Key takeaways
- XRP Ledger activates security upgrade after delayed validator approval
- New amendment closes loophole allowing unauthorized token creation
- XRP's native supply remains unaffected by the vulnerability
The XRP Ledger has activated a major security upgrade that closes a vulnerability allowing certain authorized accounts to create tokens they were only permitted to destroy, ending a nearly two-week delay caused by validator voting.
The fixCleanup3_4_0 amendment went live on November 4 at 14:52 UTC, at ledger 108,112,129, according to XRPL Dashboard's amendment tracker. The update introduces several security and accounting corrections, including protections for issued assets such as stablecoins.
The activation follows an earlier XRPL upgrade delay, when validator support briefly dropped below the required threshold. Importantly, the vulnerability did not affect XRP's native supply, and no exploitation has been publicly confirmed.
XRP Ledger Closes Token-Minting Permission Loophole
The most significant correction involves XRPL's permission delegation system, which allows account holders to authorize other accounts to perform specific operations without granting complete control.
Under the previous rules, an account holding the PaymentBurn permission could, under certain circumstances, also create new fungible tokens. This included traditional trust-line assets and Multi-Purpose Tokens (MPTs), potentially creating problems for stablecoin issuers and other tokenized financial products.
For example, a stablecoin issuer might authorize a payment processor to destroy tokens during redemptions. That permission should not allow the processor to issue additional tokens, but the vulnerability could undermine that separation.
The newly activated amendment prevents PaymentBurn transactions from crossing a zero balance into token creation unless the account separately holds the appropriate minting permission.
The correction builds on XRPL's recent security improvements, although the earlier emergency fixes addressed separate vulnerabilities.
Why Validator Voting Delayed the Security Fix
The amendment was originally expected to activate around October 23 after securing sufficient validator support on October 9.
However, support dropped below the required threshold on October 21, interrupting the mandatory 14-day approval period. Although the majority was restored approximately two hours later, the countdown had to restart.
XRPL protocol amendments require support from more than 80% of trusted validators for two consecutive weeks. With 35 validators in the tracked voting group, at least 29 approvals were needed.
The second approval period successfully completed on November 4, marking the transition from a proposed change to an active network rule.
The process highlights how XRPL governance depends on sustained validator consensus rather than unilateral decisions by Ripple.
What's Next for XRP Ledger Upgrades?
Beyond the token-minting correction, fixCleanup3_4_0 improves automated market maker clawbacks, escrow reserve handling, transaction signing and accounting for Single Asset Vaults.
However, the amendment does not activate XRPL's proposed native lending protocol, which still requires separate validator approval.
Recent voting data showed native lending receiving 19 of the 29 votes required to begin its own approval countdown.
Meanwhile, developers are working on additional token security protections, including tighter authorization checks for institutional assets.
