XRPL revoked its Permission Delegation amendment after a serious vulnerability was discovered during testing. This decision came after a bug bounty report identified a security threat in a feature that allows one account to grant certain action rights to another account. Key information was provided by RippleX Head of Engineering Jay Ayo Akinyele, who emphasized that the original V1.0 implementation was revoked following a bug report submitted through the bug bounty program. Rather than patching that version, the team introduced a new V1.1, delivering additional security and separating the old implementation from the improved solution.
As reported by a researcher under the alias Shotes, the vulnerability involved so-called "irrevocable" delegated permissions: a delegate could delete their account and recreate it while retaining all privileges granted by another account. The fixes in V1.1 address not only this vulnerability but also edge cases such as delegate identity, prevention of unintended delegation of new capabilities (Vault and Lending), improved handling of reserve payments, and restrictions for multi-signature. An overflow of medium severity in isDelegable was also resolved.
All identified issues have been resolved in V1.1 and confirmed by the Cantina team; the QA team reported no regressions after 5,088 tests and declared the feature ready for use.
The testing report published on August 26 contained 179 permission delegation tests: 112 functional checks, 48 attack resilience tests, and 19 cross-tests covering interactions with batch transactions, Confidential Multi-Purpose Tokens (Confidential MPT), the transaction queue, and multi-signature.
Permission Delegation was introduced in May 2025, marked as unsupported in September 2025 pending vulnerability resolution, renamed PermissionDelegationV1_1 in October, and reinstated in June 2026. The XLS-75 functionality itself has not changed — the conditions for its activation have been improved, which will ensure greater security for users and custodial providers.