XRPL’s Permission Delegation amendment (XLS-75) has been re-released on the mainnet following the discovery and subsequent fix of a critical bug that previously coincided with its withdrawal. The updated V1.1 version has now successfully passed security review and quality assurance checks, clearing it for production.
The Permission Delegation amendment, initially introduced in May 2025, is designed to allow one account to grant specific operational powers to another. However, before its intended mainnet deployment as V1.0, a high-severity vulnerability was identified by a bug bounty researcher. This flaw, reported by researcher Shotes, pertained to irrevocable delegate permissions. It enabled a delegate to delete and subsequently recreate their account while retaining granted permissions, which the original granting account could not revoke.
As CryptoPotato reported, this critical issue prompted the withdrawal of the V1.0 implementation before it could be deployed to the mainnet. The scope of the necessary fixes extended beyond this single vulnerability.
Further analysis during the review process also uncovered a medium-severity unsigned integer overflow in the isDelegable function. Researchers indicated, however, that this specific issue posed no significant risk without deliberate misbehavior from the delegator.
The V1.1 release incorporates comprehensive fixes for these identified issues, alongside addressing other edge cases. This hardened version not only resolves the critical permission vulnerability but also prevents the unintentional delegation of new capabilities like Vault and Lending, corrects reserve accounting, and closes a potential multi-signing bypass route.
A rigorous testing regimen was implemented to ensure the stability and security of V1.1. This included 179 dedicated tests for Permission Delegation, encompassing 112 functional tests, 48 adversarial security tests, and 19 cross-feature tests. The security of the implemented fixes was independently verified by the Cantina security firm. Furthermore, XRPL Ledger Operations reported that their Quality Assurance (QA) team conducted over 5,088 regression tests, confirming no regressions and verifying the resolution of all critical and high-severity bugs.
The development timeline for XLS-75 includes its introduction in May 2025, its designation as unsupported in September 2025 pending a security fix, a renaming in October 2025, and its eventual re-support in June 2026 with the V1.1 implementation.
This incident underscores the inherent complexities and risks associated with developing and deploying protocol-level features, highlighting the critical need for robust safeguards that extend beyond basic functionality. The successful resolution and re-release of XLS-75 serve as a testament to the effectiveness of rigorous security vetting, bug bounty programs, and comprehensive testing in maintaining the integrity of the XRPL mainnet.
Why This Matters
The materials describe a narrow update: The Permission Delegation amendment (XLS-75) was initially pulled from XRPL due to a high-risk flaw found by a bug bounty researcher. The exact date the bug bounty report was filed.
Broader Context
Source materials place the factual news in this context: XRPL Fixes Permission Delegation After Critical Bug Found.
Leave a Reply