A security patch released before its full code was made public has ignited a dispute over XRP Ledger governance and the network’s response to critical vulnerabilities. In a video addressing the controversy, Kamilah Stevenson, a finance commentator and longtime XRP holder, argues that the restricted disclosure protected the network rather than substantiated allegations of fraud.
The criticism came from Cyber Capital fund manager Justin Bonds, who challenged both the upgrade process and the influence of recommended validator lists. The dispute raises two distinct questions for investors: how developers handle dangerous vulnerabilities, and how much discretion network operators retain.
A security patch before full disclosure
Stevenson says a researcher reported an overflow vulnerability through the XRP Ledger’s bug bounty program on September 22. The flaw, which she says had existed since around 2015, potentially allowed an attacker to obtain XRP improperly or create unauthorized tokens.
According to her account, developers released version 3.4.1 on September 25 without immediately publishing the full fix code. More than 80% of main validators upgraded that day, and an amendment activated on October 9, leaving nodes without the update unable to remain synchronized.
Dr. Stevenson reports that a subsequent ledger audit found no exploitation or unauthorized XRP creation. The transcript does not identify the auditor or provide the underlying report.
She compares the response with Bitcoin Core’s handling of a 2018 vulnerability: developers initially disclosed a crash risk, withholding its inflation implications until users had time to upgrade.
“You protect the network first and you explain second,” she says. That comparison supports delayed vulnerability disclosure, though it does not by itself resolve concerns about inspecting the XRP update.
The validator list remains the harder question
Stevenson acknowledges that publishers of recommended Unique Node Lists wield influence because many operators adopt those defaults. Operators can choose their own lists, she says, while Ripple runs only one validator on the most commonly used list.
She also points to the amendment threshold: more than 80% validator support sustained for two weeks. Those safeguards challenge the idea that Ripple can unilaterally rewrite ledger rules, but validator ownership alone does not settle questions about influence over defaults.
In a nutshell, the promised code release and technical write-up would offer firmer grounds for judging this episode than either a fraud allegation or assurances from an XRP holder.