XRPL Reworks Permission Delegation Following High Risk Bug

The XRP Ledger development team recently pulled its initial Permission Delegation amendment, known as XLS 75, after a bug bounty report exposed a high risk security flaw. Permission delegation allows one account to grant specific powers to another account without giving up total control. A security researcher found that a delegate could delete their account and recreate it while keeping their granted powers, leaving the original account unable to revoke them.

Instead of patching the original version, developers introduced V1.1 to separate the old code from the new, hardened release. This update fixes several edge cases, including stopping newer capabilities like Vault and Lending operations from being unintentionally delegated. It also closes a multi signing route that could bypass delegation checks and tightens how permission revocations work.

Following extensive testing that included 179 dedicated delegation tests and verification by security firm Cantina, the development team reports that all findings are resolved. The updated feature is now ready for production use. For users and custody providers, the core capability remains the same, but the safety conditions around activation are much stronger now.