← Editorial XRP

XRP Ledger Discloses and Patches Critical Flaw in Payment Engine

XRP Ledger developers have fixed two software vulnerabilities, including a critical calculation error that could have permitted the creation of unbacked XRP tokens.

· -7

Developers behind the XRP Ledger disclosed two software vulnerabilities on October 9, 2026, including a critical flaw in the network's payment engine that could have enabled the unauthorized generation of spendable XRP tokens. The bug was patched in xrpld version 3.4.1 on September 25, with officials stating that no exploitation had been detected on any public network.

The payment engine issue stemmed from an overflow in how the system calculated required XRP across multi-offer order books, which could cause a buyer to be charged less than the amount credited to offer owners. The vulnerability was submitted by an independent researcher through the XRPL Bug Bounty program on September 22 and verified by the RippleX engineering team, who confirmed it required a complex setup of hundreds of unusually priced offers.

A second vulnerability was also identified in the network's Batch transaction mechanism, where incorrectly structured fields could have led to consensus disagreements between validator nodes. The issue was resolved through the fixBatchV1_2 amendment, and developers noted that the Batch feature had not yet been activated on the mainnet when the flaw was found.

How this piece reads Sell tone -7
Site call on XRP Neutral score 26.6

These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.

More on XRP All pieces →

Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.