XRP Ledger developers have publicly defended the emergency patch that fixed a bug capable of creating XRP beyond the network's fixed supply, saying they could not subject the fix to the usual two-week validator vote without publicly exposing the flaw to attackers first.

In an X post on Sunday, the developers said the September 25 fix — shipped three days after the bug bounty report from researcher Cayden Liao and Veria AI — took effect immediately on any server that installed it, and was the first deliberate bypass of the ledger's normal amendment process since that system was introduced more than ten years ago. "With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security," they said. The statement was reported by Cointelegraph and covered by Cryptonews.

The Decentralization Dispute

The expedited fix has reignited the argument over how decentralized the ledger actually is. Cyber Capital founder Justin Bons said Thursday that marketing XRP to retail investors as decentralized amounted to "straight-up fraud," arguing that the emergency release shipped as binaries only, temporarily withheld the source code, and pressured operators to upgrade — all signs, in his view, of centralized control.

The XRPL Foundation's response: the decision to skip the normal amendment process was made jointly by the Foundation, RippleX, core developers and validators after assessing the bug's severity. "No single party could make that call alone," the Foundation said, adding that the patch "only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments."

Independent validator operator XRP Kuwait also pushed back on the centralization reading: "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

The stakes of the debate extend beyond engineering. XRPL markets itself as a fully decentralized public blockchain — a characterization that has been central to arguments that XRP is not a security.

The Bug, Briefly

According to the disclosure report, the flaw was an integer overflow in the payment engine, present since 2015. XRP balances are stored as 64-bit integers with a fixed maximum; when a sum exceeded that maximum, the calculation wrapped to a smaller number instead of failing. An attacker posting hundreds of specially priced offers and consuming them in a single payment could have been credited the full amount while paying only the tiny wrapped total — with the difference being newly created, spendable XRP. The attack required deliberately constructed offers, could not be triggered by normal trading, and developers say they found no evidence it was ever executed on a public network.

The Currency Analytics reports that Veria Labs received a $250,000 bounty for the finding; the disclosure report itself did not state the payout amount.

The episode is the second time in a month that emergency response mechanics — rollback, patch-bypass, coordinated halt — have become the story in their own right, after Ontology froze block production entirely on Saturday over a reported security risk. The trade-off between rapid response and decentralized process is now an active governance question for every major network, not just XRPL.

TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.