The XRP Ledger Foundation released an emergency security patch on Sept. 25 to address a critical bug in the network's payment engine. This vulnerability, an integer overflow present since 2015, could have allowed for the creation of XRP beyond the network's fixed supply. Developers stated that the patch was deployed immediately to prevent exposure, bypassing the standard two-week amendment process for the first time in over a decade.
The decision to expedite the fix involved collaboration between the Foundation, RippleX, core developers, and validators. The Foundation emphasized that no single party acted alone, noting that node operators retain the choice of software. Version 3.4.1 eventually became mandatory following a standard amendment vote that secured over 80% support from validators.
The emergency update sparked debate regarding the network's decentralization. Critics argued that the release of binaries without immediate source code access and the pressure to upgrade suggested centralized control. However, the Foundation and independent validator XRP Kuwait maintained that coordinated responses to severe threats do not equate to a lack of independence among network participants.
Technical reports indicate the bug stemmed from 64-bit integer limitations. An attacker could have theoretically exploited the flaw by creating specific offers to trigger a calculation wrap, resulting in the creation of spendable XRP. Developers confirmed that the attack required deliberate construction and found no evidence that the vulnerability was exploited on any public network.
