XRP Ledger Ships xrpld 3.2.1 After Manifest Flood

XRP News

XRP (XRP), the native altcoin of the XRP Ledger, is at the center of an infrastructure advisory after Ripple engineering director Vijay Khanna urged node operators on Aug. 2 to install xrpld 3.2.1 following a July 31 validator-manifest flood. The episode did not stop the network: XRP Ledger Operations said ledgers continued closing normally, and available evidence points to resource pressure on nodes and peer-to-peer messaging rather than lost funds, altered transactions or a consensus failure. The fix targets the way servers handle validator manifests, the signed records that bind a validator’s permanent master identity to a rotating ephemeral key used for everyday validation messages. Before the patch, nodes could accept, store and relay structurally valid manifests from unknown master keys, giving an attacker a path to consume memory, storage, bandwidth and CPU by creating many unrecognized identities. The official release limits oversized manifests before full decoding, caps the number of untrusted manifests in a single message, restricts outbound sharing of fresh unknown keys and places a 100-entry ceiling on the cache for unrecognized validator identities. Operators are told to upgrade, confirm xrpld is running, then restart a second time so persisted or in-memory data can be cleared. The advisory also notes package-signing key rotation on Feb. 18, meaning older installations that do not trust the current key may miss automatic updates. A post-mortem has not yet been published, leaving the sender’s identity, message volume and node impact undisclosed. The hotfix follows xrpld 3.2.0, issued June 15, which renamed the reference server from rippled to xrpld and required configuration changes. Early adoption was stronger among validators than across the wider node network, making slower operators the main exposure if flooding resumes. For holders, the required action is limited to infrastructure providers, exchanges, custodians and data services that run their own ledger servers, while ordinary XRP users do not need to move tokens or change wallet keys.

The engineering warning, circulated publicly by Khanna on Aug. 1, frames xrpld 3.2.1 as a hotfix against a manifest-flood attack observed on July 31. The core issue involves validator identity management: each validator controls a stable master key and a changeable ephemeral key, while a manifest is a master-key-signed statement linking the two, distinct from blind signing because the master key explicitly authorizes the ephemeral key. Under the old behavior, a peer could distribute manifests that were structurally correct and cryptographically valid even when the master key was not listed, forcing other servers to process and spread data from strangers. The update hardens that propagation path with four explicit boundaries. A size cap rejects any single manifest larger than expected before it is fully decoded. A receive cap discards oversized incoming batches without tearing down the peer connection, allowing patched and unpatched nodes to remain linked during rollout. A send cap bounds the bulk manifest greeting transmitted to each new peer. A cache cap refuses additional unknown keys once 100 are held, while trusted and previously recognized validators continue to be processed. The release also stops unknown-key manifests from being written to persistent storage, so a flood cannot survive a reboot. That makes the second restart central to the remediation: the first update changes future behavior, while the later restart helps clear residual in-memory or persisted records from before the patch. Operators should also verify that their systems trust Ripple’s current package-signing key, because a February rotation could block automatic upgrades. Because the caps apply to unlisted peer gossip rather than approved validators, normal key rotation can continue while unchecked cache growth is blocked across the network. The guidance does not require ordinary wallet users to take token-level action, but it puts exchanges, custodians, wallet back ends and data providers on notice to confirm version numbers, restart status and monitoring before the promised post-mortem arrives.

COINOTAG’s proprietary 42-indicator composite S/R scoring engine shows XRP at $1.0808, up 1.77% in 24 hours, inside a downtrend with RSI 46.54 and a bearish MACD. Unlike an automated market maker pool, the signal reflects directional positioning. A key resistance level at $1.1239 scores 69/100, driven by EMA 50 and Ichimoku Senkou A, while stronger resistance at $1.2171 scores 72/100 from POC and SMA 100. Support at $1.0708 scores 68/100, backed by Pivot Point and BB Lower. Derivatives positioning is crowded long: funding is 0.0069%, open interest is $625.1 million and the long/short ratio is 3.15, with Fear and Greed at 27. A reclaim of $1.0966 could stabilize the token, but losing $1.0708 would expose $1.0217 and deepen bear-market pressure.