Odaily Planet Daily reports that on-chain investigator ZachXBT reposted a statement from the XRP Ledger Foundation about a previously disclosed critical security vulnerability and criticized its bug bounty program.
ZachXBT said that XRPL holds billions of dollars in assets, yet paid a white-hat hacker only $250,000 for discovering a critical vulnerability. He believes rewards at this level could discourage security researchers from proactively reporting vulnerabilities, and might even lead attackers to exploit them for huge profits rather than disclose them responsibly.
Previously, the XRP Ledger Foundation confirmed that the vulnerability could theoretically have bypassed the XRP total supply limit, but no additional XRP was found to have been created as a result. The vulnerability was fixed in version 3.4.1.
ZachXBT said that XRPL holds billions of dollars in assets, yet paid a white-hat hacker only $250,000 for discovering a critical vulnerability. He believes rewards at this level could discourage security researchers from proactively reporting vulnerabilities, and might even lead attackers to exploit them for huge profits rather than disclose them responsibly.
Previously, the XRP Ledger Foundation confirmed that the vulnerability could theoretically have bypassed the XRP total supply limit, but no additional XRP was found to have been created as a result. The vulnerability was fixed in version 3.4.1.