
The release also contains changes beyond the permission correction. It includes accounting fixes for planned lending and Single Asset Vault features, including calculations for vault deposits and withdrawals and how loans are classified when payments become overdue. Other corrections address token recovery from automated trading pools, permissioned trading and transaction signing.
Separating Token Burn and Mint Rights
The fix addresses a control boundary in delegated permissions: an account given authority to destroy tokens should not thereby gain the ability to create them. For issuers of assets on the XRP Ledger, that distinction is relevant to operational controls and the integrity of token supply, particularly where external processors handle redemptions.
The disclosed risk was about issued assets, including stablecoins, not the native XRP token. That limits what the bug description says was at stake, but it does not make the issue merely theoretical for issuers who rely on delegated permissions. The available reporting does not establish that any issuer suffered losses or that any token supply was altered.
The amendment also bundles accounting and transaction-related corrections. Those changes are relevant to the ledger’s planned lending and pooled-asset functions, though the report does not establish that those features were activated by this release. The principal confirmed development is the software fix, not a reported incident or a change to XRP’s supply.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
How XRPL Amendment Approval Works
The XRP Ledger uses an amendment process for changes to its protocol. According to the source report, an amendment must receive support from more than 80% of trusted validators for 14 consecutive days before activation. This approval threshold means a proposed correction does not necessarily go live as soon as it is announced.
The fix’s activation followed an earlier attempt that was interrupted in October. The amendment then completed the required period of validator support and went live on Wednesday. The source report does not give further detail about why the October attempt was interrupted, so the precise reason for that delay is not established here.
The permission issue concerns assets issued on XRPL and the system for delegating specific account actions. It is distinct from a claim that XRP itself could be minted through the flaw. The release’s additional changes concern accounting and other ledger functions, including features described as planned.
““There have been no publicly confirmed cases of the flaw being exploited.””
— CoinDesk report
Exploit Evidence and October Delay
No public exploitation has been confirmed, but the available information does not establish whether private attempts occurred or provide an independent audit of all activity before activation. It also does not identify specific issuers or accounts that may have been exposed, or quantify how many assets or transactions could have been affected under the stated conditions.
The report describes the issue as a loophole under certain conditions but does not provide the technical conditions needed to reproduce it. It also does not detail why the earlier amendment attempt was interrupted in October. Those points remain unclear from the cited material.
The release includes corrections for planned lending and vault features, but the report does not specify when those features will launch or whether every related accounting change is tied to an already active service. Further technical documentation or statements from the network’s developers could clarify the scope and implementation details.
Post-Activation Network Monitoring
The amendment is already active, so the immediate next step is for XRPL participants to operate under the corrected permission rules. Issuers and account operators using delegated actions may review their permission settings and the release notes to understand how the change applies to their arrangements; the source report does not describe any required action for all users.
Further information may come from the XRP Ledger’s technical documentation, validator records or statements from developers and affected issuers. Readers should look for specific details on the amendment’s implementation, the earlier interrupted attempt, and the status of the lending and Single Asset Vault features. No additional activation date or follow-up milestone was provided in the source material.
Key Questions
What did the XRP Ledger fix?
The fixCleanup3_4_0 amendment corrected a permission flaw that could, under certain conditions, let an account authorized to burn an issuer’s tokens also create new ones.
Was XRP itself affected?
The reported flaw affected assets issued on the XRP Ledger, including stablecoins, rather than XRP itself.
Was the flaw exploited?
No exploitation has been publicly confirmed in the source report. That statement does not establish whether any private or unreported attempts occurred.
When did the amendment go live?
XRPLWin reported that the amendment activated on Wednesday at 14:52 UTC, at ledger 108,112,129.
What else was included in the software release?
The release also included accounting corrections for planned lending and Single Asset Vault features, plus fixes involving trading, token recovery and transaction signing.
Source: coindesk.com
