The XRP Ledger Foundation rejected claims suggesting network operators were forced to install its emergency patch.
The XRP Ledger Foundation denied assertions that network operators were pushed into deploying its critical security fix.
Launched three days after a bug bounty report on Sept. 25, the fix took immediate effect on updated servers. Officials noted that this marked the first deliberate bypass of the standard amendment protocol since the system’s launch over a decade ago.
“With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security,”
XRPL developers said in an X post on Sunday.
The swift patch sparked doubts regarding the extent of XRPL’s decentralization. On its website, the platform describes itself as a fully decentralized public blockchain, a core argument used to maintain that its native token, XRP, should not be classified as a security.
XRPL Security Update Raises a Series of Questions
On Thursday, Cyber Capital founder Justin Bons labeled the marketing of XRP to retail investors as decentralized “straight-up fraud.” He claimed the Sept. 25 emergency update arrived as compiled binaries only, temporarily hid the source code, and saw operators pressured to upgrade immediately.
However, the XRPL Foundation stated that core developers, RippleX, validators, and the Foundation itself jointly chose to bypass the standard amendment procedure after evaluating the bug’s severity.
“No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments,” the foundation said.
XRP Kuwait, an independent validator operator, also dismissed assertions that the coordinated network upgrades pointed toward centralized control.
“We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control,” it said. “Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence.”
Bug Could Have Created Unlimited XRP
According to the project’s vulnerability disclosure report, an integer overflow in the XRP Ledger’s payment engine had existed since 2015, making the bug a longstanding issue in the codebase.
The ledger tracks XRP balances using 64-bit integers with a strict upper limit. If a transaction push caused a total to cross that cap, the system rolled the calculation back down to a lower figure instead of throwing an error.
Exploiting this flaw required an attacker to place hundreds of massive XRP sell offers, followed by a single payment designed to trigger them all at once.
The payment engine would credit each seller their full payout while billing the buyer just the tiny wrapped amount. This discrepancy generated fresh, spendable XRP out of thin air.
According to the report, executing the exploit demanded custom-crafted sell offers rather than standard trading activity. Developers added that no evidence was found suggesting bad actors ever targeted public networks with the flaw.
