XRP Ledger closes bug that let approved token burners create new tokens

The XRP Ledger has activated a software fix that closes a loophole through which an account authorized to destroy an issuer's tokens could also create new ones under certain conditions.

The update, called fixCleanup3_4_0, went live Wednesday at 14:52 UTC, at ledger 108,112,129, according to XRP Ledger explorer XRPLWin.

It followed two uninterrupted weeks of validator support after an earlier attempt was interrupted in October.

Permission delegation loophole

The flaw affected the network's permission delegation system, which allows an account to authorize another account to perform specific actions without handing over complete control.

A stablecoin issuer, for example, might allow a payment processor to destroy tokens when customers redeem them for dollars, without giving that processor permission to create new tokens.

Under certain conditions, the earlier rules could allow an account holding that limited burning permission to mint tokens as well. The correction enforces the separation between those actions.

The fix affects assets issued on XRP Ledger, including stablecoins, rather than XRP itself.

There have been no publicly confirmed cases of the flaw being exploited.

Additional software fixes

The software release also includes accounting corrections for the network's planned lending system and Single Asset Vaults, which are designed to let users deposit assets into pools that can support loans.

Among the fixes are changes to how vault deposits and withdrawals are calculated and how loans are classified when payments become overdue.

Other corrections cover token recovery from automated trading pools, permissioned trading and transaction signing.

The activation followed a delay caused by the XRP Ledger's amendment voting process. Changes require support from more than 80% of the network's trusted validators for 14 consecutive days.