- A fix for an XRP Ledger bug that could let a burn-only account create new is on track to activate on or after 4 November, with 33 of 35 behind it.
- XRP’s own supply was never affected. The flaw sat in the permission rules for tokens issued on the ledger, stablecoins included.
- CoinDesk found no public record of the bug being used, and the fix is still a vote in progress rather than a completed change.
The dramatic version of this story is a bug that could let a stablecoin partner print tokens out of thin air. The accurate version is narrower, nobody can find a case of it being used, and XRP itself was never part of it.
If you hold a stablecoin issued on the XRP Ledger, Ripple’s RLUSD being the one most UK readers will have come across, that is the layer the problem sat in. If you hold XRP instead, nothing about your coins was exposed. Either way there is nothing to do on your side: this is a change to the network’s own rules, not something a holder installs, claims or opts into.
What the bug does
Tokens on the XRP Ledger work differently from XRP. XRP is the network’s native currency and its supply is set by the . Everything else, including stablecoins, is issued by somebody: a company creates the token, backs it however it says it does, and keeps the ability to create more or destroy the ones that come back.
Issuers can hand parts of that control to other accounts. One of those permissions is burning, the power to destroy the issuer’s tokens and take them out of circulation. The bug meant an account granted only that burn permission could, under certain conditions, create new tokens instead.
The conditions are the part the headline version skips. It needed an issuer to have granted that permission to another account in the first place, and the ledger’s own amendments documentation currently tells developers not to grant it until the fix takes effect. CoinDesk, which reported the fix, says it found no public record of anyone using the bug to mint tokens that were not meant to exist.
Why the patch takes a fortnight
Changes to how the XRP Ledger processes transactions are called amendments, and no single party can ship one. Validators, the servers that agree on which transactions are valid and in what order, vote on them. An amendment that changes transaction rules needs more than 80% support, 29 of the 35 validators on the tracker most people watch, and it has to hold that level continuously for two weeks before it switches itself on.
Hold the threshold for the full fortnight and it activates. Lose it for a moment and the countdown goes back to zero.
Which is what happened. Support fell to 26 validators on 21 October and recovered about two hours later, enough to restart the clock and push the target from 23 October to on or after 4 November. The earliest activation window is around 14:46 UTC on Wednesday.
Since that dip the count has been steady. The Defiant, writing ahead of Wednesday, puts support at the same 33 of 35, which means the restarted fortnight has run without another drop below the threshold.
A company that finds a security bug patches it quietly and tells people afterwards. A public ledger cannot work that way. The flaw, the fix and the running vote count all sit on pages anyone can read, which is why there is a documented warning telling developers to avoid the risky permission in the meantime. More people watching the problem, and a longer gap between spotting it and closing it.
What else is in the package
The same amendment tidies up a handful of unrelated calculations: how issuers recover their tokens from trading and AMM pools, how deposits and withdrawals are accounted for in vaults, and a timing error that could mark a loan late or in default before its due date had passed.
Those last two point at features that are not live. The ledger’s lending service has 19 of the 29 votes it needs, and the vault system it depends on has 21. Neither is near the threshold, and no lending product arrives on Wednesday alongside the fix.
What to watch
Whether the 33 holds through the final stretch. One more dip below 29, even for a couple of hours, and the two weeks start again, which is exactly how the October date was lost. After Wednesday’s window opens, the thing to check is simply whether the amendment shows as activated rather than still voting.
After that, the separate proposals that would let issuers block unapproved token holders, which remain under review. They cover the same territory: who is allowed to do what with somebody else’s token. Wednesday settles one question there and leaves the bigger one open.
Validator counts and the activation estimate are live figures taken from CoinDesk’s reading of the XRP Ledger dashboard and documentation, with the current count also reported by The Defiant, and they can move before Wednesday. No one from Ripple, the XRP Ledger Foundation or any validator operator is quoted on the record in the reporting.