The vulnerability that allowed accounts authorized only to burn tokens on the XRP Ledger to also create new tokens under certain conditions was fixed in an activated update.
According to a report by CoinDesk citing XRPLWin data, the fix called fixCleanup3_4_0 was activated at 17.52 Turkey time on November 4. The change took effect after validators on the network supported it continuously for 14 days.
The vulnerability affected tokens issued on the XRP Ledger, including stablecoins; the network’s native asset, XRP, was not affected. No publicly verified cases of the vulnerability being exploited were reported.
Token deletion permission could become minting permission
The XRP Ledger’s delegation system allows an account to grant another account permission to perform certain actions without handing over full control. For example, a stablecoin issuer can authorize a payment processor to remove tokens from circulation when customers redeem them for dollars.
Under the previous rules, however, an account with only this burn permission could also create new tokens under certain conditions. The update separates the permissions to remove tokens from circulation and to create new ones, preventing this permission from exceeding its intended scope.
Update activated after two weeks of support
For changes of this kind to take effect on the XRP Ledger, more than 80 percent of the validators trusted by the network must support them for 14 consecutive days. An earlier attempt in October was interrupted; after the new support period was completed, the fix was activated on ledger 108.112.129.
The software release also includes accounting fixes for the network’s planned lending system and single-asset vaults, which will allow users to deposit assets into lending pools. These changes include calculations for vault deposits and withdrawals, as well as the classification of overdue loan payments.
Other fixes cover token recovery from automated trading pools, permissioned trading, and transaction signing processes.
Not investment advice.