The XRP Ledger Foundation has confirmed that it has patched a critical security vulnerability found in Ripple’s yet-to-be-enabled XRP Ledger patch, preventing a potentially solemn exploit.
On February 19, a security engineer at cybersecurity firm Cantina, Pranamya Keshkamat, and the Cantina AI security bot identified a “critical logic error” in the signature validation logic of the Ripple blockchain, XRP Ledger, reported XRP Ledger Foundation on Thursday.
A vulnerability in the signature verification code package patch would allow an attacker to perform transactions from victims’ accounts, including draining funds, without requiring the victim’s private keys.
“The fix was in the voting phase and was not activated on the mainnet; no funds were at risk,” XPLF stated.
Exploitation could destabilize the ecosystem
In addition to the potential for theft of funds and modification of the ledger state, the vulnerability could have “destabilized the ecosystem,” XPLF said.
“A successful large-scale exploit could result in a significant loss of trust in XRPL, which could potentially cause significant disruption to the broader ecosystem.”
Related: Cybersecurity stocks fall after Anthropic launches Claude Code Security
Cantina and Spearbit CEO Hari Mulackal he said“Our autonomous bug hunter Apex found this critical bug.”
“If exploited, it would be the world’s largest security hack in terms of dollar value, with an immediate risk of almost $80 billion,” he added, likely referring to XRP (XRP) market capitalization.
The emergence of AI cybersecurity scanners
An autonomous AI security tool developed by Cantina AI identified the vulnerability through “static analysis of the collapsed codebase” and provided a disclosure report, allowing Ripple’s engineering teams to inspect it and begin patching the code.
Validators were asked to vote against the patch, and an emergency release (version 3.1.1) was published on February 23 to block activation of the patch, XPLF said.
Artificial intelligence is increasingly being deployed for cybersecurity purposes to detect errors in code that can be missed by human eyes.
Anthropic’s February 20 release of Claude Code Security, an artificial intelligence-based cyber vulnerability scanner that it claims “can reason like a skilled security researcher,” caused shares of public IT security companies to tumble on February 20.
Warehouse: Artificial Intelligence Won’t Make You Rich, But Crypto Gaming Can, Axie Founder Steps Down: Web3 Gamer
