XRP Ledger fixes bug that could have created 18 trillion XRP

The XRP Ledger patched a payment bug that could have let an attacker create and spend new XRP, putting its fixed supply at risk. The XRPL’s October 9 security report says developers found no evidence the flaw was used on any public network.

The flaw was in the ledger’s payment engine and had likely been present since 2015. RippleX, the ledger’s developer team, says a researcher reported it through the XRPL bug bounty program on September 22. Engineers reproduced the attack and confirmed that XRP created this way could be spent in a later payment.

How could one payment create new XRP?

The attack relied on a number overflow: a total grew beyond what the software’s counter could hold, then wrapped around to a small number. An attacker could set up hundreds of accounts, each offering a tiny amount of another token for an unusually large amount of XRP, then use one payment to take all the offers.

The payment engine would credit each seller the full XRP amount but charge the buyer only the wrapped total. The ledger’s check meant to catch newly created XRP used similar counting and could miss the difference. The XRP Ledger report says the attack required offers priced in a way no real trader would use, followed by a payment built to consume them all at once.

Veria Labs co-founder Cayden Liao estimated that one exploit transaction could have created about 18 trillion XRP, according to The Block’s report on the flaw. That is 184 times the 100 billion XRP created at launch. The estimate is Liao’s; the XRPL disclosure confirms the risk of creating spendable XRP but does not give that total.

How did developers close the flaw?

The fix shipped in xrpld 3.4.1 on September 25. The software now checks whether a payment total would overflow and stops that part of the payment if it would. Developers also changed the “no XRP created” safety check to use a wider counter that cannot wrap around in the same way.

For this fix, operators did not wait for the ledger’s usual validator vote. The disclosure says the fix took effect as each server upgraded, and more than 80% of default trusted validators were running version 3.4.1 or later on release day. RippleX said the risk of leaving a critical exploit open justified that route.

References

• XRPL’s October 9 security report — xrpl.org
• The Block’s report on the flaw — theblock.co