XRPL Emergency Patch Fixes Flaw, Spurs Governance Debate

Developers of the XRP Ledger released an emergency software patch on September 25 to address a flaw that could have enabled specially crafted transactions to create spendable XRP beyond the network’s fixed supply. The update bypassed the ledger’s usual validator-voting process, prompting debate over how the network balances rapid security responses with decentralized governance. The vulnerability was an integer overflow in the ledger’s payment engine, present since 2015, according to XRPL disclosure materials. Under a carefully constructed scenario, calculations exceeding a fixed limit could wrap to a smaller value. An attacker could use specially priced offers and transactions to receive more XRP than the amount charged, effectively creating spendable tokens. The disclosure said the exploit required specific conditions and could not be triggered through ordinary transactions. The potential scale was theoretical, not a report of XRP actually created. Developers said they found no evidence that the flaw had been exploited on a public network.