The XRP Ledger is retrying an upgrade that could give institutions more precise control over account operations, after validators blocked an earlier version because of a flaw that might have let attackers drain XRP through unauthorized transaction fees.
PermissionDelegationV1_1 entered a 14-day activation countdown on September 21, backed by 29 of the network’s 35 trusted validators. The amendment could activate on October 5 at 11:18 UTC if at least 28 validators, or 80%, continue supporting it throughout the voting period.
The retry puts more than a new account feature on trial. It also tests whether the XRP Ledger’s amendment process can identify and correct a serious implementation problem before software reaches users and becomes part of institutional infrastructure.
Dividing responsibility without giving up control
Permission delegation is designed to let one account assign narrowly defined tasks to another account. A delegate could be authorized to make payments, approve customers or perform other specified operations, while the primary account retains control over keys, permissions and assets.
That model mirrors the separation of duties used by traditional financial institutions. Banks commonly divide payment processing, compliance approvals and custody across different employees, teams and systems. Permission delegation aims to bring a similar structure to blockchain accounts.
A stablecoin issuer could, for example, use an internet-connected compliance account to approve customer accounts while keeping the keys with broader authority offline. A separate operations account could process payments without gaining the power to change account settings, modify key arrangements or authorize additional delegates.
Each delegate can receive up to 10 permissions. The primary account can later change or revoke those permissions, giving the institution a way to adjust operational access without replacing its core account or distributing its most sensitive keys.
The potential business benefit is reduced exposure. Companies often hesitate to connect automated software to wallets because a compromised system may gain more authority than it needs. Delegation could limit the damage by allowing software to perform only the tasks required for its role.
A failed first attempt
The security history behind the amendment has made the second activation especially significant. The first version contained a flaw in how the network handled transactions submitted by accounts with delegated permissions.
The software checked whether an account was allowed to conduct a transaction before verifying the transaction’s signature. Attackers could have exploited that sequence by repeatedly submitting malicious transactions with deliberately high fees. Even if those transactions ultimately failed, the fee handling could have caused the victim’s account to pay unauthorized costs and lose XRP.
A community tester reported the issue on September 15, 2025, while the feature remained outside the main network. Validators then rejected the amendment before it could activate, preventing the flaw from reaching production accounts.
The corrected implementation is included in xrpld 3.3.0. Its rejection process changes the order of operations so that signature verification takes place before fees can be charged. That adjustment addresses the direct fee-draining risk, although institutions will still need to assess how delegated permissions fit into their own access controls and monitoring systems.
Governance as part of the product
The amendment’s renewed vote highlights an important feature of public blockchain infrastructure: governance and engineering cannot be separated from adoption. Permission delegation may solve a practical problem for regulated payment companies, but its value depends on confidence that changes are reviewed, tested and reversible when defects appear.
The XRP Ledger’s process did not eliminate the original bug. It did, however, provide a mechanism for validators and community testers to stop the feature before activation, revise the code and begin again. If the amendment passes, the result will be both a new institutional control layer and a public demonstration of how the network responds when innovation encounters a security failure.
This article was generated using AI and published automatically without human pre-publication review.
Without human check
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.