XRP Ledger defends emergency patch for unlimited XRP bug

The XRP Ledger Foundation pushed back against claims that its emergency security patch was forced on network operators. XRP Ledger developers have defended the emergency security patch used to fix a bug capable of creating XRP beyond the network’s fixed supply, saying they could not wait for the network’s usual two-week validator vote without exposing the flaw to attackers. The fix, released on Sept. 25, came three days after a bug bounty report, and took effect immediately on any server that installed it. It was the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago, they said. “With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security,” XRPL developers >said in an X post on Sunday. The expedited fix led to questions about XRPL’s level of decentralization. On its website, XRPL claims it is a fully decentralized, public blockchain — a characterization that has been central to arguments that its native token, XRP, is not a security. Cyber Capital founder Justin Bons >said Thursday that marketing XRP to retail investors as decentralized amounted to “straight-up fraud.” He argued that the Sept. 25 emergency release shipped as binaries only, temporarily withheld the source code and pressured operators to upgrade. However, XRPL Foundation said the decision to skip the normal amendment process was made jointly by the Foundation, RippleX, core developers and validators after assessing the severity of the bug. “No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments,” the foundation said. Related: Ledger confirms unauthorized hardware implant, says losses may exceed $86M XRP Kuwait, an independent validator operator, also >rejected claims that the coordinated upgrades signaled centralized control. “We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control,” it said. “Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence.” The bug was an integer overflow in the XRP Ledger’s