The XRP Ledger is set to implement a crucial update on November 4 that addresses a vulnerability allowing accounts, which are only authorized to burn tokens, to create new tokens under specific conditions. This issue affects issued tokens and stablecoins but does not impact the supply of native XRP.
Countdown Resets for Implementation
For any changes to be activated on the network, at least 29 out of 35 trusted validators must consistently support the update for two weeks. According to XRPL Dashboard data, the fixCleanup3_4_0 patch has currently garnered the backing of 33 validators. However, on October 21, support briefly dipped to 26, causing a reset of the two-week countdown as it was restored shortly thereafter.
Consequently, the activation that was initially anticipated for October 23 has been postponed. If the current support remains steady, the update is expected to become operational around 14:46 UTC on November 4, closely following the network’s voting checkpoint.
The capacity for an account, authorized solely to burn tokens, to mint new ones under certain circumstances represents a risk that requires resolution in structures where issuance and destruction rights should be clearly distinct.
Vulnerability Targets Issued Tokens
The identified vulnerability allows a token issuer to enable an account, only granted burning rights, to mint new tokens under certain conditions. For example, a stablecoin company might assign a payment service to burn tokens returned by customers in exchange for dollars. Typically, this service should not be able to reissue tokens without additional authorization. The forthcoming fix ensures this separation is mandatory.
Official network documentation advises developers not to grant token burning permissions before the fix is enforced. This caution is paramount for assets launched on the XRP Ledger.
Lending Adjustments Also in Focus
The update package not only addresses the authorization loophole but also revises calculation methods used by issuers to redeem tokens from transaction pools and corrects errors in the computation of deposits or withdrawals from shared vaults. Furthermore, it resolves an issue where loans could appear overdue or defaulted before maturity.
The fixCleanup3_4_0 package comprehensively corrects issues related to token authorization, transaction pools, vault structures, and credit calculations.
However, the lending service is not yet ready for activation. According to XRPL Dashboard, the lending change has received 19 votes, while the vault system it depends on has 21 votes. Both require 29 votes to initiate their own two-week countdown.
Should this threshold be surpassed by November 4, the lending infrastructure could potentially go live as early as November 18. Presently, closing the token authorization gap takes precedence on the network.
