XRP Ledger Discloses Two Vulnerabilities Fixed in xrpld 3.4.1

The XRP Ledger disclosed two vulnerabilities fixed in xrpld 3.4.1, including a payment-engine arithmetic flaw that could have created spendable XRP if exploited.

The disclosure published Oct. 9 identified one bug involving validation of Batch inner-transaction wrappers and another involving XRP overflow in the payment engine. No mainnet funds were affected by the Batch issue, and no evidence showed that the overflow vulnerability had been exploited on a public network.

The XRP Ledger released xrpld 3.4.1 as an emergency security update on Sept. 25. The release introduced the fixBatchV1_2 amendment and included security and stability fixes. The relevant amendment activated on Oct. 9.

The payment-engine flaw had existed since the current payment engine was written. If exploited, it could have allowed an attacker to create spendable XRP through an arithmetic error. The available information does not connect the flaw to an attack, stolen funds or artificial intelligence.

The Batch vulnerability involved incorrectly wrapped inner transactions. The issue did not affect mainnet funds, while unsupported servers could become amendment-blocked after the relevant amendment activated.

The project initially kept the patch source private because releasing it immediately could have exposed details of the fixes. The code was scheduled for publication with a technical retrospective.

The disclosure came as broader debate continued over software security in blockchain systems. Avalanche founder Emin Gün Sirer wrote Oct. 9 that artificial intelligence could find system-level software bugs before it breaks the cryptography used to authorize transactions. He did not identify a specific vulnerability or an AI-driven attack.

Ethereum Foundation researcher Justin Drake separately urged the industry to prepare for a possible future failure of ECDSA, the signature system discussed as securing transactions on Bitcoin and Ethereum. His proposal for “bunker mode” was precautionary, and the available information does not establish that ECDSA has been broken.