XRPL has withdrawn the original implementation of its Permission Delegation amendment after a bug bounty report identified a high-severity flaw before the feature reached mainnet. A hardened replacement, PermissionDelegationV1_1, has since completed security review and quality assurance checks.

Permission Delegation, also known as XLS-75, is designed to let one account grant another account limited powers on its behalf without handing over full control. The latest review suggests the feature’s intended scope remains the same, but the conditions and safeguards around how delegation works have been tightened.

Why V1.0 was pulled

RippleX head of engineering J. Ayo Akinyele said the original V1.0 implementation was removed after a vulnerability was reported through XRPL’s bug bounty program during testing. Rather than modifying that version in place, the team created V1.1 as a separate release to distinguish the initial implementation from the hardened one.

The most serious issue was reported by a researcher known as Shotes. According to the review, a delegate holding irrevocable permissions could delete its account and later recreate it while retaining those permissions, leaving the original account unable to revoke them. The flaw was classified as high severity.

Broader fixes in the hardened version

The changes in V1.1 extend beyond that single bug. The revised implementation addresses edge cases tied to delegate identity and prevents newer features, including Vault and Lending operations, from being delegated unintentionally.

It also corrects reserve accounting for delegated payments and closes a multi-signing path that could bypass delegation checks. Revocation behavior was tightened as part of the update as well.

Reviewers also identified a medium-severity unsigned integer overflow in isDelegable. That issue could cause a malformed permission value to be read as a delegable transaction type, although researchers said it had no meaningful impact without misbehavior by the delegator.

Testing and security review results

A QA report published by Ramkumar SG on August 26 logged 179 tests focused on Permission Delegation. Those included 112 functional tests, 48 adversarial security tests, and 19 cross-feature tests.

The testing also examined how delegation interacted with Batch, Confidential MPT, the transaction queue, and multi-signing. XRPL Operations said all findings were fixed in V1.1 and verified by security firm Cantina.

QA additionally reported no regressions across 5,088 tests and said there were no open internal bugs rated critical. Based on the tested commit level, the team concluded the feature was ready for production use.

Timeline and what stays the same

Permission Delegation was first introduced in May 2025. It was marked unsupported in September 2025 while the security fix was pending, renamed PermissionDelegationV1_1 in October, and returned to supported status in June 2026.

Akinyele said V1.1 does not change what XLS-75 is meant to do for users or custody providers. Instead, the update changes the safeguards that determine when and how that capability can be activated, with the latest confirmed step being completion of security review and QA for the hardened release.

Source: cryptopotato.com