The XRP Ledger Foundation has defended its Sept. 25 emergency security patch for a payment-engine bug that could have minted XRP beyond the ledger's fixed 100-billion-token supply, arguing that the network's standard two-week validator vote would have left the flaw exposed to attackers.

The fix landed three days after a bug bounty report and took effect immediately on any server that installed it. It marked the first deliberate bypass of XRPL's normal amendment process since that governance mechanism was introduced more than ten years ago, the developers said.

"With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security," XRPL developers wrote in a post on X on Sunday.

What was the bug?

According to the project's vulnerability disclosure report, the flaw was an integer overflow in the ledger's payment engine that had existed since 2015. XRP balances are stored as 64-bit integers with a fixed maximum. When a sum exceeded that maximum, the calculation wrapped to a smaller number instead of failing outright.

An attacker could have exploited this by creating hundreds of specially priced offers, each requesting a very large amount of XRP, then sending a single payment that consumed them all. The engine would credit each offer owner the full amount while charging the buyer only the tiny wrapped total. The difference would be newly created, spendable XRP.

The attack required deliberately constructed offers and could not be triggered by normal trading activity. Developers said they found no evidence the issue was exploited on any public network.

Why skip the amendment vote?

The expedited release drew criticism. Cyber Capital founder Justin Bons said Thursday that marketing XRP to retail investors as decentralized amounted to "straight-up fraud." He argued the Sept. 25 emergency release shipped as binaries only, temporarily withheld the source code and pressured operators to upgrade.

The episode touches a sensitive point. XRPL markets itself on its website as a fully decentralized, public blockchain — a characterization central to arguments that XRP is not a security. A patch pushed through outside normal governance feeds directly into that debate.

The Foundation responded that the decision to skip the amendment process was made jointly by the Foundation, RippleX, core developers and validators after assessing the bug's severity.

"No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments," the Foundation said.

XRP Kuwait, an independent validator operator, also rejected the centralization claim. "We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control," it said. "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

What are the operational consequences?

The disclosure clarifies the practical governance boundaries of the network. Emergency fixes can ship immediately as software releases, but making a specific version mandatory still requires a supermajority of validators over the standard two-week window — a threshold version 3.4.1 met with more than 80% support.

For node operators, the calculus is now explicit: coordinated rapid upgrades remain possible under consensus, while binding protocol changes stay locked behind the amendment process. Critics, Bons among them, will likely continue probing how source-code availability and upgrade pressure were handled during the three-day window between the bounty report and the patch.

The episode also confirms that XRPL's fixed-supply guarantee relied for roughly a decade on an integer boundary that no one had audited into safety. The Foundation's disclosure report now gives developers and validators a template for how future critical disclosures — assessment, coordinated release, retroactive amendment vote — will be handled when the next severe bug surfaces.