Overview
- The fixCleanup3_4_0 amendment went live on Wednesday, November 4, 2026 at 14:52 UTC on ledger 108,112,129 after a continuous 14-day supermajority of trusted validators.
- The bug involved the PaymentBurn delegated permission where, under the old rules, a burn-only delegate could push a payment past zero and cause new issued tokens to appear tied to the delegating account; native XRP was not affected.
- Developers tested the scenario in a rippled commit that showed the newly created units would be the delegator’s own IOUs, and the network’s Delegate ledger entries let operators audit who held burn rights during the vulnerable window.
- No publicly confirmed exploitations have been reported, but operators, custodians and wallet providers must run compatible xrpld client upgrades to enforce the new rules and avoid risk.
- The amendment also bundles fixes for AMMs, vault accounting, permissioned DEX rules and signature handling, while proposed lending features remain inactive and require separate validator approval and client updates.