XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015

Developers behind the XRP Ledger have disclosed and fixed a critical vulnerability that, left unaddressed, could have let an attacker conjure XRP out of thin air, a flaw that sat dormant in the network’s code for roughly a decade.

In a disclosure published Friday, the ledger’s maintainers said a researcher reported the bug through the XRPL bug bounty program in September. The issue was an integer overflow in the payment engine, the part of the software that processes payments.

When a single payment consumed hundreds of specially crafted offers from the order book, the sum of what the buyer owed exceeded the maximum value the system could store and “wrapped around” to a tiny number. The engine paid each seller in full but charged the buyer almost nothing, with the difference amounting to newly minted XRP that should never have existed.

Worse, the ledger’s built-in safety check meant to confirm no transaction creates XRP used the same flawed arithmetic, so it wrapped around identically and caught nothing. The maintainers said an attacker could have created spendable XRP far beyond the token’s total supply in a single transaction, then moved it, traded it or sent it to exchanges.

RippleX engineers confirmed the bug had been present since the current payment engine was written in 2015 and went unnoticed because no ordinary payment comes anywhere near triggering the overflow.

There is no evidence it was ever exploited, the team said. The fix shipped in version 3.4.1 on Sept. 25, and more than 80% of the network’s trusted validators were running it that day.

Notably, the patch bypassed the ledger’s usual amendment process, which requires validators to vote and wait two weeks before a change takes effect, the first time a transaction-processing change has deliberately shipped that way since the system was introduced over a decade ago. The maintainers said the severity justified it, since the open-source fix would have revealed the bug while leaving it exploitable for weeks.

The disclosure echoes a counterfeiting scare that rocked Zcash this year, when the privacy coin raced to patch a soundness bug in its shielded pool that could have allowed forged coins. That episode sent ZEC tumbling before the network’s Ironwood upgrade resolved it.

XRP didn’t escape the week unscathed. The token traded at $1.38 on Monday, down 1.6% over 24 hours, the worst performance among major cryptocurrencies, and off 9.4% over the past seven days.