The XRP Ledger has activated a fix for a bug tied to its delegated burn permission system. Developers say the flaw could have let unauthorized actors mint new tokens on the network, according to reports from crypto.news and Unchained.
Delegated permissions on the XRP Ledger allow one account to authorize another to perform specific actions, such as burning tokens, without handing over full control of the account. These permission structures are designed to give issuers and applications more flexibility when managing assets on the ledger.
The bug reportedly involved a path where a permission meant only for burning tokens could be exploited to mint new ones instead. Minting authority is normally tightly restricted to token issuers. A flaw that blurs that boundary raises concerns about the integrity of supply controls for assets issued on the ledger.
Both outlets describe the fix as now active on the network, addressing the delegated burn permission issue. Neither report specifies whether the bug was exploited before the fix was applied, nor does it detail how it was originally discovered.
The XRP Ledger underpins a range of tokenized assets beyond XRP itself, including issued currencies, stablecoins, and tokenized real-world assets. Any defect affecting minting controls touches the core trust assumption behind these assets: that supply can only be created by an authorized issuer. Bugs of this kind are a recurring concern across blockchain networks that support permissioned token issuance, since minting flaws can directly affect token supply and value.
Network-level fixes on the XRP Ledger typically require coordination among validators who run the software that enforces consensus rules. Updates addressing security issues are usually built into amendments or protocol changes that validators must adopt before they take effect across the network. The reports indicate the fix for this particular issue is now live, though the technical rollout process itself was not detailed in the available coverage.
Sources disagree on this story
This article was published before the reports below were compared. The reporting above stands; what follows is where the published accounts do not agree.
crypto.news and CoinTurk News EN both cover the fixCleanup3_4_0 activation but give conflicting accounts of what happened when validator support dipped on October 21.
What all sources agree on
- XRP Ledger activated the fixCleanup3_4_0 amendment on November 4 at 14:52 UTC, at ledger 108,112,129.
- The fix addresses the PaymentBurn permission, which could allow an account authorized to burn issued tokens to also create new tokens under certain conditions.
- The vulnerability concerned issued assets such as stablecoins and Multi-Purpose Tokens, not XRP's native supply.
- XRPL amendments require support from over 80% of trusted validators for two consecutive weeks.
- fixCleanup3_4_0 first achieved majority validator backing on October 9.
- Validator support briefly fell/dipped below the required threshold on October 21.
Where the reports disagree
1Whether the October 21 validator support dip restarted the 14-day approval window
Validator support briefly fell below the required threshold on October 21, restarting the mandatory 14-day approval period.
fixCleanup3_4_0 first achieved majority backing on October 9 but briefly lost validator support on October 21. Support returned the same day, and the two-week window was fulfilled without further interruption.
What would settle it: The XRPLWin amendment tracker's full validator-support history log for fixCleanup3_4_0 around October 21.
What to make of it
Treat the amendment's name, activation time/ledger, and the nature of the PaymentBurn fix as established; the exact sequence of events around the October 21 validator dip — whether it restarted the 14-day clock or not — is contested and unresolved between these two reports.
Market Impact
There is no indication from the available reporting that the bug was exploited or that any tokens were improperly minted. As a result, direct market effects tied to lost funds or diluted token supply have not been reported.
The broader implication concerns confidence in the XRP Ledger's permission architecture, particularly for projects relying on it to issue stablecoins or tokenized assets. A prompt fix, once confirmed and adopted across validators, would reduce ongoing risk. Market participants will likely watch for any follow-up disclosures about whether the vulnerability was active before the patch and whether any further protocol changes are planned.
The reported fix addresses a specific flaw in the XRP Ledger's delegated burn permission system before it could be confirmed as exploited. Further details on the bug's origin and any affected transactions may emerge as the story develops.
Frequently Asked Questions
What was the bug in the XRP Ledger?
It involved a delegated burn permission feature that could reportedly be misused to mint new tokens, rather than only burn existing ones, according to crypto.news and Unchained.
Has the XRP Ledger fixed the issue?
Yes, reports indicate a fix addressing the delegated burn permission flaw has been activated on the network.
Were any tokens improperly minted because of this bug?
The available reporting does not state that the vulnerability was exploited or that unauthorized tokens were created.
Why does a minting bug matter for the XRP Ledger?
The ledger hosts issued currencies, stablecoins, and tokenized assets, so flaws affecting minting controls could undermine trust in token supply integrity.