How does XRPL.org's xrpld v3.4.0 fix the reserve sponsorship exit bug?

The full answer

What did XRPL.org announce about the fix?

XRP Ledger fixes a reserve sponsorship bug in xrpld v3.4.0. XRPL.org stated that the fix to enforce conditional exit on reserve sponsorship is included in xrpld v3.4.0, released on September 17, 2026 [1]. The statement comes from XRPL.org’s vulnerability disclosure report dated September 21, 2026. XRPL.org said in its vulnerability disclosure report that the fix to enforce conditional exit on reserve sponsorship is included in xrpld v3.4.0, released on September 17, 2026.

XRPL.org said no funds were at risk and the amendment was not active on Mainnet.

What was the bug?

During Devnet testing of the XLS-68 Sponsored Fees and Reserves amendment, XRPL.org said, a reserve-accounting vulnerability was identified in the sponsorship lifecycle [1]. XRPL.org’s vulnerability disclosure report, published September 21, 2026, says the flaw was found during Devnet testing of the XLS-68 amendment [2]. The fix enforces a conditional exit on reserve sponsorship. The part of the report quoted here does not spell out further how the exit rule works.

Why do reserves matter here?

XRPL.org’s reserves documentation says an account owes an owner reserve for objects it holds. Trust lines are shared between two accounts, the reserve can apply to one or both, and most often the token holder owes it and the issuer does not [3]. A sponsorship feature changes who covers such a reserve. A mistake in the accounting when a sponsorship ends could therefore leave reserves counted wrongly.

Was anyone affected?

XRPL.org said the Sponsor amendment had not been activated on Mainnet, and that no funds were at risk [1]. It added that no loss of funds, private key compromise or consensus failure occurred, and that the amendment had not been activated on any production network [1]. On that account, the flaw stayed in testing. Amendments reach Mainnet only after validator voting, which the page on how XRP Ledger upgrades are approved explains.

What else shipped in version 3.4.0?

XRPL.org said in its September 21, 2026 disclosure report that the sponsorship fix is included in xrpld 3.4.0, released on September 17, 2026 [2]. The full release contents are covered in what is new in version 3.4.0, and the voting status of the lending amendment is on the page asking whether native lending is live.

What is the case for caution?

The bug was caught only in testing, but it shows how much complexity new features add to the ledger’s accounting. XRPL.org’s blog also lists a 3.4.1 emergency release on September 25, 2026 to fix security-sensitive issues. Its changelog names a Batch inner-transaction fix and integer-arithmetic hardening in the payment engine and ledger helpers [2]. Those items are separate from the sponsorship fix. Earlier XRPL Labs findings are covered in the Batch amendment vulnerability page.

As of Sep 25, 2026, investigators still need to establish how the backend was penetrated, what privileges the attackers obtained, why existing controls did not reject the transactions, and whether additional authentication or transaction-policy safeguards could have stopped them.

As of October 7, 2026, XRPL.org has not announced a Mainnet activation date for XLS-68. The wider feature roadmap sits on the page about XRP Ledger features live and coming. The vulnerability is a protocol matter and has no link to scheduled economic data such as the US inflation and jobs reports.