XRP Ledger Activates fixCleanup3_4_0 to Shut Token-Minting Loophole After Two-Month Effort

The XRP Ledger activated the fixCleanup3_4_0 amendment on November 4 at 14:52 UTC, at ledger 108,112,129, closing a permission flaw that could have allowed accounts holding only PaymentBurn authority to create issued tokens rather than merely destroy them. The bug affected assets issued on the network, including stablecoins, but left XRP's own supply untouched, and no confirmed exploitation has been reported.

The fix required two full consecutive weeks of support from at least 80 percent of the network's trusted validators. The first attempt collapsed on October 21, twelve days into the countdown, after validator support briefly fell below the required threshold, resetting the clock. The second attempt succeeded with backing from 33 of 35 tracked validators.

The flaw was rooted in the ledger's permission delegation system, which lets an issuer authorize a third party to perform specific token operations. Under certain conditions involving payments crossing a zero balance, an account granted only the right to burn tokens could also mint new ones, a capability the issuer never intended to grant. The amendment also includes accounting corrections for planned lending and pooled-asset features, as well as fixes involving trading and transaction signing.