XRP Ledger Closes Token Minting Loophole With New Amendment

The XRP Ledger has switched on a fix for a flaw that let an account with limited permission to destroy an issuer’s tokens also create new ones under some conditions. XRP itself was never at risk, and no one has publicly reported exploiting the bug.

What the XRPL Bug Allowed

The problem sat in the ledger’s permission delegation feature, which lets one account give another account narrow powers without handing over full control. A stablecoin issuer might let a payment processor burn tokens when customers cash out, but not mint more. Under certain conditions, the older rules could let that burn only account do both. The fix, called fixCleanup3_4_0, restores the separation. It covers tokens issued on the network, such as stablecoins, and not XRP.

How the Amendment Went Live

The change activated Wednesday at 14:52 UTC at ledger 108,112,129, per XRPLWin. An earlier attempt broke off in October, so validators had to start the count again. XRPL amendments need support from over 80% of trusted validators for 14 days in a row, and this one held for two straight weeks.

Other Fixes in the Release

The same software update repairs accounting for the planned lending system and Single Asset Vaults, which will let users deposit assets into pools that support loans. Changes cover vault deposit and withdrawal math and how overdue loans are labeled. Further corrections touch token recovery from automated trading pools, permissioned trading and transaction signing.