Overview
- The XRP Ledger activated the fixCleanup3_4_0 amendment on Wednesday, Nov. 4, at ledger 108,112,129 to change transaction rules and block the permission-delegation bug.
- The flaw involved the PaymentBurn permission, which lets a delegated account destroy an issuer’s tokens and could previously create new issued tokens when a payment crossed a zero-balance boundary.
- The vulnerability affected issued assets such as stablecoins, trust-line tokens and Multi-Purpose Tokens but did not touch the native XRP supply.
- There are no publicly confirmed reports of exploitation, and developers bundled the change with other fixes for AMM clawbacks, vault accounting and transaction signing.
- Full enforcement requires trusted validators to maintain approval and node operators, custodians and wallet software to run the compatible xrpld release before the new rules fully take effect.