Developers of the XRP Ledger have stood by their decision to implement an urgent security patch that addressed a significant bug, which could potentially allow the creation of XRP in excess of the network’s predetermined supply. They emphasized the necessity of acting swiftly rather than waiting for the usual two-week validator voting period, which could have left the system vulnerable to exploitation.
The resolution, rolled out on September 25, was initiated just three days after a bug bounty notification and immediately applied to any servers that adopted it. This marked the first intentional deviation from the standard amendment process since the system’s inception over a decade ago.
XRPL developers clarified in a recent post on X that “If we had followed the normal amendment voting protocol, the proposed fix would have been publicly known for weeks prior to implementation, thus jeopardizing the security of the network.”
The quick deployment of the fix raised concerns regarding the decentralization of the XRP Ledger. The XRPL website asserts that it operates as a fully decentralized public blockchain, a key point in the ongoing discussions about whether its native token, XRP, can be classified as a security.
Concerns Arise from XRPL Security Update
Justin Bons, founder of Cyber Capital, expressed on Thursday that promoting XRP to individual investors as decentralized was tantamount to “outright fraud.” He criticized the emergency update released on September 25, stating it was provided solely as binaries, withheld the source code temporarily, and exerted pressure on operators to upgrade.
Contrarily, the XRPL Foundation explained that the collective decision to bypass the standard amendment procedure involved collaboration among the Foundation, RippleX, core developers, and validators after thoroughly evaluating the bug’s critical nature.
“No single entity had the authority to make that decision unilaterally,” the Foundation stated. “Every validator and node operator can select the software they wish to run, and the version 3.4.1 only gained necessitated status through a standard amendment vote with over 80% validator support for two consecutive weeks. Protocol amendments still follow the standard amendment process.”
XRP Kuwait, an independent validator operator, also dismissed suggestions that coordinated updates indicated centralized authority.
“We take issue with the notion that operators coming together to update is, by itself, a sign of centralized control,” they remarked. “Coordination does not equate to control. Independent operators can evaluate circumstances, communicate among themselves, and reach similar conclusions while maintaining their autonomy.”
Potential for Unlimited XRP Creation from Bug
The vulnerability involved an integer overflow in the XRP Ledger’s payment processing system, present since 2015, as detailed in the project’s vulnerability disclosure report.
XRP balances are maintained as 64-bit integers with a specified upper limit. If a calculation surpassed that limit, it would revert to a smaller number instead of failing outright.
An adversary could take advantage of this by establishing numerous specifically priced offers, requesting a considerable volume of XRP, and then executing a single transaction that utilized all those offers.
The engine would grant each offer holder their total requested amount, while charging the buyer only the minor wrapped amount, effectively generating new, usable XRP.
While this attack required specifically crafted offers and could not be activated through standard trading actions, the developers asserted they found no indication that the vulnerability had been exploited on any public networks.