RippleX and the XRP Ledger Foundation fixed a major security bug that, if exploited, could have printed an unlimited amount of assets. The fix, however, has raised community questions about security, network centralization, and more.
Ripple Backs Emergency Upgrade Amid Criticisms
The team revealed the fixed vulnerability on the network without it being exploited on a public blockchain. It traces to a critical integer overflow bug that lets bad actors create more XRP, breaking its fixed supply.
Balances are stored as 64-bit integers, and when a sum exceeds, it wraps to a smaller number rather than fail. This creates a problem where the hacker initiates a buy for large assets and only makes a single payment. Owners receive the full amount, but the attacker is charged only once, creating new tokens in the process.
Per the developers, the issue dates back to 2015, was first reported as finding F48 in the Sherlock Attackathon, and was rated low severity. It was reported through a recent bug bounty program and fixed, with about 80% of validators upgrading.
“During impact assessment, Mayukha Vadari (RippleX) found that the gap also created a consensus risk between server versions, because the accepted wrapper set depended on which fields each version defined. This raised the severity from low to a pre-activation blocker.”
Despite the fix preventing attacks that could have printed several assets, critics said the process proves XRP isn’t as decentralized as it claims. Justin Bons, founder of Cyber Capital, said marketing XRP as decentralized is straight-up fraud.
Previously, Ripple has also come under fire on centralization concerns, although it consistently rejects all allegations. The team explained that a normal would have taken two weeks and was the first deliberate bypass of an amendment process since introduction over ten years.
They argued that RippleX, core developers, backed the decision to skip normal processes, not one party alone. Furthermore, it received over 80% validator support, as several operators underscored.
Independent validator XRP Kuwait in a statement on X backed the move differentiating between coordination and control in certain situations. Similarly, other users supported the upgrade because of the danger of a delay. Meanwhile, others within the community called for wider bug programs to prevent a hack that could dampen sentiment.