XRP Ledger defends emergency patch for unlimited XRP bug

XRP Ledger developers have defended the emergency security patch used to fix a bug capable of creating XRP beyond the network’s fixed supply, saying they could not wait for the network’s usual two-week validator vote without exposing the flaw to attackers.

The fix, released on Sept. 25, came three days after a bug bounty report, and took effect immediately on any server that installed it. It was the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago, they said.

“With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security,” XRPL developers said in an X post on Sunday.

The expedited fix led to questions about XRPL’s level of decentralization. On its website, XRPL claims it is a fully decentralized, public blockchain — a characterization that has been central to arguments that its native token, XRP, is not a security.

XRPL security fix “raised a lot of questions”

Cyber Capital founder Justin Bons said Thursday that marketing XRP to retail investors as decentralized amounted to “straight-up fraud.” He argued that the Sept. 25 emergency release shipped as binaries only, temporarily withheld the source code and pressured operators to upgrade.

However, XRPL Foundation said the decision to skip the normal amendment process was made jointly by the Foundation, RippleX, core developers and validators after assessing the severity of the bug.

“No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments,” the foundation said.

Related: Ledger confirms unauthorized hardware implant, says losses may exceed $86M

XRP Kuwait, an independent validator operator, also rejected claims that the coordinated upgrades signaled centralized control.

“We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control,” it said. “Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence.”

Bug could have minted unlimited XRP

The bug was an integer overflow in the XRP Ledger’s payment engine that had been present since 2015, according to the project’s vulnerability disclosure report.

XRP balances are stored as 64-bit integers with a fixed maximum. When a sum exceeded that maximum, the calculation wrapped to a smaller number instead of failing.

An attacker could exploit this by creating hundreds of specially priced offers, each asking for a very large amount of XRP, then sending one payment that consumed them all.

The engine would credit each offer owner their full amount but charge the buyer only the tiny wrapped total. The difference would be newly created, spendable XRP.

The attack required deliberately constructed offers and could not be triggered by normal trading activity, according to the report. Developers said they found no evidence that the issue was exploited on any public network.