XRP Ledger defends emergency patch for unlimited XRP bug

XRP Ledger developers have defended the emergency security patch used to fix a bug capable of creating XRP beyond the network’s fixed supply, saying they could not wait for the network’s usual two-week validator vote without exposing the flaw to attackers.

The fix, released on Sept. 25, came three days after a bug bounty report, and took effect immediately on any server that installed it. It was the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago, they said. 

“With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security,” XRPL developers said in an X post on Sunday. 

The expedited fix led to questions about XRPL’s level of decentralization. On its website, XRPL claims it is a fully decentralized, public blockchain — a characterization that has been central to arguments that its native token, XRP, is not a security. 

XRPL security fix “raised a lot of questions”

Cyber Capital founder Justin Bons said Thursday that marketing XRP to retail investors as decentralized amounted to “straight-up fraud.” He argued that the Sept. 25 emergency release shipped as binaries only, temporarily withheld the source code and pressured operators to upgrade.