In brief
- XRP Ledger maintainers disclosed and patched a critical payment-engine overflow bug, reported via bug bounty in September, that could have let an attacker create counterfeit XRP.
- The flaw sat unnoticed since 2015 because no normal payment triggers it, and the ledgers “no XRP created” safety check used the same broken arithmetic.
- There is no evidence the bug was ever exploited, XRP Ledger devs say.
Developers behind the XRP Ledger have disclosed and fixed a critical vulnerability that, left unaddressed, could have let an attacker conjure XRP out of thin air, a flaw that sat dormant in the networks code for roughly a decade.
In a disclosure published Friday, the ledgers maintainers said a researcher reported the bug through the XRPL bug bounty program in September. The issue was an integer overflow in the payment engine, the part of the software that processes payments.
Myriad: Where does XRP go next？ Click to make your prediction.
When a single payment consumed hundreds of specially crafted offers from the order book, the sum of what the buyer owed exceeded the maximum value the system could store and “wrapped around” to a tiny number. The engine paid each seller in full but charged the buyer almost nothing, with the difference amounting to newly minted XRP that should never have existed.
Worse, the ledger‘s built-in safety check meant to confirm no transaction creates XRP used the same flawed arithmetic, so it wrapped around identically and caught nothing. The maintainers said an attacker could have created spendable XRP far beyond the token’s total supply in a single transaction, then moved it, traded it or sent it to exchanges.
BitcoinBTC · USD
$83,000−3.25%
24H7D1M1YYTD
Oct 5Oct 7Oct 9Oct 11Oct 12
$86.6k$84.6k$82.7k$80.7k
24h HighHigh$84,231
24h LowLow$82,281
VolVol$1.0B
Market projectionsOdds by Myriad
Today$82,000 to $84,000$82k–$84k69% chanceThis weekBelow $84,000Below $84k62% chance
→
Buy Bitcoin with USDT
Powered by Jupiter
$50$100$500
Buy
Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →
RippleX engineers confirmed the bug had been present since the current payment engine was written in 2015 and went unnoticed because no ordinary payment comes anywhere near triggering the overflow.
There is no evidence it was ever exploited, the team said. The fix shipped in version 3.4.1 on Sept. 25, and more than 80% of the networks trusted validators were running it that day.
Notably, the patch bypassed the ledgers usual amendment process, which requires validators to vote and wait two weeks before a change takes effect, the first time a transaction-processing change has deliberately shipped that way since the system was introduced over a decade ago. The maintainers said the severity justified it, since the open-source fix would have revealed the bug while leaving it exploitable for weeks.
The disclosure echoes a counterfeiting scare that rocked Zcash this year, when the privacy coin raced to patch a soundness bug in its shielded pool that could have allowed forged coins. That episode sent ZEC tumbling before the networks Ironwood upgrade resolved it.
XRP didnt escape the week unscathed. The token traded at $1.38 on Monday, down 1.6% over 24 hours, the worst performance among major cryptocurrencies, and off 9.4% over the past seven days.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Your Email
Get it!
Get it!