XRP Ledger Activated Update to Fix Token Creation Vulnerability

On November 4, 2026, the XRP Ledger network activated the fixCleanup3_4_0 patch, closing a vulnerability related to handling issued tokens. Under certain conditions, the flaw allowed an account with the right to destroy such assets to create new units without proper authorization. The issue did not affect the issuance of XRP, the network's native cryptocurrency.

The change took effect at 14:52 UTC in ledger number 108,112,129. It pertains to the delegation of authority system: an owner can authorize another account to perform specific operations without granting full control. For example, a stablecoin issuer may allow a payment operator to redeem tokens for fiat currency but not issue new ones.

The vulnerability affected the PaymentBurn permission. When a payment with such authority resulted in a balance crossing zero, previous rules could allow token creation. After the update, such transactions are rejected. The fix applies to issued assets, including stablecoins and multi-purpose tokens (MPT). There are no publicly confirmed cases of the flaw being used to issue tokens.

The update was included in the server version xrpld 3.4.0 back in September, but changing network rules requires separate validator approval. Support must exceed 80% for 14 consecutive days. With 35 trusted validators, at least 29 votes are needed. On October 21, the number of supporters temporarily dropped to 26, so the count restarted. The repeat period concluded on November 4.

Other fixes do not trigger lending

The fixCleanup3_4_0 package also adjusts rules for operations in liquidity pools and trading orders, reserve accounting, and signature verification. Specifically, it eliminates a situation where due to rounding, a liquidity provider could have tokens destroyed without returning the underlying assets. Separate changes prohibit the reuse of a signature intended for one role in another role during an operation.

There are also changes in calculations for single-type asset vaults and the future XRP Ledger lending system. They concern deposits and withdrawals, asset accounting, and the status of overdue loans. However, lending itself did not activate after the fixCleanup3_4_0 activation: the SingleAssetVault, LendingProtocol, and LendingProtocolV1_1 functions must undergo separate voting. The launch dates for these are not yet determined.