The XRP Ledger is moving to activate an amendment that closes a narrow but dangerous back door in its delegated payment permissions. According to official documentation, account holders should not delegate the PaymentBurn permission until fixCleanup3_4_0 is enabled on Mainnet.
Permission delegation went live on October 8, allowing an account to assign specific jobs to a second account that signs with its own keys. Among twelve granular permissions, PaymentMint covers payments that create fungible tokens or Multi-Purpose Tokens, while PaymentBurn covers payments that destroy them and should stop at zero balance. The flaw sits at that boundary: before the fix, a burn-only delegated payment could in certain circumstances run past zero and issue new trust-line tokens or MPTs.
The amendment rejects any burn-only delegated payment whose amount would cross into minting unless the delegate also holds PaymentMint. The other eleven permissions are unaffected. Although only an issuer that has already chosen a delegate can be exposed, the risk is issuance—the one task delegation was designed to keep behind offline keys. For fiat-backed tokens, the economic concern is additional units entering circulation without matching reserves.
This is the second flaw found in the delegation feature. A previous version was pulled in 2025 after a community tester discovered on devnet that it could charge transaction fees to accounts that had not signed; it never reached Mainnet. The replacement, PermissionDelegationV1_1, went live on October 8 while the PaymentBurn correction was still gathering validator support.
Under XRPL amendment rules, a change needs a supermajority of trusted validators held for two uninterrupted weeks. With 35 validators in the tracked set, the threshold is 29. Support fell to 26 on October 21, resetting the clock, but recovered to 33 of 35 validators by November 2. The earliest activation window opens around 14:46 UTC on November 4, provided support remains at 29 or above. Activation itself occurs at a ledger voting checkpoint.
Issuers have been advised to stop delegating PaymentBurn until the fix is enabled, audit existing Delegate entries, revoke the permission by resending a complete DelegateSet list, and treat revocation as final only after it appears in a validated ledger. The amendment bundles 25 changes across vaults, lending, automated market makers, NFTs, escrow and sponsorship, with the PaymentBurn fix listed as the final item.
