XRP Ledger Patches Bug That Threatened Token Minting Security

The XRP Ledger has enabled an update that plugs a flaw in which accounts capable of destroying tokens can make new ones under certain circumstances without altering the native XRP token. According to the XRPLWin amendment tracker, the patch called "fixCleanup3_4_0" has come into effect since November 4 at 14:52 UTC, with ledger 108,112,129. After two straight weeks, when there was a glitch during a week in October and the validation network had to restart from the beginning, the patch came into force.

XRPL Amendment Requires Approval From More Than 80 Percent of Trusted Validators

This fix corrects an issue in the permission delegation process in XRP Ledger, where the owner of an account grants another account the right to execute certain transactions while keeping control of the funds on the account. Specifically, there is a delegated permission named PaymentBurn that provides a user with the right to burn tokens of another account. Typically, such permission would be granted to a stablecoin redemption service by the issuer. Once customers exchanged stablecoins for dollars, the service could destroy the tokens without creating new ones.

Nevertheless, the old transaction rules on XRP Ledger allowed for the creation of issued tokens by the account with only PaymentBurn permission under specific circumstances. The issue was created when the payment made with the help of the delegated permission crossed the zero-balance boundary. The new amendment prevents such transactions from crossing this boundary. 

The XRPL release notes refer to the fix as one that rejects “PaymentBurn payments that cross a zero balance.” This vulnerability impacts any asset created on the network, including stablecoins, trust-line tokens, and Multi-Purpose Tokens. XRP is not impacted by this permission issue because it is not part of the permission system of the network. There have been no reports of any exploits taking advantage of this vulnerability, and the disclosures do not mention any issuer who has experienced any unauthorised token creation.

Even though the fix was incorporated into the XRP Ledger server version 3.4.0 in September, it has not automatically affected the transaction rules of the blockchain network yet. To activate protocol amendments, it is necessary to gain approval from more than 80 percent of trusted validators for 14 days consecutively. If there are 35 validators in the tracked default set, at least 29 of them should approve the amendment.