The XRP Ledger will activate the `fixCleanup3_4_0` amendment around 14:46 UTC on Nov. 4, closing a critical loophole that allowed accounts delegated with `PaymentBurn` permission to mint new fungible tokens.
The vulnerability emerged from the permission delegation feature, which launched Oct. 8 through the `PermissionDelegationV1_1` amendment. This feature lets an account grant specific powers—such as `PaymentBurn`—to another account without sharing private keys. The XRPL's own documentation flagged the flaw: a delegate with `PaymentBurn` could also mint new tokens before the fix, and explicitly advised against delegating `PaymentBurn` until `fixCleanup3_4_0` went live.
The patch ships in `xrpld 3.4.0` and specifically rejects `PaymentBurn` payments that cross a zero balance. Other permissions remain unaffected. The release also tightens controls for automated market maker clawbacks, vault accounting, escrow reserves, and signature handling across the network.
Node operators have been instructed to upgrade to `xrpld 3.4.0` immediately. XRPL amendments require 80 percent support from trusted validators for two consecutive weeks. If support drops below that threshold even once, the activation clock resets.
The fix faced a stumble: it was initially scheduled for activation Oct. 23 but failed to meet the two-week consensus requirement. Current data from Xrpscan's amendment tracker shows `fixCleanup3_4_0` has now regained the necessary majority. Thirty-three of 35 validators currently support it—exceeding the 28 votes required for activation.
Other proposed upgrades lag further behind. `LendingProtocolV1_1` and the original `LendingProtocol` amendment each have 19 validator votes, while `SingleAssetVault` has 21. All three remain below the 28-vote threshold, delaying native lending capabilities on the ledger.
This fix comes after a month of elevated security scrutiny for the network. Last month, developers disclosed a decade-old ledger bug that theoretically could have allowed an attacker to mint XRP beyond its fixed supply. That flaw was patched in September with no evidence of exploitation. The XRP Ledger also faced indirect exposure during the recent Binance hack, though the attack targeted Binance's wallets rather than the underlying XRPL protocol. This forthcoming fix does not alter anything for regular XRP holders.
