XRPL Validators Block Two Flawed Amendments Before Mainnet Activation
In brief
- XRPL validators blocked Batch and Permission Delegation amendments due to authorization vulnerabilities
- Batch flaw could have let attackers execute transactions for victim accounts without private keys
- Permission Delegation exposed a path to drain accounts through repeated invalid transaction fees
- Both amendments marked as 'default No' in the 3.3 development registry
- RippleX expects xrpld 3.3.0 release next week with fixed replacements
The Batch Amendment Flaw
Researchers found the authorization flaw while the Batch amendment was still in voting. The original Batch amendment contained an authorization flaw that could have allowed an attacker to execute inner transactions for arbitrary victim accounts without their private keys, including unauthorized payments and ledger changes. The vulnerability meant attackers could bypass the normal signing requirements that protect accounts.
Validators blocked activation, and no funds were put at risk. The network's governance structure prevented the flawed code from ever reaching production.
Permission Delegation's Fee Drain
Permission Delegation presented a different threat. An invalid offline-signed transaction could still charge a victim account a transaction fee before failing authorization, allowing repeated submissions to drain XRP through fees. This meant attackers didn't need to successfully execute transactions—they only needed to submit invalid ones repeatedly to bleed accounts dry.
What Happens Next
The 3.3 development registry now marks BatchV1_1 and PermissionDelegationV1_1 as supported with default No votes. This means the replacements ship with the code but won't activate unless validators explicitly change their stance. XRPL amendments can activate only after compatible code ships and support remains above 80% of trusted validators for two weeks.
RippleX expects the next version of the XRP Ledger's core server software, xrpld 3.3.0, as soon as next week. RippleX product head Jazzi Cooper listed five proposed XRP Ledger features for 3.3.0: Confidential MPT, Batch, Permission Delegation, and two others. The fixed versions will need explicit validator approval to move forward.
