XRP Ledger defends emergency patch for unlimited XRP bug
-
Written by
Simonas Brazionis - Updated 2026-10-12 06:35:59
XRP Ledger developers have defended an emergency patch implemented to address a critical bug that could have led to an unlimited supply of XRP, as XRP Ledger defends emergency patch. Developers stated that delaying the fix to adhere to the network's standard two-week validator vote process would have exposed the vulnerability to potential attackers.
The patch was deployed on September 25, three days after the bug was reported through a bounty program. This marked the first instance of deliberately bypassing the usual amendment process since its inception over a decade ago, raising questions about the network's decentralization.
Decentralization Concerns and Developer Response
The expedited nature of the fix prompted discussions regarding the decentralization of the XRP Ledger, which characterizes itself as a fully decentralized public blockchain. Justin Bons, founder of Cyber Capital, commented that marketing XRP to retail investors as decentralized, given these circumstances, constituted fraud, noting that the emergency release was distributed as binaries with source code temporarily withheld.
However, the XRPL Foundation clarified that bypassing the standard amendment process was a joint agreement among the Foundation, RippleX, core developers, and validators, made after evaluating the bug's severity. The Foundation emphasized that no single party could have made this decision unilaterally. XRP Kuwait, an independent validator operator, also countered claims that coordinated upgrades indicated centralized control, asserting that communication among operators does not compromise autonomy.
Details of the Critical Vulnerability
The vulnerability, identified as an integer overflow in the XRP Ledger‘s payment engine, had been present since 2015. XRP balances are stored as 64-bit integers with a fixed maximum. The bug caused calculations to wrap to a smaller number when a sum exceeded this maximum, instead of failing.
An attacker could have exploited this by creating numerous specially priced offers, each requesting a very large amount of XRP. A single payment consuming these offers would credit each offer owner their full amount while charging the buyer only the wrapped total, creating new, spendable XRP. Developers reported no evidence of the issue being exploited on any public network.
