The XRP Ledger, a blockchain-based payment and asset issuance network, is preparing to activate a much-anticipated fix on November 4 to close a loophole that could allow certain accounts to mint new issued tokens when they should be limited to destroying them. The XRP cryptocurrency itself will remain unaffected by this update, and its supply will not change as a result of the fix.
Validator support and activation timeline
The protocol upgrade, named fixCleanup3_4_0, has drawn support from 33 out of 35 trusted validators monitored by the XRPL Dashboard. Validators are independent network participants that verify transactions and help maintain consensus across the ledger.
For any major change to transaction rules to be implemented on the XRP Ledger, at least 80% of validators must provide uninterrupted support for two consecutive weeks. With 35 validators in the current count, a minimum of 29 is required to consistently back the amendment.
Originally, developers anticipated the fix would go live by October 23, but validator support fell to 26 on October 21. Although backing returned to required levels within two hours, the drop reset the two-week activation countdown, delaying the earliest possible activation to 14:46 UTC on November 4.
The fix is now on track for Wednesday, subject to validator support holding steady through the activation checkpoint. This timeline is crucial for ecosystem participants who issue or manage tokens on the network, especially stablecoins.
Loophole details and impact
The bug impacted issued tokens, a category that includes stablecoins, but not native XRP. Under certain circumstances, an account that should only have the authority to burn (destroy) tokens could exploit the loophole to create new tokens as well.
For example, a stablecoin issuer might allow a payments processor to burn tokens when customers redeem them for cash. However, that processor should not have the power to generate additional tokens, and the fix enforces this separation of duties.
Network documentation continues to warn developers against assigning this burning permission before the fix takes effect. The update strengthens the security of issued tokens and reduces operational risks for businesses building on the XRP Ledger.
Mini dictionary: Validators are independent node operators on blockchain networks who participate in transaction verification and consensus, helping to secure and maintain the distributed ledger’s integrity.
Additional ledger improvements
Besides fixing the token authority loophole, the upgrade addresses several calculation errors found in trading pools, vaults, and lending modules. These repairs include improving issuer token recovery from liquidity pools and ensuring accurate deposit and withdrawal processing from vaults.
For lending, the update will stop loans from being flagged as late or in default until after their due dates. However, the full launch of lending services and their supporting vault system requires separate amendments, which are still pending sufficient validator support.
According to XRPL Dashboard, the main lending amendment currently has 19 validator votes, while the vault system stands at 21 votes. Both need at least 29 continuous votes over two weeks to be activated. If support reaches the threshold on November 4, the earliest possible launch for lending functionality would be November 18.
| Feature/Upgrade | Current Validator Support | Votes Required | Earliest Activation |
|---|---|---|---|
| fixCleanup3_4_0 (token authority fix) | 33 | 29 | Nov. 4 |
| Lending amendment | 19 | 29 | Nov. 18* |
| Vault system | 21 | 29 | Nov. 18* |
*Subject to reaching required validator votes and completing the two-week support period.
XRP Ledger and security
The XRP Ledger, launched by Ripple Labs in 2012, serves as a decentralized platform for fast cross-border payments and asset issuance. Its ongoing upgrades aim to bolster network reliability and safeguard both users and ecosystem partners. This latest update is part of a broader effort to enhance security and operational clarity for token issuers and developers.
Developers and issuers are advised to monitor validator support as the fix approaches activation, as maintaining compliance with permission standards is critical for preventing unauthorized token creation.
