The XRP Ledger is on track to activate a fix on Wednesday for a bug that can let accounts authorized only to destroy tokens create new ones. XRP's own supply is unaffected. The update has support from 33 of 35 trusted validators.
The XRP Ledger is on track to fix a loophole Wednesday that can let accounts create tokens they were only authorized to destroy. A brief drop in validator support delayed the update by nearly two weeks.
What the bug allows
Under certain conditions, an account authorized only to destroy an issuer's tokens can create new ones. A stablecoin company, for example, could let a payments service destroy tokens when customers exchange them for dollars. That service should need separate permission to issue more, and the fix enforces that separation.
The network's official documentation warns developers against granting the token-burning permission until the correction takes effect. The problem concerns tokens issued on the ledger, including stablecoins, not XRP.
According to The Defiant, the code change rejects a burn-only payment that exceeds the balance being redeemed. Without that check, the payment can cross zero and begin issuing tokens instead.
Why activation slipped
The update, called fixCleanup3_4_0, has support from 33 of 35 trusted validators tracked by XRPL Dashboard. Validators are the independent operators whose computers check transactions and agree on the network's history.
Changes to transaction rules need more than 80% support for two uninterrupted weeks. With 35 validators in the tracker's count, 29 must keep backing the change.
However, the fix was originally expected on Oct. 23. Support fell to 26 on Oct. 21 and recovered about two hours later, which restarted the countdown. The earliest activation window is around 14:46 UTC on Nov. 4, provided support holds.
Lending repairs arrive first
The package also corrects calculations used when issuers recover tokens from trading pools and when users deposit or withdraw from vaults that pool assets. Another correction keeps a loan from being marked late or in default before its due date has passed.
Those repairs will land ahead of the lending service itself. Its main amendment still has 19 votes, while the vault system it depends on has 21, according to XRPL Dashboard. Both need 29 to begin their own two-week countdowns.
Sources: CoinDesk, The Defiant
Trading involves risk.
Risk Disclaimer
