XRP Ledger Patches Vulnerability in Token Minting Permissions

The security flaw centered on the PaymentBurn function, a delegated permission allowing approved accounts to destroy tokens issued by third parties. Under specific circumstances, particularly when transactions crossed a zero-balance boundary, the network's previous rules could have enabled an account to mint new assets despite lacking the proper authorization. The new amendment enforces strict separation between token destruction and issuance, effectively blocking these transactions from crossing the boundary.

Activation of the fix required a sustained 14-day period of support from over 80% of the network’s 35 trusted validators. While initially slated for late October, the process faced a temporary setback on October 21 when validator support dipped below the mandatory threshold. This interruption forced a restart of the approval countdown, delaying the final implementation until early November. No evidence suggests that malicious actors exploited this vulnerability prior to the patch.

Beyond the primary security fix, the update refines several core functions, including automated market maker clawbacks, escrow reserves, and transaction signing procedures. Notably, the amendment introduces distinct signing prefixes to prevent the reuse of authorizations across different transaction roles. While the update includes accounting adjustments for proposed vault systems, the much-anticipated XRP Ledger lending protocol remains inactive, pending separate validator approval and distinct amendment cycles.