Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP XRP 账本团队回应紧急安全补丁争议：为防范致命漏洞，首次绕过常规审批流程
XRP 账本（XRPL）的开发团队近日针对近期实施的一项紧急安全补丁引发的担忧作出了回应。该补丁旨在解决一个关键性漏洞，该漏洞若被利用，可能导致生成的 XRP 数量超出其固定的供应上限。
开发团队表示，他们采取了即时行动，因为如果等待网络常规的两周修正案投票程序，可能会使这一漏洞暴露在潜在攻击者面前，从而带来安全风险。
紧急补丁绕过了常规审批流程
这项于 9 月 25 日发布的补丁，是在三天前收到一份漏洞赏金报告后实施的，并且任何安装该补丁的服务器都会立即生效。XRPL 开发团队指出，这是在过去十多年里，为了保护网络安全而首次有意绕过修正案流程。
开发团队在社交平台 X 上发布声明强调，此举出于对安全的必要考量：“按照正常的修正案投票流程，修复方案将在生效前公开数周，这将使网络安全面临风险。”
然而，这种快速部署也引发了人们对 XRP 账本去中心化程度的新质疑。XRPL 的公开资料长期以来一直宣称，该区块链作为一个完全去中心化的开放网络运行。这一描述在关于 XRP 作为非证券代币的法律地位讨论中发挥了关键作用。
Debate on decentralization and transparency
CyberCapital founder Justin Bons doubts these claims, calling the claim that marketing XRP to retail investors is "decentralized" as "pure fraud." Bons believes that releasing emergency patches in binary rather than open source form and rapidly promoting them put pressure on node operators to upgrade.
The XRPL Foundation, a non-profit organization responsible for ledger development, responded by stating that the decision to implement emergency fixes was made collectively by the foundation, RippleX, core developers and validators after jointly assessing the vulnerability risk. "No single party can make this decision alone. Each validator and node operator has its own choice of software to run, and version 3.4.1 became required only after receiving more than 80% validator support and a normal amendment vote that lasted for two weeks. Changes to the agreement are still made through amendments."
Independent verifier operator XRP Kuwait also refuted claims that node operators coordinated actions to undermine decentralization. The operator emphasized that consensus and communication are not the same as centralized control, and pointed out that independent operators always maintain autonomy throughout the process.
Critical vulnerability details and mitigation measures
This vulnerability involves how XRP balances are stored, using a fixed upper limit of 64-bit integer. When the total exceeds this upper limit, the total is "wrapped" to a smaller value rather than returning an error.
Attackers can exploit this flaw to create hundreds of pending orders requesting extremely large amounts of XRP. By sending a carefully crafted payment, an attacker can trigger all of these pending orders, paying the owner of the pending order in full, while the buyer only has to pay a very small amount of wrap around, effectively generating a new expendable XRP that exceeds the expected supply.
This vulnerability can only be exploited through deliberately constructed specific pending orders and cannot be accessed through standard trading activities. The development team reported that it found no evidence of exploitation of the issue on the public XRP network.
