XRP Ledger skips its own validator vote to fix critical vulnerabilities

RippleX 在未进行标准验证者投票的情况下紧急修复 XRP Ledger 关键漏洞

RippleX 在未经过标准验证者投票程序的情况下，更改了 XRP Ledger（XRPL）的交易规则。此次紧急修复关闭了一个可能导致凭空生成 XRP 的安全缺陷。在源代码公开之前，验证者便收到了编译好的软件版本。XRPL 的披露报告指出，没有证据表明有人利用该漏洞攻击公共网络。

这是十多年来，XRP Ledger 的开发者和验证者首次在没有将变更提交给验证者投票表决的情况下，改变了网络处理交易的方式。此次紧急发布版本 xrpld 3.4.1 于 2026 年 9 月 25 日推出，距离安全公司 Veria Labs 私下报告一个可能让单笔支付创建约 18 万亿 XRP 的漏洞仅三天。该修复方案首先以编译软件的形式发布，随后才公布源代码，这一流程自项目启动以来便受到了外界的批评。

最近的 XRPL 安全修复引发了诸多疑问和一些误解。让我们在此澄清事实。

1. 是否有任何 XRP 被非法创建？

没有。XRP 的供应量在 XRP Ledger 启动时就被固定在 1000 亿枚，任何交易都不允许创建更多的 XRP。这个漏洞原本是一种绕过限制的手段……

—— XRP Ledger Foundation (@XRPLF) 2026年10月11日

常规流程与紧急操作的对比

账本上的规则变更通常需要通过“修正案”（Amendment），该修正案只有在超过 80% 的可信验证者在连续两周内支持后才会激活。修正后的代码从第一天起就是公开的，具备能力的读者可以将其与前一个版本进行比较，从而了解其防止了什么风险。

然而，如果按照常规流程，旧规则将在至少两周内继续有效。这次攻击的成本很低：官方披露估计仅需几百枚 XRP 的账户和报价储备金（大部分可收回），加上普通费用即可实施。

流程类型 激活条件 源代码状态 潜在成本/风险 标准路线 (Amendment) 两周以上支持率超过 80% 第一天即公开 在修复方案可读期间，漏洞仍可被利用 RippleX 的操作 (Emergency Release) 每个升级服务器的即时生效 二进制文件之后公布 可能导致验证者分歧，代码运行基于信任

补丁与未补丁验证者的潜在分歧

The emergency fix took effect on each server immediately after the operator installed it, so the validator applied different rules in a short period of time. Patched verifiers will refuse malicious payments, while unpatched verifiers will accept them. Disclosure documents acknowledge that the split could lead to a temporary standstill in ledger verification. RippleX believes that network stagnation is a more acceptable price than generating trillions of dollars in unauthorized XRP.

This window period is very short. On release day, more than 80% of the validators on the default Unique Node List (UNL) were running version 3.4.1. UNL is a set of nodes that the server trusts by default unless otherwise configured.

Timeline from private reports to public disclosures

• September 22:Veria Labs submitted report. RippleX reproduced the vulnerability and raised the severity from "significant" to "critical."
• September 23: Engineers merged fixes into the 3.4.1 branch after a private review.
• September 25:xrpld 3.4.1 was released without a vote.
• October 9: The XRPL team released its vulnerability report.

Under other pressures, some networks have taken more radical measures: In September, for example, Cronos erased 11,000 blocks to undo a $120 million attack.

The operator is running software that cannot be read by the outside world

The verifier receives the executable software, but the source code remains private. CyberCapital founder Justin Bons criticized the arrangement, arguing that a public ledger is temporarily running under closed code. RippleX engineer Mayukha Vadari defended him, pointing to the danger of leaking critical vulnerabilities before the network is protected.

The XRP Ledger Foundation subsequently stated that the build was first sent to the default UNL validator through each validator's contact information published in the xrp-ledger.toml file, and that the public binary file was also released on the same day. The foundation also emphasized that there is no single imposing party that can enforce this change: each operator chooses whether to install it, and 3.4.1 will only become mandatory after the BatchV1_2 amendment passes a standard vote. The source code for 3.4.1 has now been released, and anyone can compare it with distributed binaries.

Single payments, hundreds of quotes, and totals close to zero

This vulnerability exists in 2015 payment codes. The ledger agreement has a built-in order book, and one payment can settle many pending orders at the same time. The engine uses 64-bit integer arithmetic to calculate the XRP to be expected. When the total exceeds the maximum value that the format can accommodate, the value will wrap around and become a small number. The seller receives full credit, and the buyer only needs to pay the total amount after wrapping.

The supply check added in 2017 should have prevented this, but it used the same unchecked arithmetic and spilled during audit calculations. Per-account restrictions also failed to stop attacks because the newly generated XRPs were scattered across hundreds of wallets.

Parameters Details XRP that can be created for 1 transaction 18 trillion Value at risk (Veria Labs estimates) US$94 billion Year the defective code was launched 2015 Bounty amount paid (maximum planned amount) US$250,000

Veria Labs said an AI agent it built discovered both weaknesses and wrote proof-of-concept code. According to the company's statistics, since 2024, the ledger has passed more than a dozen audits and audit competitions and paid a reward of more than $1 million, but no one has discovered the overflow.

Servers require version 3.4.1 or higher, and owners do not need to operate

Server operators need to run xrpld 3.4.1 or later. Disclosure documents do not indicate that XRP holders need to take any steps. The foundation said it has verified the supply throughout its ledger history and that approximately 99.986 billion XRP is currently in circulation, slightly lower than the original 100 billion because transaction fees have been destroyed.

Developers have added overflow checks to the payment engine, rebuilt the supply checking mechanism, and introduced stricter procedures to ensure that reported vulnerabilities are confirmed before release. The same version also fixed a separate flaw in Batch transactions, which has not yet been activated on the main network, and the fix has passed a regular amendment and was activated on October 9.

Response speed will face another test

Veria Labs pointed out that in one incident in 2026, at least 1,367 BTC (worth approximately $89 million) was stolen through a multi-year-old vulnerability in Coldcard wallet firmware. Hardware wallets were attacked again this month, with Ledger users losing millions of dollars due to spy chips hidden inside their devices. Wallet maker Coinkite reportedly suspects that attackers used AI to discover the vulnerability, although this suspicion has not yet been confirmed.