The XRPL Foundation paused activation of the Batch amendment after a critical signature-validation flaw surfaced during the voting phase, a defect researchers warned could have enabled unauthorized inner transactions. The Foundation moved to stop the amendment before it could transition from “in vote” to “live on mainnet.” As part of the response, Universal Node List (UNL) validators were urged to vote against activation, and an emergency client update was shipped to neutralize the risk.
The issue was identified on February 19, 2026 by researcher Pranamya Keshkamat alongside Cantina AI’s Apex security bot, and the Foundation released an emergency rippled update on February 23, 2026 to mark the amendment as unsupported. The Foundation also published a disclosure that outlines the defect and positions a replacement amendment, BatchV1_1, as the forward path under review.
We released a full report on the Batch amendment issue from last week.
The bug revolved around the signature validation logic of the Batch amendment.
It was caught before the amendment was activated by the autonomous AI agent Apex at @cantinaxyz.
Thank you to all validators… pic.twitter.com/bDENk49WZS
— XRP Ledger Foundation (Official) (@XRPLF) February 26, 2026
What went wrong in signature validation
In the proposed Batch design, inner transactions were intended to rely on the batch’s outer list of signers instead of requiring separate signatures per inner transaction. That signer model is efficient in theory, but it also makes validation logic a single point of failure. The vulnerability described in the disclosure sits precisely in that validation routine.
According to the Foundation’s disclosure and contemporaneous reporting, a loop error caused the validation function to return success too early. The routine could “pass” after validating an initial signer if it encountered a signer account that did not yet exist in ledger state, skipping validation of the remaining signers. That premature exit created a credible path for an attacker to execute inner transactions on behalf of victim accounts without possessing their private keys.
Industry coverage noted that some analysts discussed the potential scale of exposure, but the Foundation emphasized a key mitigating fact: the amendment had not been activated on mainnet when the defect was disclosed. No compromised funds were reported, because the flaw was caught and contained during the vote phase rather than after activation. In risk terms, this was a high-severity issue with a low realized impact due to timing and response.
Governance response and operational lessons
The Foundation’s immediate playbook was procedural and fast: advise UNL validators to oppose activation and ship an emergency update that would prevent the vulnerable amendment from being supported. On February 23, 2026, rippled 3.1.1 was released to mark Batch and fixBatchInnerSigs as unsupported, effectively blocking activation while engineering work continued. This approach prioritized ecosystem containment over incremental remediation.
Post-patch, the Foundation said a revised amendment—BatchV1_1—has been submitted for review with stronger authorization guards and tightened signing checks. The message to the market is that the feature is not being abandoned, but it will be reintroduced only with stricter signing guarantees. For operators, the practical focus now shifts to tracking review outcomes and any follow-on votes tied to the replacement amendment.
The incident underscores how XRPL governance actually executes in production. Amendment activation is ultimately a coordinated operational event—validator voting plus timely client upgrades—so communication to UNL validators can stop risk before it reaches mainnet. At the same time, the episode highlights concentration and delegation risk when amendments change signer semantics, because a smaller set of sophisticated actors carries disproportionate responsibility for code-vetting and vote consequences.
The Foundation’s use of automated security tooling to surface the flaw is likely to shape pre-vote diligence norms. Expect more pressure for formal audits and AI-assisted checks before any vote that touches signature, authorization, or custody-adjacent semantics. In the near term, market participants and treasuries will want to monitor BatchV1_1’s review status and any renewed activation discussions with a tighter governance-and-controls lens.
