Ripple’s XRPL NFT plan on hold as developer finds fault in proposal

Any hope of non-fungible tokens (NFTs) being enabled on Ripple’s XRP ledger soon will have to wait as XRPL Labs lead developer Wietse Wind temporarily withdrew his vote in support of the development on Sept. 11.

An explainer 🧵 on the recent finding that a simple ‘flag’ (setting) on minted NFT’s can be abused, causing NFT issuers to get all their XRP locked up due to actions of third parties.

Because of this finding, I have removed the “yay” vote of the @XRPLLabs validator. Temporarily.

— WietseWind – 🛠 XUMM @ XRPL Labs (@WietseWind) September 11, 2022

According to Wind, a setting that could allow malicious players to abuse minted NFTs was discovered.

He added that the flaw could also lead to NFT issuers XRP tokens being “locked up due to actions of third parties.”

The problem essentially is with the collection of royalties for minted NFTs. Normally, the issuer will get a percentage on every secondary sale of the NFT. But XRPL requires that the issuer should have a trust line.

While this is good and prevents spamming, it could have dire effects on NFTs. The current XLS-20 specification has a flaw: if a flag is set on an NFT, a trust line would automatically be created for the NFT issuer.

But the sale can happen without the issuer’s knowledge and, in that case, lock up the account reserve.

“A once minted and sent/sold NFT with the lsfTrustLine + Transfer Fee could then be sold back and forth between two or more accounts from an attacker, causing more and more Trust Lines to be created for random shitcoins issued by the attacker.”

Wind said it now means the XLS-20 amendment may lose the majority. However, he argued that this is the best thing and will give time to rectify the problem and vote again.

Wind revealed that the bug was identified by xTokenize.

The withdrawal of that crucial vote from the XLS-20 amendment means that the plan to upgrade XRPL to make NFT minting possible will have to wait. According to Wind, “this is not “XLS20 Goodbye”: this is “XLS20 See you later”.