Current outcome
Ripple's xrpld 3.4.1 disclosure details a critical payment-engine integer overflow that could have minted spendable XRP from thin air (patched 25 September, no exploitation found) and a batch-transaction encapsulation validation flaw addressed by the fixBatchV1_2 amendment, activated on mainnet on 9 October. Subsequently, ZachXBT publicly criticized the XRP Ledger Foundation for paying only $250,000 to the white-hat hacker who reported the payment-engine flaw, arguing the low bounty discourages responsible disclosure.
Progress timeline
2 material updates- #01
【Ripple 披露两项漏洞修复：支付引擎整数溢出可凭空铸造 XRP，批量交易封装校验亦存共识风险】
Ripple's xrpld 3.4.1 disclosure details a critical payment-engine integer overflow that could have minted spendable XRP from thin air (patched 25 September, no exploitation found) and a batch-transaction encapsulation validation flaw addressed by the fixBatchV1_2 amendment, activated on mainnet on 9 October.
Source evidence: foresightnews
- #02
ZachXBT指责XRPL仅向发现「无限XRP供应漏洞」白帽黑客支付25万美元赏金
ZachXBT publicly criticized the XRP Ledger Foundation for paying only $250,000 to the white-hat hacker who reported the payment-engine flaw that could have enabled unlimited XRP issuance, arguing the low bounty discourages responsible disclosure.
State after update: Ripple's xrpld 3.4.1 disclosure details a critical payment-engine integer overflow that could have minted spendable XRP from thin air (patched 25 September, no exploitation found) and a batch-transaction encapsulation validation flaw addressed by the fixBatchV1_2 amendment, activated on mainnet on 9 October. Subsequently, ZachXBT publicly criticized the XRP Ledger Foundation for paying only $250,000 to the white-hat hacker who reported the payment-engine flaw, arguing the low bounty discourages responsible disclosure.
Source evidence: theblockbeats