Default
Door Remote - 23 Sep 2026
The upgrade lets an account divide its authority by job. A stablecoin issuer could allow an internet-connected compliance system to approve customer accounts to hold its token while keeping the keys with full control offline.
A separate operations account could receive permission to make payments without gaining the power to change those keys or grant authority to somebody else. Each delegate can receive up to 10 permissions, which the main account can later change or revoke, according to XRPL documentation.
PermissionDelegationV1_1 is the network’s second attempt at introducing the feature.
The original version contained a flaw that could let an attacker make another account pay fees for transactions it had not properly signed. Repeated submissions carrying deliberately high fees could have drained the victim’s XRP balance.
The software checked whether an account had permission to carry out the transaction before verifying its signature. Certain failures still charged a fee, meaning the money could be deducted before the system discovered that the signature was invalid, according to an XRPL vulnerability report.
A community tester reported the flaw on Sept. 15, 2025, while testing the feature outside the main network. Validators were advised to reject the amendment, and it never activated.
A separate operations account could receive permission to make payments without gaining the power to change those keys or grant authority to somebody else. Each delegate can receive up to 10 permissions, which the main account can later change or revoke, according to XRPL documentation.
PermissionDelegationV1_1 is the network’s second attempt at introducing the feature.
The original version contained a flaw that could let an attacker make another account pay fees for transactions it had not properly signed. Repeated submissions carrying deliberately high fees could have drained the victim’s XRP balance.
The software checked whether an account had permission to carry out the transaction before verifying its signature. Certain failures still charged a fee, meaning the money could be deducted before the system discovered that the signature was invalid, according to an XRPL vulnerability report.
A community tester reported the flaw on Sept. 15, 2025, while testing the feature outside the main network. Validators were advised to reject the amendment, and it never activated.