XRP Ledger Set to Fi...

XRP Ledger Set to Fix Token Creation Loophole After Two-Week Delay

By José Oramas November 03, 2026 In Tokenisation, XRPL

The fixCleanup3_4_0 amendment had the backing of 33 of the XRP Ledger’s 35 trusted validators on Monday and is due to activate on 4 November.
It closes a flaw that could let an account delegated only to burn tokens mint new trust line tokens or MPTs instead.
Activation was first set for 23 October, but support fell to 80% or below two days earlier and restarted the count.

XRP Ledger validators are set to activate a fix on Wednesday for a flaw that could let accounts allowed only to burn tokens create new ones.

The amendment, fixCleanup3_4_0, had the backing of 33 of the network’s 35 trusted validators on Monday, according to XRPScan data. That backing, if it holds, puts activation in the afternoon UTC, early on Thursday in Australia.

The flaw sits in permission delegation. That feature lets an account hand specific powers to another account, including the right to send certain payments on its behalf. Its current version went live on the XRP Ledger on 8 October. It replaced an earlier version that was disabled in xrpld 2.6.1 over a critical bug.

One of those powers, PaymentBurn, covers payments that send a token back to its issuer, removing it from circulation. A separate permission, PaymentMint, covers payments from the issuer that create new tokens.

“Before the fix, a delegate with the PaymentBurn granular permission can also mint new fungible tokens (trust line tokens or MPTs) in certain circumstances,” the XRP Ledger’s developer documentation states.

Trust line tokens include stablecoins such as Ripple’s RLUSD, which Coinbase added across its platforms in October.

The fix rejects a burn-only payment that would cross a zero balance and turn into a mint, unless the delegate also holds PaymentMint. Other delegated permissions are unaffected, the documentation notes. Until the fix is live, it advises against delegating PaymentBurn at all. That warning went up on 28 September.

A Ripple engineer committed the code on 14 September. It shipped in xrpld 3.4.0, the ledger’s server software, on 17 September. The same amendment carries fixes for the ledger’s automated market makers, lending protocol, NFTs and escrow.

Validator Dip Reset Clock

XRP Ledger amendments need support from more than 80% of trusted validators for two weeks before they activate. That two-week count restarts if support drops to 80% or below.

The fix first cleared that bar at 9:34 a.m. UTC on 9 October, which put its activation on 23 October. Ledger records show it lost that majority at 12:41 p.m. UTC on 21 October.

Support returned at 2:46 p.m. UTC the same day. That restarted the clock, putting activation at about the same time on 4 November.

The xrpld software ships the fix with a default vote of no, so each validator operator has to opt in to support it.

The amendment is separate from a payment-engine bug that could have created XRP from nothing. That bug was disclosed on 9 October and patched in xrpld 3.4.1.