XRP Ledger is preparing to implement the PermissionDelegationV1_1 update, which may activate on October 5 at 11:18 UTC, providing businesses the ability to delegate limited powers to other accounts – for example, for making payments or approving clients – without transferring full control. A 14-day countdown began on September 21 after 29 out of 35 trusted validators in the network supported the update. To activate, support must remain at or above 80%: if the number of supporting validators falls below 28, the countdown will reset.
The main feature of the update is the separation of powers by tasks. The stablecoin issuer will be able to allow a connected compliance system to approve client accounts while keeping the keys fully under offline control. A separate operational account can be granted payment rights without obtaining powers to change keys or transfer rights to anyone else. Each delegate can receive up to 10 powers, which the main account can subsequently change or revoke.
PermissionDelegationV1_1 is the second attempt to implement this function. The first version contained a vulnerability: the system checked for permission for a transaction before verifying the signature, and part of the errors still charged the fee. This allowed an attacker to force another account to pay fees for unsigned transactions, and repeated submissions with deliberately high fees could deplete the victim's XRP balance. The vulnerability was discovered by a community tester on September 15, 2025, during testing of the function outside the main network. Validators were advised to reject the change, and it was never activated.
The corrected version is included in the server software xrpld 3.3.0. It changes the way unauthorized transactions are rejected: the fee cannot be charged until the signature is verified.
Related articles
