XRP Ledger Fixes Token-Minting Flaw After 14 Days of Validator Approval

The XRP Ledger (XRPL) has activated a critical software correction that closes a permission-delegation vulnerability that could have allowed authorized token-burning accounts to create new digital assets under certain conditions. The amendment, known as fixCleanup3_4_0, went live on November 4 at 14:52 UTC, at ledger 108,112,129. The activation followed 14 consecutive days of validator support after an earlier voting attempt was disrupted in October. The correction strengthens security for issued assets, including stablecoins, although XRP’s native supply was never affected by the vulnerability.

XRP Ledger closes token-minting vulnerability

The fixCleanup3_4_0 amendment addresses a weakness in the XRP Ledger’s permission-delegation system, which allows account owners to authorize other accounts to perform specific transactions without transferring complete control of their wallets.

The vulnerability involved a permission known as PaymentBurn. This authorization allows a delegated account to destroy issued tokens, but it should not provide the ability to create additional tokens.

For example, a stablecoin issuer might authorize a payment processor to burn tokens when customers redeem them for dollars. The processor would need permission to destroy the redeemed tokens without receiving authority to issue new ones.

Under the previous rules, however, an account holding this limited permission could potentially mint new fungible tokens under certain circumstances. The newly activated correction enforces the separation between token destruction and creation.

According to the official XRP Ledger documentation, the correction prevents PaymentBurn transactions from crossing a zero balance, closing the loophole that enabled the unintended behavior.

Importantly, the issue concerned assets issued on the XRP Ledger, including stablecoins and other fungible tokens. It did not provide a mechanism to create additional XRP or change the cryptocurrency’s native supply. No publicly confirmed exploitation has been reported.

14-day validator approval delays activation

The amendment’s activation highlights the XRP Ledger’s governance process, which requires substantial agreement among trusted network validators before protocol changes become permanent.

The network requires more than 80% support from trusted validators for 14 consecutive days. If approval falls below the required threshold during that period, the qualification countdown must restart.

The first activation attempt lost its majority in October, delaying implementation. Validators subsequently restored the required support on October 21, allowing a new 14-day approval period to begin.

The amendment eventually became active on November 4 at ledger 108,112,129.

Key activation details include:

• Amendment: fixCleanup3_4_0.
• Activation date: November 4, 2026.
• Activation time: 14:52 UTC.
• Ledger number: 108,112,129.
• Approval requirement: More than 80% validator support for 14 consecutive days.

XRPL update strengthens vault accounting

Beyond the permission-delegation correction, the XRP Ledger 3.4.0 software release includes additional improvements covering automated market makers, permissioned trading, transaction signing and asset management.

Several corrections address the network’s Single Asset Vaults, which allow users to deposit assets into shared pools designed to support lending activities.

The changes improve calculations for vault deposits, withdrawals and asset balances, reducing the possibility of accounting discrepancies caused by rounding errors. Other corrections strengthen token recovery from automated trading pools and improve transaction-signing protections.

The release also contains improvements for the planned lending infrastructure. However, these software changes should not be confused with the separate activation of the LendingProtocolV1_1 amendment.

Conclusion

The activation of fixCleanup3_4_0 represents an important security improvement for the XRP Ledger, particularly for stablecoin issuers and businesses using delegated transaction permissions. By separating token-burning authority from unintended minting capabilities, the network reduces a potential risk to issued assets. The successful completion of its validator approval process also demonstrates the importance of decentralized governance in maintaining blockchain security and reliability.