Key Takeaways
- A decade-old XRP Ledger bug could have created approximately 18.45 trillion spendable XRP in one transaction.
- Developers patched the vulnerability on September 25 and found no evidence of exploitation on public networks.
- More than 80% of default-list validators upgraded that day, applying the emergency fix without the usual amendment waiting period.
XRP Ledger developers have patched a critical vulnerability that could have allowed an attacker to create trillions of spendable XRP, bypassing the network’s fixed-supply rules.
The payment-engine bug appears to have existed since 2015, according to a research disclosure. RippleX engineers confirmed the flaw could generate XRP that could then be transferred in a follow-up payment. They found no evidence of exploitation on any public network.
Researcher Cayden Liao’s security firm, Veria Labs, said its proof of concept could create approximately 18.45 trillion XRP in one transaction, about 184 times the token’s original 100 billion supply.
An Arithmetic Error Could Have Created Spendable XRP
The vulnerability affected how the XRP Ledger calculated payments passing through its order books.
When a payment consumed multiple offers, the engine added together the amounts owed using a 64-bit integer. That counter had a maximum value, but the software did not check whether the combined total exceeded it.
Instead of rejecting an excessive sum, the calculation wrapped around to a small number. The engine could consequently credit offer owners with their full amounts while charging the buyer only the much smaller total.
The difference would become newly created XRP.
Two safeguards failed to prevent that outcome. The check designed to ensure transactions never created XRP used similarly vulnerable arithmetic. A separate account-level check could be bypassed because the resulting balances were distributed across many accounts.
Developers said ordinary payments could not accidentally trigger the flaw. It required a deliberately constructed activity with values far outside normal trading conditions.
However, exploiting it would not have required substantial starting capital or privileged access, making the potential consequences particularly severe.
Researchers Earned a $250,000 Bounty
Liao and Veria reported the vulnerability through the XRPL bug bounty program on Sept. 22.
RippleX engineers reproduced the issue on a standalone server, confirmed the newly generated XRP was spendable, and raised its severity from Major to Critical.
Veria said an AI security agent identified the weaknesses, connected them, and produced a working local demonstration. The firm reported receiving the program’s maximum bounty of $250,000. Its technical account indicates a potential issuance of approximately 18.45 trillion XRP per attack transaction.
That figure describes a demonstrated vulnerability, rather than tokens actually issued on the public ledger.
The XRP Ledger Foundation subsequently emphasized that XRP’s original supply remained intact, except for transaction fees, which are destroyed. It said ledger balances are public and that its monitoring had found no unauthorized issuance.
The distinction matters: the disclosure exposed a failure in enforcing XRP’s supply rules, but it did not establish that those rules had been violated on Mainnet.
The developers attributed the bug’s longevity to an unusual calculation that normal payments would never reach, allowing the error to remain dormant for roughly a decade.
Validators Applied an Emergency Fix
Developers released the patch in xrpld 3.4.1 on Sept. 25. More than 80% of validators on the default Unique Node List upgraded that day.
Unusually, the overflow fix took effect immediately upon each server’s upgrade, bypassing the normal amendment activation process.
Protocol changes typically require sustained validator support for two weeks. Developers argued that publishing the patch while leaving the vulnerability active during that waiting period would expose the network to an unacceptable risk.
The accelerated rollout carried its own danger: upgraded and older servers could disagree if someone attempted the exploit during the transition.
The patch added overflow checks and strengthened the supply-protection counter. Separately, the release fixed a Batch transaction validation bug through the normal amendment process.
Developers also pledged to retest every security finding against release candidates before marking it resolved, strengthening verification after the emergency response.
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
