XRP Ledger to Fix Flaw Allowing Unauthorized Token Creation

XRP Ledger schedules fix for token creation bug

The XRP Ledger is expected to activate a technical update on Wednesday, November 4, to close a loophole that could allow certain accounts to create new tokens without permission. The XRP Ledger is a decentralized blockchain, a type of digital record-keeping system, used for processing transactions.

This bug specifically affects tokens issued on the network, such as stablecoins, which are digital assets designed to keep a steady value. The supply of XRP, the network's native cryptocurrency, is not affected by this flaw.

Critical details of the network update

• The update, named fixCleanup3_4_0, is scheduled for activation around 14:46 UTC on November 4.
• At least 29 out of 35 tracked validators must support the change for two weeks straight to activate it.
• Current data shows 33 out of 35 validators support the fix.
• A temporary drop in support on October 21 caused the original October 23 launch date to be delayed by nearly two weeks.

How the token permission loophole works

The flaw allows an account that is only authorized to destroy tokens to also create new ones under specific conditions. For example, a stablecoin issuer might grant a payment service the power to burn, or destroy, tokens when customers trade them for traditional money. This bug could accidentally give that service the power to issue new tokens as well.

Official network documentation currently warns developers not to give out token-burning permissions until the fix is active. The upcoming patch will enforce a strict separation between the permission to create tokens and the permission to destroy them.

Why validator voting delayed the launch

Changes to the network rules require more than 80% support from validators for 14 consecutive days. Validators are independent operators whose computers check transactions and agree on the history of the network. While support is currently high, a brief dip below the required threshold in late October restarted the mandatory two-week countdown clock.

Lending and vault features await further support

The update package also includes fixes for trading pools and vault calculations. However, the actual lending service and the vault system it requires do not yet have enough validator votes to launch. These features currently have 19 and 21 votes respectively, but they need 29 to start their own activation countdown. If they receive enough support on Wednesday, they could potentially launch by November 18.

Strengthening security for stablecoin issuers

This fix is vital for companies that issue assets on the ledger. It ensures that partners can only perform the specific tasks they are authorized to do. By correcting these permissions and mathematical calculations, the network aims to provide a more secure environment for stablecoins and other tokenized assets.

Sources

• CoinDesk