Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP RippleX 修复 XRPL 网络中潜伏约 11 年的关键安全漏洞
Ripple 的开发团队 RippleX 宣布，他们已修复了 XRP Ledger（XRPL）网络中的一个关键安全漏洞。该漏洞被认为存在了大约 11 年，攻击者曾可能利用它无需支付任何费用即可“挖掘”数十亿枚 XRP。
根据 10 月 9 日发布的网络安全报告，研究人员在 XRPL 的支付引擎中发现了一个软件缺陷，该缺陷自 2015 年以来便已存在。这一漏洞原本允许恶意行为者违反 XRP 的供应规则，凭空创建新币，并将其像普通 XRP 一样进行花销。
RippleX 表示，目前没有证据表明该漏洞在任何公共网络上被实际利用过。
攻击者本可生成数十亿枚 XRP
2026 年 9 月 22 日，通过 XRP Ledger 漏洞赏金计划报告的某个安全漏洞被确认为源于支付引擎中的 64 位整数溢出错误。
通常情况下，XRP Ledger 拥有严格的安全控制措施，以防止新 XRP 的创建。然而，研究人员证明，如果在一个支付交易中使用了数百个精心构造的买单和卖单，这些控制机制就可以被绕过。
In this scenario, the system can process the XRP payment in full to the order holder, while charging only a very small percentage of the actual amount due from the recipient. In addition, the security mechanism used to check whether a new XRP was created also failed due to the same mathematical error, resulting in the relevant transaction being judged valid.
RippleX engineers reproduced the vulnerability in an independent test environment, confirming that XRP extracted using this method can be spent in subsequent transactions.
The report shows that initially only a few hundred XRPs were reserved in accounts and orders to launch such attacks. However, such attacks require specific conditions that cannot arise spontaneously through normal market transactions.
Ripple fixes another security vulnerability
The security report states that in addition to errors that may cause XRP to be "mined", another security vulnerability in the batch processing mechanism has also been fixed.
The vulnerability was reported on September 18, and its ability lies in causing different evaluations of the same operation using validators with different software versions. In this case, verification of new blocks on the XRP Ledger network may be temporarily suspended.
However, since the relevant functions had not been enabled on the main network when the vulnerability was discovered, no user balances were affected and no reconciliation problems occurred on the network.
Both vulnerabilities were fixed in xrpld version 3.4.1 released on September 25. The updateBatchV1_2 update involving batch mechanism fixes was deployed to the main network on October 9.
This article does not constitute investment advice.
