Key facts
- The amendment closes a gap letting accounts with PaymentBurn permission create issued tokens without PaymentMint permission, per XRPL developers.
The XRP Ledger's fixCleanup3.4.0 amendment had 33 of 35 trusted validators supporting it as of November 2, putting November 4 as the earliest possible activation date, according to XRPLWin's amendment tracker. The upgrade closes a permission gap that could let accounts holding the PaymentBurn permission create issued tokens, including stablecoins, without the separate PaymentMint permission.
Stablecoin issuers on the XRP Ledger would gain a safeguard against approved payment partners creating tokens without their consent once the amendment activates, which XRPLWin's tracker put no earlier than November 4. The separate lending and vault amendments, at 19 and 21 validator votes, still lack the support needed to begin their approval periods.
The XRP Ledger has proposed a security upgrade to stop unauthorized stablecoin minting by closing a permission loophole, according to the network's official documentation. The gap affects accounts holding the PaymentBurn permission, which normally lets them destroy issued tokens. Under certain conditions those accounts could create tokens without the separate PaymentMint permission, XRPL developers said. One example is a stablecoin issuer authorizing a payment provider to burn tokens during customer redemptions.
XRPL developers said the issue affects issued assets, including stablecoins and multipurpose tokens, but that the supply of XRP does not depend on the affected mechanism. The fixCleanup3.4.0 amendment was included in XRP Ledger version 3.4.0, released in September. The amendment also corrects errors in calculating deposits, withdrawals and asset recovery in vaults, and improves transaction handling in automated market makers and lending systems. It would also prevent certain loan records from showing overdue payments before their contractual due dates.
According to XRPLWin's amendment tracker, 33 of 35 trusted validators supported the upgrade on November 2. Network rules require more than 80% validator support for 14 consecutive days before an amendment activates. Developers had hoped for activation on October 23, but support briefly fell to 26 validators on October 21, restarting the countdown. With validators back, November 4 was the earliest possible activation date, and the network had not activated the amendment as of November 2.
XRPL developers previously addressed a separate security vulnerability through an emergency software release in October. That incident involved the payments engine and was unrelated to the permission problem. The separate lending and Single Asset Vault amendments had 19 and 21 validator votes, respectively, and both still needed more support before starting their 14-day approval periods.
Pick the topics you care about. Get only what matters, on your cadence.