XRP Ledger patched 2015 vulnerability, audit finds no unauthorized XRP creation

Cyber Capital fund manager Justin Bonds criticized recent developments in the XRP Ledger, focusing on the management of software upgrades and the role of validator lists. The concerns center on how developers handle critical vulnerabilities and the extent of control that network operators and default node lists exert on the ecosystem.

XRP Ledger Vulnerability and Response

Dr. Stevenson, a researcher active in the blockchain space, reported that an overflow vulnerability was discovered on September 22 through the XRP Ledger’s official bug bounty program. This bug, reportedly present since 2015, could have enabled attackers to obtain XRP fraudulently or generate unauthorized tokens.

In response, developers released version 3.4.1 of the XRP Ledger software on September 25. However, they initially withheld the complete fix code from the public. On that same day, a significant majority of the network’s validators—over 80%—upgraded to the new version. Two weeks later, on October 9, a protocol amendment was activated, leading to the disconnection of nodes that had not yet updated.

Following the incident, Dr. Stevenson indicated that a ledger audit was conducted to determine whether any unauthorized XRP had been created or exploited via the vulnerability. She stated that the audit did not find evidence of exploitation. Details about the specific auditor or access to the full report were not disclosed.

Dr. Stevenson said that the overflow flaw existed since around 2015 and could have allowed attackers to obtain XRP or create tokens without authorization, yet the audit showed no evidence such exploitation occurred.

Mini dictionary: Overflow vulnerability, a software programming error where a calculation produces a value that exceeds the storage capacity of a variable, potentially allowing attackers to manipulate balances or create unauthorized assets.

Comparison with Other Blockchain Responses

Dr. Stevenson contrasted the XRP Ledger incident with how Bitcoin Core developers handled a similar vulnerability in 2018. In that case, developers first disclosed a risk of system crashes and delayed revealing the full extent of potential inflation vulnerabilities, giving users more time to upgrade securely.

Validator Influence and Network Decentralization

The discussion also addressed the influence of Unique Node Lists, which most operators use by default to select trusted validators. Dr. Stevenson observed that while operators may choose any list, recommended lists still shape network consensus. Ripple, the financial technology company behind the XRP Ledger, runs only one validator on the widely used list.

To implement major changes, more than 80% of main validators must support a new amendment for at least two weeks. These requirements make it difficult for a single party to unilaterally change the ledger’s rules, though the influence of recommended validator lists remains a topic of debate among stakeholders.

Safeguards such as the 80% amendment threshold and voluntary Unique Node Lists mean Ripple cannot single-handedly alter consensus rules, but ownership of validator lists still plays a significant role in influencing defaults.

Calls for Transparency and Ongoing Scrutiny

Critics have argued that full transparency through the publication of the complete fix code and detailed technical documentation is necessary to thoroughly assess the incident. Both the prompt code release and a comprehensive technical write-up are seen as critical for restoring confidence in the platform and clarifying whether user funds were ever at risk.