XRP flaw could allow tokens to be “minted out of thin air”: fixed—what should holders check?
What holders should check this time is whether nodes have been upgraded and the deposit and withdrawal status of the platforms they use—not assume that disclosure of the flaw means large amounts of XRP have already been minted. An official fix has been released, and no evidence of exploitation on the public network has been found so far; this is not a guarantee of absolute safety going forward.
On October 9, XRPL disclosed details of a payment engine flaw. The xrpld 3.4.1 patch had already been released in late September, so this was a disclosure after the fix—not a sudden token-minting incident that day.
The problem was in how the server performed calculations: a specially crafted transaction could cause the total amount to overflow, resulting in recipients receiving more while senders were charged less. The existing supply check used a similar algorithm, so a “fixed total supply” is no substitute for a correct implementation.
But don’t conflate the two fixes. The token-minting flaw was fixed as soon as nodes were upgraded; the rule fixing a separate Batch processing flaw was not activated until October 9. Now, nodes running old versions are blocked by the new rule and can’t keep up with the mainnet. You can’t judge a service to be working normally just because its website still opens.
If you run your own node, upgrade to version 3.4.1 or later as officially required, and check its sync status. If you hold XRP through a wallet or exchange, focus on the provider’s announcements and the deposit and withdrawal status for XRP; don’t try to “fix” your on-chain balance yourself.
Over the next 48 hours, I’ll be watching for verifiable evidence of abnormal token issuance or a mainnet outage, as well as providers’ upgrade and recovery announcements. Evidence of exploitation on the public network, or the same issue occurring on upgraded nodes, would raise the risk assessment. I’d lower the operational risk for this particular process only once it can be verified that the relevant service has synced and deposits and withdrawals have resumed—not based solely on the words “patch released.”
#XRP #资产安全 #Blockchain
What holders should check this time is whether nodes have been upgraded and the deposit and withdrawal status of the platforms they use—not assume that disclosure of the flaw means large amounts of XRP have already been minted. An official fix has been released, and no evidence of exploitation on the public network has been found so far; this is not a guarantee of absolute safety going forward.
On October 9, XRPL disclosed details of a payment engine flaw. The xrpld 3.4.1 patch had already been released in late September, so this was a disclosure after the fix—not a sudden token-minting incident that day.
The problem was in how the server performed calculations: a specially crafted transaction could cause the total amount to overflow, resulting in recipients receiving more while senders were charged less. The existing supply check used a similar algorithm, so a “fixed total supply” is no substitute for a correct implementation.
But don’t conflate the two fixes. The token-minting flaw was fixed as soon as nodes were upgraded; the rule fixing a separate Batch processing flaw was not activated until October 9. Now, nodes running old versions are blocked by the new rule and can’t keep up with the mainnet. You can’t judge a service to be working normally just because its website still opens.
If you run your own node, upgrade to version 3.4.1 or later as officially required, and check its sync status. If you hold XRP through a wallet or exchange, focus on the provider’s announcements and the deposit and withdrawal status for XRP; don’t try to “fix” your on-chain balance yourself.
Over the next 48 hours, I’ll be watching for verifiable evidence of abnormal token issuance or a mainnet outage, as well as providers’ upgrade and recovery announcements. Evidence of exploitation on the public network, or the same issue occurring on upgraded nodes, would raise the risk assessment. I’d lower the operational risk for this particular process only once it can be verified that the relevant service has synced and deposits and withdrawals have resumed—not based solely on the words “patch released.”
#XRP #资产安全 #Blockchain