The XRP Ledger's fixCleanup3_4_0 update, which targets a flaw letting burn-only accounts mint issued tokens, could activate as early as Nov. 4 if validator support is sustained. XRP's own supply is not affected. An earlier Oct. 23 target was missed after support briefly dipped.
The XRP Ledger is set to apply the fixCleanup3_4_0 update, with the earliest rollout on Nov. 4, to fix a vulnerability that could allow unauthorized additional issuance of tokens such as stablecoins. The earliest activation date is Nov. 4, 2026 at 2:46 PM UTC. That timing holds provided support holds, and the actual switch follows a network voting checkpoint. Validator support puts the update on track for a potential Nov. 4 activation, provided the required 80% voting threshold is sustained.
What the flaw does
Under certain conditions, the flaw allowed an account authorized only to burn tokens to also mint new ones. For example, a payment company given permission only to burn redeemed tokens could have been able to issue new tokens. Accounts with PaymentBurn permission could create tokens without having the separate PaymentMint permission. The network's official documentation currently warns developers against granting the token-burning permission until the correction takes effect.
The vulnerability applies only to tokens issued on XRPL, including stablecoins, and does not affect XRP's native supply. The affected assets include stablecoins and multipurpose tokens, while XRP's supply does not depend on the impacted permission mechanism.
Voting and timeline
The update has support from 33 of 35 trusted validators tracked by XRPL Dashboard. Under XRPL rules, an amendment must receive more than 80% validator support for 14 consecutive days before activation. With 35 validators counted, 29 must keep backing the change.
The update was originally scheduled for Oct. 23, but the two-week approval period restarted after validator support briefly fell below the threshold on Oct. 21. Support fell to 26 on that date and recovered about two hours later, restarting the countdown. Nov. 4 became the earliest possible activation date, and the amendment had not activated as of Nov. 2.
Other fixes and related amendments
The update also includes fixes for calculation errors when token issuers withdraw assets from transaction pools or when users deposit and withdraw from vaults. It also addresses a problem that could incorrectly mark loans as delinquent or in default before maturity. The amendment additionally prevents certain loan records from showing overdue payments before contractual due dates.
The work is associated with the planned fixCleanup3_5_0 amendment, whose changes have not yet been merged into the XRP Ledger's main software. Once merged, that upgrade requires support from more than 80% of trusted validators for two weeks before activation.
Separate lending and Single Asset Vault amendments had 19 and 21 validator votes respectively and still needed more support before starting their 14-day approval periods. Both need 29 votes to begin two-week countdowns, and reaching that on Wednesday would put lending's earliest activation on Nov. 18.
