XRP Ledger Fixes Bug That Allowed Unauthorized Token Creation

XRP Ledger closes loophole for unauthorized token creation

The XRP Ledger, a decentralized blockchain network, activated a software fix on Wednesday to close a security loophole. The bug previously allowed certain accounts to create new tokens without proper authorization. This fix ensures that accounts only permitted to destroy tokens cannot also create them under specific conditions.

The flaw specifically impacted assets issued on the network, such as stablecoins. A stablecoin is a digital token designed to maintain a steady value, usually by being tied to a currency like the U.S. dollar. XRP, the native cryptocurrency of the ledger, was not affected by this vulnerability.

Important highlights of the software update

• The update prevents accounts with limited permissions from minting new tokens.
• There have been no publicly confirmed cases of this flaw being exploited by hackers.
• The release includes accounting fixes for the network's upcoming lending features.
• The fix required 14 days of continuous support from over 80% of the network's validators.

Technical details of the software release

The software update, known as fixCleanup3_4_0, addresses a flaw in the network's permission delegation system. This system allows an owner to let another account perform specific tasks. For example, a stablecoin issuer might let a partner destroy tokens when a customer cashes out, but they would not want that partner to have the power to create new ones.

The update also corrects accounting rules for Single Asset Vaults and the network's planned lending system. These features are designed to let users deposit assets into pools to support loans. The fixes involve how deposits, withdrawals, and overdue loan payments are calculated. Other corrections in the release cover token recovery from trading pools and how transactions are signed.

Network activation and voting results

The fix went live on Wednesday at 14:52 UTC at ledger 108,112,129. Its activation followed a successful two-week voting period by the network's trusted validators. Validators are independent participants who verify and agree on transactions to keep the ledger secure.

An earlier attempt to activate the fix in October was interrupted when validator support fell below the required levels. This recent activation followed 14 consecutive days of support from more than 80% of the network's trusted validators, satisfying the ledger's rules for making changes.

Protecting issuers and stablecoins

This update is important for organizations that issue their own tokens on the XRP Ledger. It ensures a strict separation between the power to create tokens and the power to destroy them. By fixing this loophole, the network protects the integrity of stablecoins and other assets, ensuring that their supply cannot be increased by accounts that were only meant to manage token redemptions.

Sources

• CoinDesk
• XRPLWin
• GitHub - XRPLF rippled releases