This Week on the Ledger

The XRP Ledger closed a permission flaw in its token issuance logic this week, after a two-week validator vote that had already been reset once in October. The native lending stack, parts of which received accounting corrections in that same bundle, remains well short of the support it needs to activate, while developers keep refining how loan repayments are calculated. In Canada, the compliance story came from Washington: on November 6 the U.S. Treasury designated eight Canadian money services businesses for moving Iranian funds through digital assets, in an action coordinated with FINTRAC.

Protocol Infrastructure: fixCleanup3_4_0 Closes a Delegated-Burn Minting Flaw

The fixCleanup3_4_0 amendment was enabled on Mainnet on November 4, 2026, at ledger 108,112,129, according to the XRPLWin amendment tracker. Its path to activation took two attempts. The amendment first gained a majority on October 9, lost it on October 21, regained it the same day, and was enabled 14 days later. Under the amendment process, support must stay above 80% of trusted validators for two uninterrupted weeks, so the brief October dip restarted the countdown.

The most consequential change concerns permission delegation, which lets one account authorize another to perform specific transaction types on its behalf. The XRPL.org permission reference describes the PaymentBurn permission as allowing a delegate to destroy fungible tokens or MPTs, but not past a zero balance. Before the fix, a delegate holding only PaymentBurn could, in certain circumstances, mint new tokens instead. The documentation advised issuers not to delegate PaymentBurn until fixCleanup3_4_0 was enabled. The practical case is a stablecoin issuer that wants a payment processor to burn tokens on redemption without giving it the ability to create supply. XRP itself was not affected, and CoinDesk reported on November 2 that it found no public record of the flaw being exploited.

The amendment shipped with xrpld 3.4.0, announced September 16, and bundles a range of other corrections, including:

• rejecting PaymentBurn payments that would cross a zero balance;
• stopping AMMClawback from burning LP tokens when MPT rounding yields zero, and letting it skip the owner-reserve check when it auto-creates a paired asset holding;
• enforcing MPT balance and transfer invariants that previously only logged violations;
• separate signing hash prefixes for counterparty and sponsor signatures, so one role’s signature cannot be replayed as the other;
• escrow reserve handling in EscrowCancel and EscrowFinish, plus precision and rounding fixes across vault operations.

Node operators should note that the current recommended release is xrpld 3.4.1, an emergency security release dated October 10. Its release notes state that the fixBatchV1_2 amendment it introduced is already enabled on Mainnet, which means servers running older releases are amendment-blocked and cannot follow the network.

Native Lending: Eight Votes Short as LendingProtocolV1_2 Takes Shape

The lending amendments did not follow fixCleanup3_4_0 into a voting window. The XRPL Dashboard snapshot for November 6 shows LendingProtocol and LendingProtocolV1_1 each supported by 21 of 35 validators heard, and SingleAssetVault by 23. With 29 votes required to exceed the 80% threshold, each lending amendment is eight votes short and SingleAssetVault is six short. No amendment gained or lost a majority that day. Because a two-week countdown can only begin once the threshold is crossed, the earliest any of these could activate is two weeks after validators move.

The design those validators are being asked to approve is also still changing. According to the XRPL.org known amendments page, LendingProtocolV1_1 adds closed-ended vaults, with subscription, investment and redemption phases that govern when assets can be deposited, lent and withdrawn, and cash-basis accounting, under which interest is recognized only when it is paid. Once it is enabled, new loan brokers can only be created against closed-ended vaults.

On November 6, a contributor opened pull request #8698, “fix: Telescope loan payment value to the schedule,” labelled for a further amendment, LendingProtocolV1_2. Today each payment’s value portion is calculated on its own, so rounding errors accumulate and the final payment can require one unit more than the scheduled periodic payment. The change ties each on-time payment to the loan’s remaining schedule so the final payment equals the rounded periodic payment, and it resets the outstanding value to the new schedule after an overpayment. The pull request was still open and awaiting a required review as of this writing. For institutions modelling loan products on XRPL, the detail matters because it determines whether on-chain repayment amounts reconcile exactly with the amortization schedule a lender books.

Regulatory Enforcement: U.S. Sanctions Eight Canadian Money Services Businesses

On November 6, 2026, the U.S. Treasury’s Office of Foreign Assets Control designated eight money services businesses based in Canada under Executive Order 13902, which targets Iran’s digital asset sector. Six are in Ontario and two in British Columbia. Treasury said the firms converted Iranian rials and other currencies into digital assets to support Iran-related transactions, and that their addresses transacted with addresses associated with the Islamic Revolutionary Guard Corps, with sanctioned Iranian exchanges including Nobitex and Wallex, and with addresses tied to terrorism. It also said several of the firms laundered drug proceeds by converting cash into digital assets. The action was coordinated with FinCEN, the DEA and FINTRAC.

The OFAC listing includes TRON (TRX) addresses for four of the eight entities, which lets exchanges and other compliance teams screen for them directly. Treasury Secretary Scott Bessent said in the release that “Canada cannot be a safe haven for illicit financial facilitators.”