New invariant privilege "mayDeleteMPT", used by VauleDeposit & Clawback

include/xrpl/protocol/detail/transactions.macro

@@ -844,7 +844,7 @@ TRANSACTION(ttVAULT_DEPOSIT, 68, VaultDeposit,
 #endif
 TRANSACTION(ttVAULT_WITHDRAW, 69, VaultWithdraw,
     Delegation::delegatable,
-    noPriv,
+    mayDeleteMPT,
     ({
     {sfVaultID, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
@@ -858,7 +858,7 @@ TRANSACTION(ttVAULT_WITHDRAW, 69, VaultWithdraw,
 #endif
 TRANSACTION(ttVAULT_CLAWBACK, 70, VaultClawback,
     Delegation::delegatable,
-    noPriv,
+    mayDeleteMPT,
     ({
     {sfVaultID, soeREQUIRED},
     {sfHolder, soeREQUIRED},

src/xrpld/app/tx/detail/InvariantCheck.cpp

@@ -76,6 +76,8 @@ enum Privilege {
                                 // object (except by issuer)
     mayAuthorizeMPT = 0x0200,   // The transaction MAY create or delete an MPT
                                 // object (except by issuer)
+    mayDeleteMPT =
+        0x0400,  // The transaction MAY delete an MPT object. May not create.
 };
 constexpr Privilege
 operator|(Privilege lhs, Privilege rhs)
@@ -1554,10 +1556,9 @@ ValidMPTIssuance::finalize(
             return true;
         }
 
-        if ((tx.getTxnType() == ttVAULT_CLAWBACK ||
-             tx.getTxnType() == ttVAULT_WITHDRAW) &&
-            mptokensDeleted_ == 1 && mptokensCreated_ == 0 &&
-            mptIssuancesCreated_ == 0 && mptIssuancesDeleted_ == 0)
+        if (hasPrivilege(tx, mayDeleteMPT) && mptokensDeleted_ == 1 &&
+            mptokensCreated_ == 0 && mptIssuancesCreated_ == 0 &&
+            mptIssuancesDeleted_ == 0)
             return true;
     }