XRPL Fixes High-Risk Flaw in Permission Delegation Feature

XRPL has issued a critical update to its Permission Delegation feature after a bug bounty report revealed a high-risk flaw during testing. The updated V1.1 version has completed security review and QA checks, addressing edge cases involving delegate identity and preventing newer capabilities from being delegated unintentionally.

The initial issue was discovered by researcher Shotes, who found that a delegate could delete their account and recreate it while keeping existing permissions, with no way for the original account to revoke them. The changes also fix reserve accounting for delegated payments and close a multi-signing route that could bypass delegation checks.

XRPL head of engineering J. Ayo Akinyele explained that the team chose to introduce V1.1 instead of patching the original version, citing the need for safeguards beyond the basic feature itself. The updated feature remains unchanged in terms of capability but has stricter activation conditions.