XRP Ledger Upgrade Restores Features Previously Pulled Over Critical Security Bugs

The XRP Ledger's upcoming xrpld 3.3.0 release, expected next week, will present validators with five proposed amendments—two of which are revised versions of features previously withdrawn after security researchers discovered critical vulnerabilities.

Jazzi Cooper, head of product at RippleX, announced the release on Friday, confirming that xrpld 3.3.0 will carry five amendments: Confidential MPT, Batch, Permission Delegation, Sponsored Fees and Reserves, and Dynamic MPT.

XRPL has already proven it can support tokenized assets at scale. Now it's time to put these assets to use: global transfers, trading, collateralizing, and settling. The upcoming release of xrpld 3.3.0 includes five amendments that move XRPL significantly closer to that goal.… — Jazzi Cooper (@jazzicoop) July 31, 2026

Source: https://x.com/jazzicoop/status/2083188623911100797

Amendment Approval Process

Amendments on the XRP Ledger are proposed protocol changes that require at least 80% of trusted validators to support them for two consecutive weeks before they take effect. This threshold is designed so that the network—rather than Ripple—determines which features ship. The two vetoed amendments that are now returning, Batch and Permission Delegation, illustrate that this safety mechanism has functioned as intended: serious bugs were caught and blocked before reaching the production network.

Returning Features with Fixed Flaws

Both Batch and Permission Delegation have previously gone through this approval process and failed.

Batch enables up to eight transactions across different accounts to execute atomically—meaning either all succeed or none do. It reached the voting phase in February, but security researcher Pranamya Keshkamat and the firm Cantina discovered a flaw in how the amendment validated signatures. The vulnerability would have allowed an attacker to execute transactions from any account without holding its private keys. Validators were advised to reject it, and an emergency server release marked it as unsupported to prevent activation. No funds were lost because the amendment never reached the main network. Details are documented in the vulnerability disclosure report.

Permission Delegation, which allows institutions to grant another account narrowly scoped authority without surrendering full signing power, was disclosed as vulnerable in September 2025 and subsequently disabled. The bug permitted one account to charge transaction fees to another account, potentially draining its balance.

The XRP Ledger's documentation has listed both amendments as obsolete, pending replacement by revised versions.

Three New Amendments

The remaining three amendments are new additions:

• Confidential MPT combines zero-knowledge proofs with elliptic-curve encryption, keeping balances and transfer amounts on Multi-Purpose Tokens private while still allowing auditors or regulators to verify them when required. Selective disclosure of this kind has become a baseline expectation for institutional tokenization use cases, where compliance obligations often demand that transaction details remain confidential to the public but accessible to authorized parties.

• Sponsored Fees and Reserves enables a bank or platform to cover another account's XRP transaction fees and reserve requirements, removing the need for every user to acquire XRP before transacting. This addresses a long-standing UX friction point for platforms onboarding users who may not hold XRP, aligning XRPL with how regulated financial intermediaries typically operate.

• Dynamic MPT allows an issuer to specify at token creation which properties can be changed later, eliminating the need for a full migration to a new token when fees or metadata require updating.

Current Validator Landscape

The release marks a notable shift from where the ledger stood two weeks earlier. In mid-July, all five amendments were still listed in development on the XRP Ledger's amendment tracker, and the amendments available for validator voting were bug-fix bundles covering the lending protocol, single-asset vaults, the permissioned exchange, and multi-purpose tokens.

Approval is not guaranteed. The lending protocol and single-asset vault amendments have each attracted roughly a third of validator support, well below the 80% threshold required. Additionally, Batch has already been voted down once before. The outcome of the upcoming votes will determine how quickly XRPL's institutional DeFi feature set matures relative to other blockchains pursuing similar tokenization and compliance infrastructure.