XRP Ledger activates fix for token-minting permission flaw
The XRP Ledger activated a fix for a permission flaw that could let token-burning delegates mint issued assets, closing a risk for stablecoins and other tokens.
Crypto Daybook Newsroom2 min read
The XRP Ledger activated a fix on Nov. 4 for a flaw that could let an account authorized to destroy issued tokens create new ones in some cases. The change protects assets such as stablecoins and keeps the PaymentBurn permission limited to destroying tokens, according to the Crypto.news report on the activation.
The update does not affect XRP, the ledger’s native cryptocurrency. The risk involved tokens issued on the network, including trust-line tokens and Multi-Purpose Tokens (MPTs).
How could a burn permission allow token creation?
The issue involved PaymentBurn, a permission an account holder can delegate to another account. It allows that delegate to destroy issued tokens, for example, when a payment service processes a customer’s stablecoin redemption.
Under the old rules, a PaymentBurn transaction that crossed a zero-balance boundary could also allow the delegate to mint tokens in certain circumstances. The XRP Ledger’s permission documentation describes the risk and says not to delegate PaymentBurn until the fix is enabled. Other granular permissions were unaffected.
The fix rejects PaymentBurn payments that cross zero. That keeps the ability to burn tokens separate from the ability to issue them. The ledger’s documentation lists PaymentMint as the permission for payments that create fungible tokens or MPTs.
When did the change take effect?
The fix, called fixCleanup3_4_0, became active on Nov. 4 at 14:52 UTC, at ledger 108,112,129, Crypto.news reported. It had been included in server version 3.4.0, but the software release alone did not change the network’s rules. The correction needed approval through the ledger’s amendment process.
Amendments require more than 80% support from trusted validators for 14 consecutive days. Crypto.news reported that support fell below the threshold on Oct. 21, restarting the approval period. The amendment activated after support remained above the threshold for a new two-week stretch.
Was there evidence the flaw was exploited?
No public exploitation has been confirmed, and the report did not identify an issuer whose tokens were created without permission. The confirmed risk was limited to issued assets; the flaw did not allow unauthorized creation of XRP itself.
The amendment also bundles other fixes for parts of the XRP Ledger, including trading, vault accounting and transaction signing. Its activation closes the disclosed token-permission flaw, while the ledger’s published warning provides a clear rule for users considering delegated PaymentBurn permissions.
References
- Crypto.news report on the activation — crypto.news
- XRP Ledger’s permission documentation — xrpl.org