XRP Ledger developers published a vulnerability disclosure report on Friday, Oct. 9, describing an integer overflow in the ledger’s payment engine. Exploited, it would have handed an attacker newly minted, spendable XRP “far beyond the total supply” in one transaction.
The flaw was fixed in xrpld 3.4.1, released on Sept. 25. “We have found no evidence that this issue was exploited on any public network,” the report said.
Researcher Cayden Liao and Veria AI flagged the issue through the XRPL bug bounty program on Sept. 22. The submission rated it Major; RippleX engineers raised it to critical after reproducing the mint on a standalone server and confirming the new XRP could be spent in a follow-up payment. The report said the bug had likely existed since the current payment engine was written in 2015.
In a post on X, Liao wrote that the bug “let anyone mint infinite XRP, with $94B at risk.” The report itself gives no XRP or dollar amount.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
How the Exploit Worked
An attacker would open a few hundred accounts, have each post a deliberately mispriced offer demanding an enormous amount of XRP for a sliver of some token, then route one payment through every offer at once. The engine totaled what the payer owed with unchecked 64-bit addition, so the sum rolled over to a tiny figure. Each offer owner received the full amount, while the payer was debited only the rolled-over number.
Neither of two existing safety checks caught it. The invariant meant to stop XRP creation relied on the same unchecked math, and the per-account limit only trips when one account holds more than the entire supply. The setup required only a few hundred XRP in reserves, which can be reclaimed, plus fees, according to the report.
No Amendment Vote
The fix took effect on each server as soon as it upgraded, skipping the usual process in which a rule change must keep more than 80% validator support for two weeks. The report called it the first change to transaction processing deliberately shipped that way since amendments were introduced more than a decade ago, arguing that because xrpld is open source, a voted fix would have exposed the bug for weeks while it remained exploitable. More than 80% of default UNL validators ran 3.4.1 on release day, when its source code had not yet been published. The report says the source code has now been published.
“This case does not change how the XRP Ledger makes protocol changes,” the report said, adding that bypassing amendments “only makes sense for the most severe bugs, where the exploit is even worse than a network halt.”
The XRP Ledger Foundation said on X on Sunday that no XRP had been created. “About 99.986 billion XRP exist today,” it wrote. “AI makes bugs like this faster to find, for the bad guys and the good guys.”
The report also disclosed a second, lower-impact bug in the Batch feature, which was not yet live on Mainnet at the time; its fix, the fixBatchV1_2 amendment, activated Oct. 9. Developers said every security finding marked as fixed will now be re-tested against each release candidate before it is closed.
Related Listen: How OpenAI’s Math Dump Has Crypto Rethinking Its Cryptography: Uneasy Money
The post XRP Ledger Fixes Bug That Could Have Broken the Token’s Fixed Supply appeared first on Unchained.