The XRP Ledger is expected to enable the fixCleanup3_4_0 amendment at about 14:46 UTC on Nov. 4, a change aimed at closing a permission delegation loophole tied to token burning. The issue allowed some accounts with burn-only authority to create new fungible tokens under certain conditions.

The amendment now has backing from 33 of 35 validators, according to the XRPL amendment tracker cited in the source report. That is above the 80% support level required for activation after a two-week holding period.

Bug affected delegated PaymentBurn authority

The problem is linked to permission delegation, a feature that lets one XRPL account assign limited powers to another account without handing over private keys. That feature was introduced on Oct. 8 through the PermissionDelegationV1_1 amendment.

One of the available granular permissions is PaymentBurn, which is intended to allow a delegate to destroy tokens. However, XRPL documentation warned that before fixCleanup3_4_0 is activated, a delegate with PaymentBurn could also mint new fungible tokens in some cases, including with trust line tokens or multi-purpose tokens in certain circumstances.

The recommendation before activation was not to delegate PaymentBurn. Other delegated permissions were described as unaffected.

What xrpld 3.4.0 changes

The fix is included in xrpld 3.4.0. In the release notes, the update is presented as a cleanup package for the 3.4.0 release, including a change that rejects PaymentBurn payments that cross a zero balance.

The same software release also includes other adjustments affecting automated market maker clawbacks, vault accounting, escrow reserves and signature handling. Node operators were advised to upgrade as soon as possible.

Activation was previously expected in October

The amendment had originally been on course to go live on Oct. 23 at about 09:34 UTC. That did not happen because XRPL amendments activate only after they maintain at least 80% support from trusted validators for two consecutive weeks, and any drop to 80% or below resets the countdown.

Support has since recovered. The latest figures cited from Xrpscan show 33 validators in favor out of 35, comfortably above the 28 votes needed.

Other upgrades remain below the threshold

Several other proposed XRPL amendments are still short of the support required to begin their own activation countdowns. The tracker shows LendingProtocolV1_1 with 19 votes, the original LendingProtocol amendment with 19, and SingleAssetVault with 21.

Those proposals are tied to bringing native lending functions to the XRP Ledger, but for now they remain on hold.

Why this matters and what comes next

The fix arrives after a difficult stretch for XRPL security disclosures. Last month, developers said a separate, decade-old ledger bug could have allowed an attacker to mint XRP beyond the asset’s fixed supply, though that issue was patched quietly in September and there was no evidence it had been exploited. The recent Binance hack also first impacted XRP, although that attack targeted Binance wallets rather than the XRPL itself.

For ordinary XRP holders, the PaymentBurn fix does not change routine use of the network. The practical impact is on issuers, exchanges and businesses that rely on delegated account permissions. If activation proceeds as expected on Nov. 4, PaymentBurn should be safe to delegate again.

Source: news.bitcoin.com