A recently disclosed vulnerability in the XRP Ledger raised questions about whether an attacker could bypass the network’s fixed XRP supply and create new tokens. Cayden Liao and Veria AI identified the issue, and the 3.4.1 software release addressed it.
As questions emerged about the vulnerability and how developers handled it, the XRP Ledger Foundation issued a detailed explanation covering the XRP supply, how the bug could have been triggered, and why developers chose to deploy the fix outside the usual amendment process.
The Foundation confirmed on X that no new XRP was created and said the ledger’s supply remained intact throughout the incident. It also outlined additional security measures planned to protect the network against similar vulnerabilities.
XRP Supply Remains Unchanged
The XRP Ledger Foundation explained that the network launched with a fixed supply of 100 billion XRP, and its rules do not permit transactions to create additional tokens. However, the vulnerability provided a potential way around that restriction, prompting questions about whether the supply had been compromised.
According to the Foundation, the 3.4.1 release fixed the issue without creating any additional XRP. It also stressed that the public nature of the XRP Ledger allows anyone to examine account balances and transaction records independently.
The Foundation said it monitors the network around the clock and has verified the XRP supply throughout the ledger’s history. Other community members have also conducted independent checks. The Foundation added that transaction fees are permanently destroyed, gradually reducing the supply over time. It estimates that approximately 99.986 billion XRP currently exist.
Foundation Outlines Additional Security Measures
The Foundation also explained why the vulnerability went unnoticed for so long. It said ordinary payments would not trigger the bug because exploiting it required hundreds of deliberately constructed operations.
However, the Foundation warned that artificial intelligence could accelerate vulnerability discovery for both security researchers and malicious actors. It plans to work with RippleX and the wider XRPL community to strengthen the network’s defenses.
The proposed measures include greater use of formal verification and AI-based adversarial testing, closer collaboration with security researchers and improvements to the bug bounty program. The Foundation said it would provide further updates as this work progresses.
Why Developers Deployed the Fix Directly
Another key issue concerned the decision to deploy the security fix directly rather than wait for the usual amendment process to take effect.
The Foundation explained that a public amendment process could have exposed details of the vulnerability weeks before the fix became active, giving potential attackers time to study the weakness. In response, the Foundation, RippleX, core developers, and validators reached a social consensus on a deployment plan designed to protect the network while minimizing disruption for node operators.
The Foundation emphasized that no single organization could make the decision alone. Validators and node operators retain the ability to choose which software they run, and version 3.4.1 became required through the normal amendment process after receiving more than 80% validator support for two weeks.
The Foundation thanked Cayden Liao and Veria AI for responsibly reporting the vulnerability, as well as the core developers and node operators who helped implement the fix. It maintained that the response reflected the XRP Ledger community’s collective role in protecting the network.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
