Author
Ahmed Barakat
Author
Share
In the latest XRP news, RippleX expects to ship xrpld 3.3.0 the week of August 1, 2026, packaging five amendments for validator consideration, including rewritten versions of Batch and Permission Delegation, both of which were blocked before mainnet activation after security researchers discovered separate critical authorization flaws in their original implementations.
No funds were ever lost. The question now is whether the ecosystem extends enough trust for the rewrites to clear the 80% validator threshold.
Discover: Everyone’s Got a Take. Get Free $25 to Actually Trade Yours
XRP News: What Broke the First Time, and How
The original Batch amendment contained a signature-validation bug that allowed an attacker to execute inner transactions from arbitrary victim accounts without ever holding their private keys.
According to the official XRPL vulnerability disclosure, researcher Pranamya Keshkamat and Cantina AI’s autonomous audit tool Apex identified the flaw on February 19, 2026, while the amendment was still in its voting phase.
UNL validators were advised to vote against it the same evening; an emergency release, rippled 3.1.1, marked both Batch and the related fixBatchInnerSigs amendment as unsupported to prevent any activation path.
The root cause was a loop-exit error in the signer-validation logic: when the code encountered a new account whose signing key matched its own, it declared success and exited without checking the remaining signers, meaning a forged signer entry for any victim account would never be inspected.
The exploit path let an attacker drain a victim account down to its reserve through unauthorized Payment transactions. The replacement, BatchV1_1, redesigns that authorization logic and is now flagged in the 3.3 development registry as supported with a default No vote pending validator approval.
Permission Delegation exposed a different attack surface. A September 2025 disclosure documented how an invalid offline-signed transaction could still charge the delegated account a transaction fee before failing authorization, because the code checked permissions before verifying the signature, and tec-type errors carry a fee charge by design.
A malicious actor could repeatedly submit such transactions with elevated fees to silently bleed a victim account’s XRP balance. The fix reclassifies the relevant error from tec to ter and reorders checks so no fee can be deducted before signature verification.
The replacement, PermissionDelegationV1_1, carries the same default No designation in the 3.3.0 registry. This pattern of catching bugs before mainnet is consistent with the broader XRPL security maintenance cadence, which has seen multiple hotfix releases address protocol-level issues ahead of activation.
Discover: Your Market Calls Are Worth Something. Start With Free $25 on Kalshi
Three New Amendments Target Institutional Tokenization
The remaining three amendments are new additions aimed at the institutional tokenization market. Confidential MPT uses elliptic-curve cryptography and zero-knowledge proofs for Multi-Purpose Token balances and transfer amounts, keeping them opaque on the public ledger while remaining auditable by designated entities, such as regulators.
It addresses the most consistent objection from financial institutions evaluating public blockchain infrastructure: that counterparty exposure is visible to everyone.
The feature targets tokenized government bonds, real estate, equities, and private credit, asset classes where confidentiality is a baseline operational requirement, not a preference. The broader XRPL push into this space is already underway, with active infrastructure development for capital markets tokenization on the XRP Ledger.
Sponsored Fees and Reserves allow a bank, issuer, or platform to cover transaction fees and reserve requirements on behalf of its users, removing the requirement for end users to hold XRP before transacting.
This substantially lowers onboarding friction for institutional deployments, though it also reopens the structural debate: if end-users no longer need XRP to interact with the ledger, demand dynamics shift toward institutional settlement volume rather than retail token utility. That outcome is neither confirmed nor refuted until the amendment activates and institutions actually deploy it.
Dynamic MPT closes the third gap, allowing token issuers to modify specified properties, fees, metadata, and predefined parameters after issuance without migrating to a new token entirely.
Jazzi Cooper, RippleX’s head of product, announced the five amendments on X, describing XRPL as having already demonstrated its capacity to support tokenized assets at scale and framing the new features as the infrastructure layer for global transfers, trading, collateralization, and settlement.
Cooper confirmed that all five require validator voting before activation.
Discover: Get Paid to Be Right, $25 to Start on Kalshi
Don’t Miss Out on Our $1,000 USDT Airdrop on ByBit
