XRPL withdraws Permission Delegation amendment after discovering a critical flaw allowing irrevocable permissions, moving to a hardened V1.1 version.
Tech & Launches ·
The XRP Ledger has withdrawn its Permission Delegation amendment (XLS-75) after a bug bounty report identified a high-severity vulnerability during testing, according to CryptoPotato. Rather than patching the original version, the team developed a hardened V1.1 to separate the flawed release from an improved one. A researcher identified a critical issue where delegates could delete and recreate their accounts while retaining irrevocable permissions granted by another account, with no revocation mechanism available to the original account holder.
The refined V1.1 extends beyond addressing that single defect. Additional changes prevent newer features such as Vault and Lending operations from being unintentionally delegated, tighten revocation procedures, fix reserve accounting for delegated payments, and close a multi-signing pathway that could circumvent delegation controls. Security review also surfaced a medium-severity unsigned integer overflow in the isDelegable function, though analysis determined it posed negligible practical risk without deliberate misconduct by the delegator.
Testing encompassed 179 dedicated Permission Delegation test cases across functional, adversarial, and cross-feature categories, with coverage of interactions involving Batch operations, Confidential MPT, transaction queuing, and multi-signing. The Cantina security firm verified that all identified issues were resolved in V1.1, and XRP Ledger Operations reported no critical bugs remained and no regressions across a broader 5,088-test suite, declaring the feature production-ready at the tested commit.