XRP Ledger Security has been questioned following the issuance of a patch by the developers in response to a critical bug that had the potential for malicious parties to generate further spendable XRP tokens despite the fixed quantity of 100 billion on the network.
Table of Contents
The bypassing of the regular two-week validation voting system was justified by the fact that waiting would give time to the exploiters to exploit the weakness.
XRP Ledger Security was rolled out three days after the report of the bug bounty, with immediate effect. The developers claimed that it was the first time in over ten years when an intentional bypass of the amendment process occurred.
The fix has created a lot of discussion regarding the approach taken by the XRP Ledger in case of such vulnerabilities and its commitment to decentralization.
Also Read | Ondo Stocks’ Growth Draws Attention as ONDO Price Outlook Improves
XRP Ledger Security Patch Bypasses Validator Approval
Protocol amendments in the XRP Ledger follow a procedure where a change needs more than 80% consensus among validators within two weeks before implementation.
Developers noted that waiting for the outcome of the vote on the XRP Ledger Security patch might have left the loophole open to exploitation.
According to the post by XRP Ledger developers on their blog on Sunday, the normal amendment process could have left the problem fix out in the open for several weeks before the amendment was activated, thus exposing the network to danger.
While the emergency patch ensured a quick resolution of the problem, bypassing the regular process was a major issue that questioned the involvement of the development teams in security breaches.
XRP Ledger Patch Sparks Decentralization Debate
The XRP Ledger Security response has raised controversy over whether XRPL is decentralized, which has been one of the main subjects in determining XRP’s legal standing.
Justin Bons, who is a co-founder of Cyber Capital, was critical of the emergency update. He said that talking about the decentralization of XRP was deceptive.
Binary distributions are executable files. In the absence of the prompt distribution of source code, independent developers will have limited time to analyze the changes made.
XRP Ledger Foundation explained that the emergency patch was “jointly agreed upon” by the Foundation, RippleX, developers, and validators due to the seriousness of the bug found in the code. They emphasized that there was no one dictating the decision-making process, and the operators are still free to use whatever software they prefer.
Validator operator XRP Kuwait also supported the emergency patching process by stating that collaboration does not mean centralization.
The controversy around XRP Ledger Security is again putting a question mark over transparency and accountability during emergency patches.
XRP Ledger Bug Exposed Integer Overflow Risk
As per the vulnerability report, the issue with the XRP Ledger Security vulnerability bug was an integer overflow in the payment engine, which had persisted since 2015. Calculations above the fixed maximum limit produced smaller results.
An attacker could have used this vulnerability by sending hundreds of offers asking for huge amounts of XRP in exchange. After the calculation, the attacker would have received those amounts while the buyer would have paid less than the required amount, which may have resulted in extra spendable XRP.
This particular attack needed offers that were specially made, and this cannot happen during the regular process of trading.
The XRP Ledger Security patch was designed to prevent this calculation error from being used to bypass the network’s supply rules.
How Is RippleX Improving XRP Ledger Security?
RippleX intends to enhance XRP Ledger Security through vulnerability detection using AI, adversarial testing, formal verification, and collaborating with external security experts.
The objectives behind such efforts include finding any bugs in the code, testing any possible attacks, and identifying vulnerabilities before exploitation. RippleX is interested in enhancing security for the whole system of code, not just fixing any detected vulnerabilities.
XRP Ledger Security Incident Impact
The emergency fix reveals a problem of maintaining blockchain security alongside transparency in the decision-making process. Although fast implementation is essential to protect against potential attacks, it raises issues with decision-making processes and access to source code.
The developers claimed that the vulnerability made it necessary to skip the procedure, whereas the Foundation claimed that coordination did not affect the independence of validators.
The incident with XRP Ledger Security illustrates the need for the development of emergency protocols.
Also Read | Zcash Whale Accumulates $31.93M as ZEC Price Outlook Draws Attention
