XRP Ledger fixes bug that could have minted 18 trillion XRP
The XRP Ledger patched a payment bug on Sept. 25 that could have created spendable XRP beyond its 100 billion supply cap in a single transaction.
The Blocktape Editors 2 min read c765da
RippleX shipped a fix for a payment-engine bug in XRP Ledger software on Sept. 25 that could have let attackers create and spend XRP beyond the network’s supply cap. The XRP Ledger’s disclosure report says the flaw was present in the payment engine since 2015, affected versions 3.4.0 and earlier, and showed no evidence of exploitation on a public network.
How could the bug have created new XRP?
The payment engine could miscount a single payment that consumed hundreds of order-book offers, the report says. When it added the amounts, a total exceeding the limit of a 64-bit integer wrapped around to a small number: offer owners received the full amounts, while the buyer paid only the wrapped total.
The ledger’s “no XRP created” safety check used similar arithmetic and also missed the difference. An attacker could spread the new XRP across hundreds of accounts to avoid a separate account-balance check. RippleX reproduced the exploit on a standalone server and confirmed the XRP could be spent in a later payment.
How much XRP could one transaction have created?
Veria Labs co-founder Cayden Liao estimated that one exploit transaction could have created about 18 trillion XRP, according to The Block’s report. That is about 184 times the ledger’s original 100 billion XRP supply; transaction fees have since reduced the circulating total.
The attack required hundreds of specially priced offers and a payment designed to consume them together; the disclosure says ordinary payments and trades could not trigger the overflow. The required account and offer reserves amounted to a few hundred XRP and were recoverable, alongside transaction fees.
Why did RippleX ship the fix without a validator vote?
The fix took effect as each server upgraded to version 3.4.1, instead of waiting for the usual amendment process. RippleX said that process could have left the vulnerability exposed for weeks while validators voted and waited for activation; more than 80% of default Unique Node List validators ran the patched version on release day.
The XRP Ledger disclosure says server operators must upgrade to version 3.4.1 or newer to maintain network sync.
Source material
- XRP Ledger’s disclosure report — xrpl.org
- The Block’s report — theblock.co