ZachXBT Criticizes XRPL Bug Bounty as Too Low: Only $250K Reward Could Weaken White Hat Hackers' Willingness to Report Vulnerabilities

Odaily Report: On-chain detective ZachXBT retweeted the XRP Ledger Foundation's explanation regarding a previous critical security vulnerability and criticized its bug bounty mechanism.

ZachXBT stated that XRPL, which holds billions of dollars in assets, only paid a $250,000 reward to the white hat hacker who discovered the critical vulnerability. He believes that this level of reward could weaken security researchers' incentive to proactively report vulnerabilities, and may even encourage attackers to exploit vulnerabilities for massive gains rather than responsibly disclosing the issue.

Previously, the XRP Ledger Foundation confirmed that the vulnerability could theoretically bypass the XRP total supply limit, but no additional XRP was found to have been created as a result, and the vulnerability has been fixed through version 3.4.1.