The XRP Ledger community published a vulnerability report concerning XLS-68, the fee and reserve sponsorship mechanism. The issue was reported on August 7 during Devnet testing and affected xrpld 3.3.0 while the Sponsor amendment had not yet been activated on Mainnet.
The flaw could allow a sponsor to terminate sponsorship of certain objects without verifying that their owner could subsequently meet the required reserve. Under some conditions, this could have enabled objects without adequate reserve backing and undesirable ledger-state growth.
The key fact is that the vulnerability was identified before Sponsor activation on Mainnet. The fix was incorporated into xrpld 3.4.0, and the amendment should not be activated until the correction is present. The report also describes collaboration with the researchers who reported the issue and members of the XRPL Foundation.
This episode illustrates both the risks inherent in new protocol functionality and the value of Devnet testing and responsible disclosure. It would be misleading to describe the incident as an exploit of XRP Mainnet: the official report states that the affected amendment was not enabled there.