XRP Ledger (XRPL) developers have defended an emergency security patch that skipped the network's standard validator vote. The fix, released on September 25, closed a flaw that could have all
XRP Ledger (XRPL) developers have defended an emergency security patch that skipped the network's standard validator vote. The fix, released on September 25, closed a flaw that could have allowed an attacker to create spendable $XRP beyond the token's fixed supply.
According to the XRPL Foundation, the decision to bypass the normal process was made jointly by developers, RippleX (@RippleXDev) and validators. RippleX reported no evidence of exploitation on public networks.
Cointelegraph reported that XRPL developers said they could not wait for the usual two-week validator vote without exposing the flaw to attackers. The fix came three days after a bug bounty report and took effect immediately on any server that installed it. Developers described it as the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago.
Under the standard route, rule changes normally need support from more than 80% of trusted validators for two weeks, according to BeInCrypto. In an X post, XRPL developers argued that a normal amendment vote would have made the fix public for weeks before it took effect, which risked network security.
The flaw was an integer overflow in the ledger's payment engine. Cryptometer reported that an attacker could have placed offers involving unusually large amounts of XRP across many accounts, then consumed them with a single crafted payment. The combined total could exceed what the counter could hold and wrap around to a much smaller number, so sellers would be paid in full while the buyer paid far less.
The issue reportedly dates to 2015 and was reported on September 22 by researchers Cayden Liao and Veria AI through the XRPL bug bounty program, per the same report. Digital Today reported that RippleX engineers reproduced the flaw on a local standalone server and confirmed the newly created XRP could be spent. The fix shipped in xrpld 3.4.1.
Uptake was fast. Coingape reported that more than 80% of default UNL validators were running the update by release day, with public disclosure following on October 9.
The move has drawn criticism. Cyber Capital founder Justin Bons argued that the release shipped as binaries only and pressured operators to upgrade, according to Cointelegraph. The Foundation responded that no single party could make the call alone, and that every validator and node operator chooses what software to run.
Sources:Cointelegraph on the XRPL emergency patch, BeInCrypto on the XRP Ledger bug fix, Digital Today on the XRPL bug and no signs of exploitation
