XRP Ledger (XRPL) developers have defended the emergency security patch deployed to fix a bug capable of creating XRP beyond the network's fixed supply, arguing that they could not wait for the blockchain's usual two-week validator vote without exposing the flaw to potential attackers.

Unlike networks that mint new coins over time, the XRP Ledger launched with its entire supply of 100 billion XRP already in existence — which is why a code path capable of minting additional tokens struck at a foundational property of the asset.

The patch was released on Sept. 25, three days after a bug bounty report, and took effect immediately on any server that installed it. According to the developers, it marked the first deliberate bypass of the network's standard amendment process since that system was introduced more than ten years ago. Under that process, protocol changes ship as amendments and only activate after more than 80% of validators support them for two consecutive weeks — the same threshold the XRPL Foundation later cited in defending the mandatory move to version 3.4.1.

"With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security," XRPL developers said in an X post on Sunday.

The expedited fix has raised questions about the degree of decentralization on the XRP Ledger. On its website, XRPL describes itself as a fully decentralized, public blockchain — a characterization that has been central to arguments that its native token, XRP, should not be classified as a security. Those arguments carry regulatory weight: the U.S. Securities and Exchange Commission sued Ripple in December 2020, alleging unregistered securities offerings of XRP, and the degree of XRP's decentralization has been a recurring point of argument in that case.

Security fix "raised a lot of questions"

Justin Bons, founder of Cyber Capital, said Thursday that marketing XRP to retail investors as decentralized amounted to "straight-up fraud." He argued that the Sept. 25 emergency release shipped as binaries only, temporarily withheld the source code, and pressured operators to upgrade.

The XRPL Foundation, however, said the decision to skip the standard amendment process was made jointly by the Foundation, RippleX, core developers, and validators after assessing the severity of the bug.

"No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments," the foundation said.

XRP Kuwait, an independent validator operator, also rejected claims that the coordinated upgrades signaled centralized control.

"We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control," it said in an X post. "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

Bug could have minted unlimited XRP

According to the project's vulnerability disclosure report, the bug was an integer overflow in the XRP Ledger's payment engine that had been present since 2015.

XRP balances are stored as 64-bit integers with a fixed maximum. When a sum exceeded that maximum, the calculation wrapped around to a smaller number instead of failing.

An attacker could exploit the flaw by creating hundreds of specially priced offers, each asking for a very large amount of XRP, and then sending a single payment that consumed all of them. The engine would credit each offer owner their full amount while charging the buyer only the tiny wrapped total — with the difference materializing as newly created, spendable XRP.

The attack required deliberately constructed offers and could not be triggered by normal trading activity, according to the report. Developers said they found no evidence that the issue was ever exploited on any public network.

How a flaw in one of the ledger's core components went undetected for roughly a decade remains an open question in the debate the disclosure has stirred.