XRP Ledger (XRPL) developers disclosed on October 9 fixes for two vulnerabilities. The central issue was a payment-processing error confirmed in a separate test environment that could allow XRP to be created improperly and then spent. Developers estimated that the flaw had existed since 2015 and said they found no evidence that it had been exploited on any public network.
The error occurred when amounts from multiple offers were added: if the calculation exceeded its limit, the total wrapped around to a small number. An attacker could exploit this to pay more XRP to recipient accounts than was deducted from the buyer's account. Developers reproduced the behavior on a test server and explained that the safeguard designed to prevent the creation of new XRP failed to catch it because it used the same faulty calculation.
The fix was included in xrpld 3.4.1, released on September 25. Changes to transaction-processing rules normally require support from more than 80% of trusted validators to be maintained for two weeks under the amendment process. This payment-error fix, however, took effect as soon as a server was upgraded. The report said this was the first time since the amendment system was introduced that a transaction-processing change had deliberately been deployed this way. Members of the XRPL Foundation, RippleX and the validator community judged that the risk of exploitation if the fix were disclosed while awaiting a vote outweighed the risk that differing server behavior during the emergency rollout could halt consensus. More than 80% of validators on the default Unique Node List (UNL) upgraded on the day of release.
Meanwhile, the Batch transaction validation error disclosed at the same time affected a feature that was not active on Mainnet when it was discovered, so it did not affect Mainnet accounts or funds. That fix went through the normal amendment process and was activated on October 9. The report said the standard process for rules changes remains in place and did not present a standing exception-approval procedure for similar future cases.