<h2 id="tldr">TLDR</h2>
<ul>
 <li>XRP Ledger activated the fixCleanup3_4_0 amendment on November 4 at 14:52 UTC, at ledger 108,112,129.</li>
 <li>The fix stops accounts with burn-only permission from creating new issued tokens, including stablecoins.</li>
 <li>XRP itself was not part of the affected permission system, and no exploitation has been publicly reported.</li>
 <li>A dip in validator support on October 21 restarted the 14-day approval clock and pushed activation into November.</li>
 <li>The update also fixes trading, signing and vault rules, but the lending protocol still needs its own vote.</li>
</ul>
The XRP Ledger activated a software amendment on November 4 that closes a flaw tied to issued tokens. T<a href="https://xrplwin.com/amendment/fixCleanup3_4_0" rel="noopener noreferrer nofollow">he fix, called fixCleanup3_4_0,</a> went live at 14:52 UTC at ledger 108,112,129, according to the XRPLWin amendment tracker.
The update reached the network almost two weeks later than first expected. A short drop in validator support in October forced the approval clock to start over.
The flaw sat inside the ledger’s permission delegation system. This system lets account holders allow other accounts to carry out specific transactions without giving up full control.
The problem involved a permission called PaymentBurn, which lets an approved account destroy tokens issued by another account. An issuer might give this permission to a payment service that handles stablecoin redemptions.
Under the old rules, an account holding only PaymentBurn rights could create issued tokens under certain conditions. This happened when payments using the permission crossed a zero-balance boundary.
The new amendment blocks those transactions from crossing that boundary.<a href="https://xrpl.org/blog/2026/xrpld-3.4.0" rel="noopener noreferrer nofollow"> The official XRPL release</a> notes say the change rejects “PaymentBurn payments that cross a zero balance.”
The flaw affected assets issued on the network, such as stablecoins, trust-line tokens and Multi-Purpose Tokens. XRP, the network’s native cryptocurrency, was not part of the affected permission system.
No confirmed exploitation of the flaw has been publicly reported. Available disclosures do not name any issuer that suffered unauthorized token creation.
<h2 id="how-a-missed-vote-delayed-the-fix">How a Missed Vote Delayed the Fix</h2>
Developers added the correction to XRP Ledger server version 3.4.0 in September. However, a software release alone does not change the network’s transaction rules.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;">WOW… <a href="https://x.com/search?q=%24XRP&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$XRP</a> Ledger OFFICIALLY FIXES a Bug That Could Let Someone CREATE Tokens They Were Only Allowed to BURN <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f92f.png" alt="🤯" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f525.png" alt="🔥" style="height: 1em; max-height: 1em;">
 Imagine a stablecoin company allows another account to DESTROY tokens when customers cash out. <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f440.png" alt="👀" style="height: 1em; max-height: 1em;"><a href="https://t.co/DqbxiCjTOT" rel="noopener noreferrer nofollow">pic.twitter.com/DqbxiCjTOT</a>
 — ChardSartin (@ChardSartin_com) <a href="https://x.com/ChardSartin_com/status/2118550803724046640?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 6, 2026</a>
 </blockquote>
</div>
Amendments need support from more than 80% of trusted validators for 14 days in a row. With 35 validators on the tracked default list, at least 29 must back an amendment for the full period.
The first approval window opened on October 9, which put activation on track for around October 23. Support fell below the threshold on October 21, ending that attempt after 12 days and three hours.
A new majority formed later that same day, starting a fresh two-week countdown. The second attempt lasted 14 days and five minutes before the amendment went live.
<h2 id="other-changes-in-the-update">Other Changes in the Update</h2>
The amendment also fixes several other transaction functions. One change stops automated market maker clawbacks from destroying a liquidity provider’s tokens when rounding would leave the issuer recovering no underlying assets.
Developers corrected permissioned trading rules so accounts cannot receive certain tokens through offers when issuer limits should block them. Other changes cover escrow reserves, Multi-Purpose Token authorization and transaction signatures.
Some signing steps had used overlapping authorization structures. The update adds distinct signing prefixes so a signature meant for one transaction role cannot be reused in another.
The release also includes accounting fixes for Single Asset Vaults and the proposed XRP Ledger lending protocol. These cover deposits, withdrawals, recoverable assets, overdue payments and how impaired loans affect vault records.
The maintenance amendment does not switch on the lending features themselves. Ripple has backed the lending amendments, which would let loan brokers arrange fixed-term loans using assets deposited into vaults.
A further amendment, LendingProtocolV1_1, proposes closed-ended vaults with subscription, investment and redemption periods. Each lending amendment must pass the same validator approval process before it can run on mainnet.
The post <a href="https://blockonomi.com/xrp-ledger-patches-burn-permission-bug-that-could-create-new-stablecoins/" rel="noopener noreferrer nofollow">XRP Ledger Patches Burn Permission Bug That Could Create New Stablecoins</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

XRP Ledger Patches Burn Permission Bug That Could Create New Stablecoins

Table of Contents

Blockonomi

Other articles published on Nov 6, 2026

Join our free newsletter for daily crypto updates!