TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The XRP Ledger activated fixCleanup3_4_0 on Wednesday, closing a disclosed permissions flaw that could have let accounts authorized to destroy an issuer’s tokens create tokens under certain conditions. The issue affected assets issued on the network, including stablecoins, not XRP itself; no exploitation has been publicly confirmed.
The XRP Ledger activated a software fix on Wednesday that closes a disclosed permissions flaw that could have allowed accounts authorized to destroy an issuer’s tokens to create new tokens under certain conditions. The bug affected assets issued on the network, including stablecoins, rather than XRP itself, and no exploitation has been publicly confirmed.
The amendment, called fixCleanup3_4_0, went live at 14:52 UTC at ledger 108,112,129, according to XRP Ledger explorer XRPLWin. Its correction separates the ability to burn an issuer’s tokens from the ability to mint them, addressing a potential gap in the network’s permission delegation system.
That system lets an account authorize another to carry out specified actions without handing over full control. For example, an issuer might let a payment processor destroy tokens when customers redeem them, without authorizing the processor to create new supply. Under certain conditions, the earlier rules could have allowed an account with that limited burning authority to mint tokens as well.
The change was activated after two uninterrupted weeks of validator support, following an earlier attempt that was interrupted in October. The release also includes accounting corrections for planned lending and pooled-asset features, plus other changes involving trading and transaction signing.
Separating Token Burning From Minting
The flaw concerned a boundary between two distinct permissions: removing tokens from circulation and creating them. If an account granted only burning authority could also mint under certain conditions, an issuer’s intended limits on a delegated account might not work as expected. The fix is intended to enforce that separation on the ledger.
This is relevant to issuers and users of tokens on the network, including stablecoins, because those assets rely on rules governing how they are issued and handled. The report does not establish that any token supply was created through the flaw, and there are no publicly confirmed cases of exploitation. The confirmed development is the activation of the corrective amendment, not evidence of losses or misuse.
The broader release also addresses calculations and classifications tied to planned lending and pooled-asset products. Those corrections matter to the design of features that may handle deposited assets and loans, although the source report does not say that those features became available as a result of this activation.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
How XRPL Amendment Approval Works
The XRP Ledger uses an amendment process for changes to its protocol rules. According to the source report, an amendment requires support from more than 80% of trusted validators for 14 consecutive days before it can activate. The latest fix met that threshold after an earlier attempt was interrupted in October.
The permissions issue arose within delegated authorization, rather than from a flaw described as affecting XRP itself. The distinction matters: XRP is the ledger’s native asset, while tokens such as stablecoins are issued on the network under issuer-defined rules. The disclosed issue concerned what a delegated account could do with those issued assets under particular conditions.
The same software release includes changes related to the network’s planned lending system and Single Asset Vaults. The latter are designed to let users place assets into pools that can support loans. The reported updates include revised calculations for vault deposits and withdrawals and changes to how overdue loans are classified, as well as corrections related to token recovery from automated trading pools, permissioned trading and transaction signing.
““There have been no publicly confirmed cases of the flaw being exploited.””
— CoinDesk report
No Confirmed Exploitation Reported
The available report says no exploitation has been publicly confirmed, but it does not establish whether the flaw was tested or used privately, or whether any issuer observed suspicious activity. It also does not provide details about the precise conditions required to trigger the behavior or identify affected accounts, tokens or issuers.
The source describes the flaw as affecting issued assets, including stablecoins, but does not list specific tokens or quantify any exposure. It also does not report losses, changes to token supplies or a direct impact on users. Those details should not be inferred from the fact that a corrective amendment was activated.
The release’s lending and vault accounting changes are described as corrections for planned features. The report does not specify when those features will launch, which projects will use them, or how the changes will be evaluated after activation.
Validator Support and Feature Follow-Up
The immediate next step is continued operation of the ledger under the activated rules. The report does not name a further deadline or a separate review date for the permissions fix. Issuers and other users relying on delegated permissions may monitor their configurations and any subsequent technical disclosures, but the source does not announce a new action or advisory from a specific issuer.
Further information may also emerge about the accounting corrections for lending and Single Asset Vaults, including when those planned features will be introduced. For now, the confirmed milestone is activation of fixCleanup3_4_0; broader availability of the lending and pooled-asset features has not been established by the report.
Key Questions
What did the XRP Ledger fix?
The amendment corrected a permissions flaw that could, under certain conditions, have allowed an account authorized to destroy an issuer’s tokens to create tokens as well.
Did the bug affect XRP?
The report says the flaw affected assets issued on the XRP Ledger, including stablecoins, rather than XRP itself.
Was the flaw exploited?
No exploitation has been publicly confirmed, according to the report. It does not establish whether the flaw was ever used privately.
When did the amendment activate?
XRPLWin records fixCleanup3_4_0 as going live on Wednesday, November 4, 2026, at 14:52 UTC, at ledger 108,112,129.
What else was included in the release?
The release included accounting corrections for planned lending and Single Asset Vault features, along with changes involving automated trading pools, permissioned trading and transaction signing.
Source: coindesk.com
