XRP Ledger has fixed two software vulnerabilities that threatened XRP issuance and network operation. The first vulnerability could have allowed XRP to be issued without backing. It was discovered on September 22, 2026, through the XRPL bug bounty program. An integer overflow in the payment mechanism could have allowed an attacker to create XRP out of nothing by using special offers in the order book and a single payment. When processing hundreds of offers, the system could incorrectly sum XRP amounts, allowing offer owners to receive full amounts while buyers paid significantly less. The bug could have existed since 2015 when the current payment mechanism was created and was fixed in version xrpld 3.4.1, released on September 25. Now the system checks for overflow when calculating amounts and rejects incorrect operations.
The second vulnerability threatened network consistency and was discovered during a re-evaluation of the Sherlock Attackathon results. The XRPL Foundation team confirmed that the previous fix for the batch transaction issue was incomplete. This issue concerned the Batch mechanism, which allows up to eight transactions to be combined into one batch. The server did not check whether each internal transaction was wrapped in a RawTransaction field, which could lead to discrepancies between server software versions and, under certain conditions, threatened to halt the confirmation of new ledgers. The bug was fixed through the fixBatchV1_2 update, activated on the mainnet on October 9. Both fixes were included in xrpld 3.4.1. The team also plans to re-evaluate each fixed vulnerability on candidates for new releases.
Earlier in 2026, Ripple Labs also worked on enhancing the security of the XRP Ledger and expanding its capabilities. In March, RippleX researchers introduced an approach to confidential transfers for multifunctional tokens aimed at protecting user data. In April, the company announced a multi-phase plan to prepare the XRPL for quantum computing threats, which includes transitioning to post-quantum cryptography by 2028. In October, the Brazilian CSD BR launched the first phase of a partnership with Ripple Labs for the tokenization of BTG Pactual investment fund shares in the XRP Ledger.
This material is prepared solely for informational purposes and does not constitute financial advice or a recommendation.