The XRP Ledger Foundation has defended its decision to circumvent the standard XRP Ledger amendment process due to a critical security vulnerability that could have seen trillions of XRP minted by malicious actors.
The foundation has also made it clear that no unauthorized XRP was minted, and it has clarified some misconceptions regarding the recently uncovered vulnerability, which could have put the entire $94 billion XRP market cap in jeopardy.
The vulnerability could have allowed the XRP fixed supply cap to be bypassed, and the XRP Ledger Foundation confirmed that this was indeed the case and that the now-fixed vulnerability had the potential for this. However, the foundation has assured that the exploit was never seen on the public network.
AI-powered security firm Veria Labs uncovered this vulnerability. The team of researchers at Veria Labs found a bug in the XRP Ledger payment engine that is said to have been present since 2015. If exploited, this could have yielded around 18.45 trillion XRP in a single transaction. That would have been 180 times more than the original XRP supply.
No XRP creation
The foundation has addressed speculation regarding possible XRP creation (unauthorized minting).
It has stated that all XRP balances are public information, so if any new XRP were minted, it would obviously be visible in the publicly available ledger data.
The foundation also stated that the supply of the network is monitored on an ongoing basis and that the supply data is verified by community members.
Centralization claims
The foundation has also addressed some of the criticism surrounding the unusual process of releasing this security patch.
Typically, when changes are proposed to the XRP Ledger protocol, they would need to be approved by over 80% of the trusted validators for two consecutive weeks before being enacted. However, the XRP Ledger Foundation pointed out that the risk with that process is that it would give potential attackers a window of several weeks to exploit the vulnerability before the fix went live.
Given how easily vulnerabilities can be discovered and reverse-engineered these days, especially with the aid of artificial intelligence, the developers concluded they needed an immediate software update.
Therefore, a coordinated emergency response was carried out between the XRP Ledger Foundation, RippleX, core developers, and validators.
Validators received the patched software on Sept. 25, and public binaries were also released on that same day.
The XRP Ledger Foundation has stated that no single person can compel network participants to adopt the software update.