XRPL Fixes Permission Delegation After Critical Bug Found

XRPL has pulled its Permission Delegation amendment after a bug bounty report found a high-risk flaw during testing, with a hardened V1.1 now completing security review and QA checks.

The episode shows why delegation at the protocol level needs safeguards that extend beyond the basic feature itself.

XRPL Reworks Permission Delegation After Bug Report

Permission Delegation, known as XLS-75, allows one account to give another account specific powers to act on its behalf. The permissions are meant to be narrow, rather than giving the delegate control over the entire account.

RippleX head of engineering J. Ayo Akinyele explained that the original V1.0 implementation was pulled after a vulnerability was reported through the bug bounty program before it reached the XRPL mainnet. Instead of patching that version in place, the team introduced V1.1 to separate the original implementation from the hardened release.

A researcher called Shotes found a high-severity issue involving irrevocable delegate permissions, where a delegate could delete their account and later recreate it while keeping whatever permissions it had been handed by another account, with no way for the original account to revoke them.

The changes go beyond a single bug. V1.1 addresses edge cases involving delegate identity and stops newer capabilities, including Vault and Lending operations, from being delegated unintentionally. It also fixes reserve accounting for delegated payments and closes a multi-signing route that could bypass delegation checks. Revocation behavior was tightened as well.

The review also found a medium-severity unsigned integer overflow in isDelegable, which could allow a malformed permission value to be interpreted as a delegable transaction type, although researchers said the issue had no meaningful impact without misbehavior by the delegator.

Testing Expands Across XRPL’s Delegation Surface

A QA report published by Ramkumar SG on August 26 recorded 179 dedicated Permission Delegation tests, including 112 functional tests, 48 adversarial security tests, and 19 cross-feature tests. Testing also covered interactions with Batch, Confidential MPT, the transaction queue, and multi-signing.

XRP Ledger Operations said that all findings had been fixed in V1.1 and verified by the Cantina security firm. Its QA team also reported no regressions across 5,088 tests and noted there were no open internal bugs classified as critical, concluding that the feature was ready for production use at the tested commit level.

Permission Delegation was introduced in May 2025, marked as unsupported in September 2025 pending a security fix, renamed PermissionDelegationV1_1 in October, and re-supported in June 2026.

As CryptoPotato reported last week, a public dashboard built by developer Denis Angell has been tracking how thoroughly XRPL amendments get exercised on devnet before reaching mainnet, and delegation was among the amendments it had flagged as incomplete.

For users and custody providers, the intended capability is still unchanged. As Akinyele put it, V1.1 does not change what XLS-75 can do; instead, it changes the conditions under which that capability is activated.