Skip to the article
Web3 Hub

Markets, protocols and policy, reported

XRPL defends emergency XRP overflow patch after decentralization criticism

XRPL developers defended the Sept. 25 patch after a bug could mint spendable XRP; the fix bypassed the usual validator vote to avoid weeks of public exposure.

By Web3 Hub Newsroom2 min read

XRPL defends emergency XRP overflow patch after decentralization criticism

XRP Ledger developers defended the Sept. 25 emergency patch for a bug that could create spendable XRP, saying the normal validator vote would have left the flaw exposed for weeks. In its vulnerability disclosure report, the project said the fix took effect as each server upgraded, bypassing the network’s usual amendment process.

The defense followed criticism of the rapid rollout. The Cointelegraph report said Cyber Capital founder Justin Bons questioned the network’s decentralization, while the XRP Ledger Foundation said the decision was made jointly by the Foundation, RippleX, core developers and validators.

How could the bug create new XRP?

A researcher reported the flaw through the XRPL bug bounty program on Sept. 22, according to the disclosure. The report said Cayden Liao and Veria AI identified an integer overflow in the payment engine, which could have been present since 2015.

An attacker could create hundreds of offers requesting large XRP amounts, then use one payment to consume them. The engine could credit offer owners in full while charging the buyer only a small amount because the total wrapped around; the XRP created could then be spent. XRPL said it found no evidence the flaw was exploited on a public network.

Why did the fix skip the validator vote?

The usual process requires more than 80% of trusted validators to support a change for two weeks before it takes effect, the report said. Developers said that process would have made the fix public while the vulnerability remained exploitable; the patch instead checks for overflow and uses a wider counter in the “no XRP created” safety check.

The XRP Ledger Foundation said no single party could make the decision alone and that operators choose which software to run. The report says all server operators must upgrade to version 3.4.1 or newer to maintain sync with the network.

References