XRP Ledger set to fix flaw that could let stablecoin partners print new tokens

XRPL's amendment system lets validators vote in new rules, with activation requiring roughly 80% support sustained for fourteen days. PaymentBurn belongs to a delegation feature that lets issuers hand limited authority to third parties, separating the right to destroy tokens from the right to create them. The flaw under fixCleanup3_4_0 blurs that separation: in some conditions, an account cleared only to burn tokens can also mint trust line tokens or MPTs it was never meant to issue.

Once fixCleanup3_4_0 activates, burn-only delegates lose any residual ability to mint, closing a path that stablecoin issuers and custodians using XRPL's delegation model would otherwise need to police manually. With 33 of 35 trusted validators already backing it, token issuers gain assurance that a narrowly scoped permission stays narrow, while anyone who built workarounds or monitoring around the bug's existence can retire that extra layer once the fix is live.

The episode tests how much trust a 'permissioned delegation' model deserves when partners increasingly issue stablecoins directly on XRPL rather than through separate custodial rails. Splitting mint and burn authority is meant to limit blast radius if a delegated key is compromised; a bug letting burn rights quietly become mint rights undercuts that promise. It is a reminder that fine-grained permission systems are only as reliable as the code enforcing the boundaries between them. (per coindesk.com)

Activation is projected for November 4, contingent on validator support holding above the 80% threshold for the required fourteen-day window. Support already dipped below that line on October 21, resetting an earlier October 23 target, so a repeat dip would push the date again rather than cancel the fix outright. The number to track is the trusted-validator count, currently 33 of 35, in the days leading into November 4.