Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP XRP Ledger emergency security patch sparks discussion
The development team of XRP Ledger (XRPL) has defended its release of an emergency security patch that skips the network's standard validator voting process. The fix, released on September 25, closes a potential vulnerability that could have been used by attackers to create expendable $XRP beyond the fixed supply of tokens.
According to the XRPL Foundation, the decision to skip the normal process was made jointly by the developers, RippleX (@RippleXDev), and the validator. RippleX said it found no evidence of exploitation on public networks.
Why the patch skips the two-week voting period
XRPL developers reportedly pointed out that without immediate action, waiting for the usually two-week validator vote would expose the vulnerability to attackers. The fix was released within three days of receiving the vulnerability bounty report and immediately took effect on any server that installed the patch. Developers described this as the first time in more than a decade since the system was introduced, the normal amendment process was deliberately bypassed.
Under normal processes, rule changes typically require the support of more than 80% of trusted verifiers and last for two weeks to take effect. XRPL developers posted on the X platform arguing that a normal amendment vote would expose fixes for weeks before they take effect, endangering network security.
Vulnerability details and repair methods
The vulnerability stems from an integer overflow problem in the ledger payment engine. According to reports, attackers could place quotes involving an unusually large number of XRPs in multiple accounts and then consume those quotes through a carefully constructed payment. As the total exceeded the range of the counter and wrapped around, the value became a smaller number, allowing the seller to collect in full, while the buyer paid much less than expected.
It is reported that this problem dates back to 2015. Researchers Cayden Liao and Veria AI reported the issue on September 22 through the XRPL Vulnerability Bounty Program. RippleX engineers replicated the vulnerability on a local stand-alone server and confirmed that the newly created XRP could indeed be spent. The fix code is included in xrpld 3.4.1.
Updates are gaining popularity quickly. As of the release date, more than 80% of default UNL (Unique Node List) validators had run the update, which was publicly disclosed on October 9.
External reactions and responses
This move has also attracted some criticism. Justin Bons, founder of CyberCapital, believes that the release only provides binary files and puts pressure on operators to upgrade. In response, the foundation stated that no single party can make decisions alone and that each verifier and node operator has the right to choose what software to run.
