The XRP Ledger is expected to switch on a fix around 4 November 2026 for a bug in its delegated-permissions feature. Before the fix, an account that a token issuer had allowed only to burn its tokens could, in some circumstances, mint new ones. The bug concerns tokens issued on the ledger, such as stablecoins; XRP's own supply is not affected, and no exploit has been reported.

What happened?

The XRP Ledger lets an account hand narrow permissions to another account, for example letting a payments partner burn (destroy) tokens when customers redeem them. A flaw in how one of those permissions, called PaymentBurn, was implemented meant the delegate could also create new fungible tokens (trust-line tokens or MPTs) under certain conditions.

The fix ships in an amendment named fixCleanup3_4_0. The ledger's official amendment list now carries a warning telling issuers not to delegate the PaymentBurn permission until the fix is enabled, and notes that other granular permissions are unaffected (xrpl.org, Known Amendments).

According to CoinDesk's report of 2 November, the amendment had the support of 33 of 35 tracked validators. XRP Ledger changes need more than 80% support held for two uninterrupted weeks. The fix was first due on 23 October, but support briefly dipped on 21 October, which restarted the two-week clock. The earliest activation was put at about 14:46 UTC on 4 November, if support holds. CoinDesk found no public record of the flaw being exploited.

The same package also corrects calculations in the ledger's trading pools, vaults and lending features.

Why does it matter?

Stablecoins are only as trustworthy as the rules on who can create them. A token's issuer is supposed to be the only party that can add supply; a partner that redeems tokens should only be able to remove them. This bug blurred that line for anyone who had used the new delegation feature in a particular way.

For most people sending or receiving XRP, nothing changes. For businesses that issue tokens on the XRP Ledger, or that rely on partners to redeem them, the practical steps are simple: do not grant the PaymentBurn permission until the amendment is live, and review any delegations already in place.

It is also a useful reminder of how public blockchains change. Upgrades on the XRP Ledger only take effect after validators vote for them over a sustained period, so a fix can be known and published days or weeks before it is active. Anyone building on a network should follow its official amendment or upgrade notices, not just price news.

What does this mean for CryptoMerchant users?

CryptoMerchant lists XRP on the XRP Ledger among the networks it accepts. The bug does not affect XRP itself, so XRP payments are not touched by it.

Sources

This is a news summary, not investment advice. Published by Quantumines.