Key Takeaways
- 33 of 35 trusted validators back fixCleanup3_4_0, above the 80% threshold needed for activation.
- The fix was first expected on Oct. 23 before its two-week countdown restarted on Oct. 21.
- XRPL documentation advises against delegating the PaymentBurn permission until the fix goes live.
Fix a Lingering Loophole
The XRP Ledger (XRPL) is a day away from closing a flaw tied to one of its newest features, closing a loophole that could otherwise let accounts authorized to burn tokens also issue new ones.
The issue sits inside permission delegation, which lets an account hand specific powers to another account without sharing its keys. That feature went live on Oct. 8 through the PermissionDelegationV1_1 amendment, an upgrade Bitcoin.com News covered last month. One of those powers, PaymentBurn, is meant to let a delegate destroy tokens.
The XRPL’s own permission delegation docs spell out the problem:
“Before the fix, a delegate with the PaymentBurn granular permission can also mint new fungible tokens, which can happen with trust line tokens or multi-purpose tokens (MPTs) in certain circumstances. Until the fixCleanup3_4_0 amendment is enabled, it is recommended not to delegate the PaymentBurn granular permission.”
It’s worth mentioning that other permissions remain unaffected.
The fix ships in xrpld 3.4.0, which the release notes describe as bundling cleanups for the 3.4.0 release. Among them, it “rejects PaymentBurn payments that cross a zero balance.” The package also tightens automated market maker (AMM) clawbacks, vault accounting, escrow reserves and signature handling, and node operators were told to upgrade “as soon as possible.”
A Deadline That Slipped
The patch was supposed to be live already. Amendments on the XRPL activate only after holding at least 80% support from trusted validators for two straight weeks. If support dips to 80% or lower even once, the clock resets. In mid-October, the upgrade was set for Oct. 23 at about 09:34 UTC. That date came and went, with current data on Xrpscan’s amendment tracker showing fixCleanup3_4_0 as having regained its majority. Support now stands at 33 of 35 validators, well above the 28 needed.
Native Lending Still Short of Votes
Other pending upgrades are further behind, and the same tracker shows LendingProtocolV1_1 with 19 votes, the original LendingProtocol amendment with 19 and SingleAssetVault with 21, all below the 28-vote line. Together they would bring native lending to the XRPL, but none has a countdown running.
That leaves the ledger’s lending plans on hold even as institutions push more activity onto the network. Ripple’s RLUSD stablecoin, for example, recently drew Coinbase support across the XRPL and other chains.
A Busy Season for XRPL Security
The fix caps a rough few weeks for the network’s security record, given that last month, developers disclosed that a decade-old ledger bug could have let an attacker mint XRP beyond its fixed supply. That flaw was patched quietly in September, and there is no evidence it was ever exploited.
XRP was also hit first in the recent Binance hack, although that attack targeted Binance’s wallets rather than the XRPL itself.
In regard to the fix, nothing changes for regular XRP holders, but for issuers, exchanges, and businesses that delegate account permissions. Once fixCleanup3_4_0 activates, PaymentBurn should be safe to delegate again. XRP is trading near $1.25 on Nov. 3 ahead of the upgrade.
