XRP Ledger Activates Fix for Bug That Let Token Burners Mint Tokens
The XRP Ledger activated fixCleanup3_4_0 on November 4, closing a flaw that let accounts with PaymentBurn permission create issued tokens under certain conditions. Sources report no confirmed exploitation, and the native XRP token was outside the affected permission system.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Changed on November 4
The XRP Ledger activated the software amendment fixCleanup3_4_0 on November 4 at 14:52 UTC, at ledger 108,112,129, according to XRPLWin's amendment tracker. The amendment closes a vulnerability that allowed an account holding only the PaymentBurn permission to create issued tokens under certain conditions. CoinDesk and Crypto.news both report the fix took effect that day.
The flaw involved PaymentBurn, a delegated permission that lets an approved account destroy tokens issued by another account. An issuer could, for example, grant that permission to a payment service that destroys redeemed stablecoins without being able to create replacements. Under the previous rules, a PaymentBurn transaction that crossed a zero-balance boundary could result in issuance. The new rules reject PaymentBurn payments that cross a zero balance, which the official XRPL release notes describe as separating token destruction from issuance.
Scope of the Vulnerability
The affected assets include stablecoins, trust-line tokens and Multi-Purpose Tokens issued on the network. The sources agree that XRP, the native cryptocurrency, was not affected because it sits outside the permission system involved. Crypto.news reports that no publicly confirmed exploitation has been disclosed and that the available material does not identify any issuer that suffered unauthorized token creation.
The sources differ on framing. CoinDesk describes the bug as one that let approved token burners create new tokens, while Crypto.news characterizes it as a potential unauthorized minting vulnerability. Both descriptions point to the same mechanism. The difference is one of emphasis: CoinDesk's wording reflects the permission holder's role, and Crypto.news's wording reflects the outcome for issuers.
Why the Activation Took Weeks
The fix was included in XRP Ledger server version 3.4.0 in September, but the release did not change network rules until validators activated it. Amendments require support from more than 80% of trusted validators for 14 consecutive days. With 35 validators on the tracked default list, at least 29 must support an amendment throughout that period.
The first approval window began October 9 and was expected to activate around October 23. Validator support fell below the threshold on October 21, after 12 days and three hours, and the countdown reset. A new majority formed later that day, and the second 14-day window ran for 14 days and five minutes before activation. Because the process requires uninterrupted support, a brief dip can delay an upgrade. The episode is a reminder that the network's governance timing is strict.
Related Corrections in the Same Amendment
The amendment also corrects several other transaction functions. Changes to automated market maker clawbacks prevent a transaction from destroying a liquidity provider's tokens when rounding would leave the issuer recovering no underlying assets. Permissioned trading rules were corrected so that accounts cannot receive certain tokens through offers when issuer restrictions should block them. Additional changes address escrow reserves and other areas.
Crypto.news has previously covered the token-minting flaw, including a November 2 report published while the amendment was still awaiting activation.
Why It Matters
For Traders
Issued tokens such as stablecoins on the XRP Ledger no longer carry the minting risk as of November 4, and no exploitation has been reported that would affect prices.
For Investors
The episode shows the XRP Ledger's amendment process can close protocol-level flaws, though its strict 80% validator threshold also delays fixes that are already written.
For Builders
Teams relying on PaymentBurn for redemption flows should confirm their logic against the new rule rejecting payments that cross a zero balance.
This article is for information only and is not financial advice. Read the full disclaimer.
