A high-severity bug bounty finding forced XRPL to withdraw its Permission Delegation specification before mainnet, letting a delegate recreate an account while keeping irrevocable permissions. The hardened V1.1 blocks Vault and Lending operations from accidental delegation and passed 5,088 regression tests with no critical bugs open.
A delegate on the XRP Ledger could once erase its account and rebuild it while holding onto powers it was never meant to keep. That flaw, surfaced through a bug bounty submission, kept the network's XLS-75 specification off mainnet and pushed developers into a full rewrite now clearing security review and QA checks.
The researcher, operating as Shotes, filed the finding through the Cantina bug bounty program: a delegate could delete its account and later recreate it while retaining every permission another account had granted, with no route for the original account to revoke them. J. Ayo Akinyele, head of engineering at RippleX, said the team chose replacement over repair. "V1.1 does not change what XLS-75 can do; instead, it changes the conditions under which that capability is activated," Akinyele said.
Permission Delegation lets one account hand another narrow powers to act on its behalf rather than surrendering control of the whole account — the mechanism custody providers and institutional users need to route selected transactions without exposing balances. The amendment was introduced in May 2025, marked unsupported in September 2025 pending a security fix, renamed PermissionDelegationV1_1 in October, and re-supported in June 2026. XRP traded at $0.6234 as of 14:30 UTC, down 1.2% over 24 hours, according to CoinGecko, with the token's move tracking a broader altcoin session rather than the amendment timeline.
The V1.1 changes reach past the single reported bug. Delegate identity edge cases were closed, newer capabilities including Vault and Lending operations were blocked from being delegated unintentionally, reserve accounting for delegated payments was corrected, and a multi-signing route that could bypass delegation checks was shut. Revocation behavior was tightened as well. A separate medium-severity unsigned integer overflow in the isDelegable function, which could let a malformed permission value be read as a delegable transaction type, was also fixed; researchers said it carried no meaningful impact absent misbehavior by the delegator.
A QA report published by Ramkumar SG on August 26 recorded 179 dedicated Permission Delegation tests: 112 functional, 48 adversarial security, and 19 cross-feature. Coverage extended to interactions with Batch, Confidential MPT, the transaction queue, and multi-signing. XRP Ledger Operations said all findings were fixed in V1.1 and verified by the Cantina security firm, with no regressions across 5,088 tests and no open internal bugs classified as critical at the tested commit level.
The disclosure lands as XRPL's newest financial primitives approach production. Native lending under XLS-66 is being built with Cicada Credit acting as Loan Broker, handling borrower sourcing, credit checks, covenants, and monitoring off-chain while the protocol manages issuance, fixed terms, interest, repayments, and defaults on-chain. Single Asset Vaults under XLS-65 sit alongside it. Both are exactly the features V1.1 now prevents from being swept into a delegation grant by mistake — a delegate holding lending or vault authority could otherwise originate credit or move pooled assets under a permission the owner never intended to hand over.
The episode also sharpens a testing question the ledger's own tooling had already raised. A public dashboard built by developer Denis Angell tracks how thoroughly XRPL amendments are exercised on devnet before reaching mainnet, and delegation was among the amendments it flagged as incomplete. XRPL contributor Mayukha Vadari said the team is working with Common Prefix on formal verification, mathematically checking critical ledger functions rather than relying on test coverage alone — the same class of formal methods recently applied to formalize Fermat's Last Theorem.
For XRP holders and XRPL DeFi builders, the practical read is that the capability survived intact while the activation conditions got stricter. The bug never reached mainnet, which limits the direct damage, but the disclosure confirms that delegation — the permission layer that Vault and Lending depend on for institutional use — needed a second pass before those products could be trusted with real credit. The next checkpoint is the re-support date in June 2026, when PermissionDelegationV1_1 is scheduled to return to the supported set; until then, builders integrating XLS-65 vaults or XLS-66 lending should assume delegation grants cannot carry those operations.
This article is for informational purposes only and does not constitute investment advice.
