The XRP Ledger Foundation is facing strong criticism from the crypto community over the bounty paid for a critical security bug. Many users say the reward, reported at $250,000, is far too small for what was found. The bug allowed an attacker to create spendable XRP beyond the entire supply, according to the foundation’s own disclosure report.
How it turnedo out
The fix, version 3.4.1, went out weeks ago. Public binaries were released on September 25. The foundation says no XRP was created. It points out that XRP’s supply was fixed at one hundred billion at launch and that all ledger data is public. About 99.986 billion XRP exist today, because transaction fees are destroyed. It also says triggering the bug required hundreds of intentionally constructed operations, so ordinary payments should never encounter it.
Critics are not focused on the supply claim. They are angry about the payout. One person called the reward an absolute joke and warned that next time hackers will exploit first and ask for a bounty second. Another said the team deserves a bigger reward because the bug was catastrophic.
A third said the foundation must pay bug finders well, or future hackers will consider the cheaper option instead. The sharpest comment said XRP is a scam if a decent bounty is not paid, and that the next flaw might not be disclosed responsibly.
Unsusual issuance pipeline
Normally, changes to the ledger go through an amendment process, in which validators vote over a period of weeks. This time the team skipped that step and shipped an emergency fix, the first time in over ten years.
You Might Also Like
The foundation says a public fix would have shown attackers where the bug was, and AI makes finding it fast. It says the network, RippleX, core developers, and validators agreed on the plan together.
Some users doubted the decentralization claims. One said a company they knew had trouble getting help to change a name within the ledger. Another asked why no safety stop exists if the supply goes above the cap. The foundation thanked Cayden Liao and Veria AI for reporting the bug responsibly. It also promised stronger testing and a larger bug bounty program. Whether this is enough to calm critics remains to be seen.
Be the first to comment