XRP Ledger set to fix flaw that could let stablecoin partners print new tokens

The XRP Ledger is on track to fix a loophole Wednesday that can let accounts create tokens they were only authorized to destroy, coming after a brief drop in validator support delayed the update by nearly two weeks.

The bug can let an account authorized only to destroy an issuer’s tokens create new ones under certain conditions.

A stablecoin company, for example, could have let a payments service destroy tokens when customers exchange them for dollars. That service should need separate permission to issue more, and this fix enforces that separation.

The network’s official documentation currently warns developers against granting the token-burning permission until the correction takes effect. The problem concerns tokens issued on the ledger, including stablecoins. XRP’s own supply is unaffected by this permission bug.

The update, called fixCleanup3_4_0, has support from 33 of 35 trusted validators tracked by XRPL Dashboard. Validators are the independent operators whose computers check transactions and agree on the network’s history.

Changes to transaction rules need more than 80% support for two uninterrupted weeks. With 35 validators in the tracker’s count, that means 29 must keep backing the change.

The fix was originally expected on Oct. 23. Support fell to 26 on Oct. 21 and recovered about two hours later, restarting the countdown, as CoinDesk reported.

That puts the earliest activation window around 14:46 UTC on Nov. 4, provided support holds. The actual switch follows a network voting checkpoint.

The package also corrects calculations used when issuers recover tokens from trading pools and when users deposit or withdraw from vaults that pool assets. Another correction keeps a loan from being marked late or in default before its due date has passed.

Those lending repairs will arrive ahead of the lending service itself. Its main amendment still has 19 votes, while the vault system it depends on has 21, according to XRPL Dashboard.

Both need 29 to begin their own two-week countdowns. Reaching that threshold on Wednesday would put lending’s earliest possible activation on Nov. 18.