XRP Ledger developers have defended an emergency security patch used to fix a bug capable of creating XRP outside the network’s fixed supply, saying they could not wait for the network’s usual two-week validation vote without disclosing the flaw to attackers.
The fix, released on September 25, came three days after a bug bounty was reported and took effect immediately on any server it was installed on. It was the first deliberate bypass of the normal corrections process since the system was introduced more than ten years ago, they said.
“With a normal amendment vote, the amendment would have been public for weeks before it took effect, risking network security,” the XRPL developers said. said In an X post on Sunday.
The rapid correction has raised questions about XRPL’s level of decentralization. On its website, XRPL claims that it is a fully decentralized, public blockchain – a feature that is at the heart of the argument that its native token, XRP, is not a security.
XRPL security fix “raises many questions”
Justin Bones is the founder of Cyber Capital said Thursday that marketing XRP to retail investors as decentralized is “outright fraud.” He argued that the September 25 emergency release was shipped as binary only, temporarily withholding the source code and forcing operators to upgrade.
However, the XRPL Foundation said the decision to skip the normal patching process was made jointly by the foundation, RippleX, key developers and verifiers after assessing the severity of the bug.
“No single party could make this call alone. Each validator and node operator chooses which software to run, and 3.4.1 only requires two weeks with more than 80% validator support through a simple amendment vote. Protocol changes still go through amendments,” the foundation said.
Related: Laser confirms unauthorized hardware implants, says damages could exceed $86M
XRP Kuwait, an independent verification operator, also rejected Claims that integrated upgrades signal centralized control.
“We do not agree with the contention that an update coordinating operators is in itself evidence of centralized control,” it said. “Coordination is not the same as control. Independent operators can assess a situation, communicate with each other, and reach the same decision without sacrificing their independence.”
Bug can generate unlimited XRP
The bug was an integer overflow in the XRP ledger’s payment engine that had been present since 2015, according to the project’s vulnerability disclosure report.
The XRP balance is stored as a 64-bit integer with a fixed maximum. When a sum exceeds that maximum, the calculation wraps to a smaller number instead of failing.
An attacker could exploit this by creating hundreds of special price offers, each asking for a very large amount of XRP, then sending a payment that consumes them.
Engine will credit each offer owner their full amount but will only charge the buyer the small wrapped total. The difference will be newly created, expendable XRP.
According to the report, the attack required a deliberately crafted proposal and could not have been triggered by normal business activity. The developers said they found no evidence that the issue was exploited on any public networks.
magazine: Lazer Attack Spreads to EU, AI Finds ’18 Trillion XRP’ Bug: Hodler Digest
