XRP Ledger Foundation Reveals Critical Vulnerability in XRP System

The XRP Ledger Foundation has issued a clarification regarding a critical vulnerability in the XRP system that could have allowed attackers to create trillions of XRP. The foundation confirmed that no unauthorized XRP was created and clarified several misconceptions about the recently discovered vulnerability, which could have jeopardized the entire XRP market with a capitalization of $94 billion.

The vulnerability could have led to bypassing the fixed supply limit of XRP. The XRP Ledger Foundation confirmed that such a threat did indeed exist and that the now-fixed vulnerability had the potential for this. However, the foundation assured that exploitation was never observed in the public network. The vulnerability was discovered by Veria Labs, a company specializing in security. Researchers at Veria Labs found a bug in the XRP Ledger's payment engine, which reportedly existed since 2015. If exploited, it could have led to the creation of about 18.45 trillion XRP in a single transaction, which is 180 times the original amount of XRP. The foundation also commented on speculations about possible XRP creation (unauthorized minting). It noted that all XRP balances are public information, so if new XRP were created, it would be evident in the published ledger data.

Addressing criticism regarding the unusual process of releasing this security update, the foundation emphasized that normally, changes to the XRP Ledger protocol must be approved by more than 80% of trusted validators over a two-week period before implementation. However, the XRP Ledger Foundation noted that this process could create a window of opportunity for potential attackers to exploit the vulnerability for several weeks before the fix takes effect. Given how easily vulnerabilities can now be identified and reverse-engineered, especially with the help of artificial intelligence, developers concluded that immediate software updates were necessary. As a result, a coordinated emergency response was conducted, during which the XRP Ledger Foundation, RippleX, core developers, and validators worked together on the solution. Validators received updated software on September 25, and public binary versions were also released on the same day. The XRP Ledger Foundation emphasized that no one can force network participants to accept the software update.