The XRP Ledger activated its fixCleanup3_4_0 amendment on Wednesday, with the change going live at 14:52 UTC at ledger 108,112,129, according to XRPLWin, an XRP Ledger explorer. The activation came after two consecutive weeks of validator support, following an earlier attempt that was interrupted in October.

The amendment closes a flaw in the ledger's permission delegation system that, under certain conditions, could have allowed an account authorized to destroy tokens to create new ones as well.

Fix Separates Token Burning From Token Issuance

The vulnerability centered on the network's permission delegation system, a mechanism that allows one account to authorize another to carry out specific operations without transferring full control of the account.

In a typical arrangement, a stablecoin issuer could grant a payment processor permission to destroy tokens when customers redeem them for dollars, while withholding the authority to issue additional tokens.

Under certain conditions, however, the rules in place before the fix could allow an account with permission to burn tokens to mint new ones as well. The fixCleanup3_4_0 amendment addresses the loophole by enforcing a strict separation between token destruction and token creation permissions. For issuers that delegate operations this way, the change keeps redemption-related burn authority from spilling over into issuance under the edge cases the old rules left open.

The flaw affected assets issued on the XRP Ledger, including stablecoins, rather than the XRP cryptocurrency itself. There have been no publicly confirmed cases of the vulnerability being exploited, which makes this a preventive fix rather than a response to a known incident.

Update Also Includes Lending and Vault Accounting Corrections

Beyond the permission-related vulnerability, the software release introduces accounting corrections for the network's planned lending system and Single Asset Vaults. These vaults are designed to let users deposit assets into pools that can be used to support loans.

The changes include adjustments to the calculations used for vault deposits and withdrawals, as well as corrections to how loans are classified when borrowers fall behind on payments.

Additional fixes in the release address token recovery from automated trading pools, permissioned trading, and transaction signing. With the lending system still in the planning stage, its eventual rollout would face the same validator approval thresholds described below.

Validator Support Delayed Amendment Activation

The amendment's rollout was delayed by the XRP Ledger's governance process. Network changes require approval from more than 80% of trusted validators, and that level of support must be maintained for 14 consecutive days.

After an earlier activation attempt was interrupted in October, the latest effort secured the required uninterrupted validator support, allowing fixCleanup3_4_0 to go live on Wednesday. Because the threshold counts only consecutive support, the October interruption broke the streak, meaning a fresh 14-day window had to accumulate before the amendment could take effect.

Source: CoinDesk