XRP Ledger Fix for Token-Minting Flaw Is Due to Activate Wednesday

A permission meant only to burn tokens on the XRP Ledger can also be used to create new ones. The fix, an amendment called fixCleanup3_4_0, is due to switch on tomorrow, Wednesday 4 November, at about 14:46 UTC, as long as validator support holds until then.

If you hold tokens issued on XRPL, here is what matters. The problem sits in permission delegation, the feature that lets an account hand another account the right to send certain transactions on its behalf.

A Burn Permission That Can Also Mint

One of those delegated rights is called PaymentBurn. The XRPL permission values documentation describes it as the right to send payments that burn fungible tokens or MPTs, "but not past a zero balance." Minting is supposed to be a separate permission, PaymentMint.

The same page carries a warning. Until fixCleanup3_4_0 is enabled, "a delegate with the PaymentBurn granular permission can also mint new fungible tokens (trust line tokens or MPTs) in certain circumstances." Trust line tokens and MPTs are formats issuers use to create their own assets on the ledger.

The documentation recommends not delegating PaymentBurn until the fix is live. It says other granular permissions are unaffected.

Why an Issuer Cannot Narrow the Risk

There is no way to limit the exposure to one token. The documentation says the set of granular permissions is hard-coded, with no custom configurations, and gives the example that "you cannot add permissions based on specific currencies."

So an issuer that handed PaymentBurn to a partner was handing over the permission as written, with this flaw attached.

It is not known whether any issuer actually delegated PaymentBurn, or whether anyone used the flaw to create tokens. No issuer has been identified as affected.

Validators Back the Fix Ahead of Wednesday

Amendments on XRPL activate only after more than 80% of trusted validators support them for 14 days in a row. fixCleanup3_4_0 has the support of 33 of the 35 trusted validators, or 94.3%.

It crossed that threshold on 21 October. If support stays above 80% through the waiting period, activation lands on 4 November at about 14:46 UTC. If it dips below before then, the 14-day count starts again.

The activation has not happened yet. Until it does, the documentation's advice on PaymentBurn stands.

This is a separate issue from an earlier XRP Ledger bug that could have minted 18 trillion XRP. The current flaw concerns tokens issued on the ledger through delegated permissions, and the fix for it is the next amendment in line.