- An integer overflow in the XRP Ledger’s payment engine could have let an attacker create spendable XRP, according to a disclosure report published on 9 October.
- The fix shipped in xrpld 3.4.1 on 25 September without a validator vote, a first since amendments began more than ten years ago.
- Veria Labs, which reported the flaw, says a single transaction could have created 18 trillion XRP and that it received the maximum US$250,000 bounty.
XRP Ledger developers disclosed on 9 October a flaw in the network’s payment engine, dating to 2015, that could have let an attacker mint XRP from nothing.
They found no evidence that it was exploited on any public network, the disclosure report states. Their fix went out in xrpld 3.4.1, the ledger’s server software, on 25 September. The bug sat where the engine adds up amounts in a single payment that consumes many order-book offers.
XRP amounts in that sum are integers with a fixed maximum, and a total past that limit wrapped around to a small number. The engine then paid each offer owner in full but charged the buyer only the wrapped total.
A built-in safety check meant to confirm that no transaction creates XRP summed balance changes the same way. It wrapped around identically and caught nothing.
Read more: OpenAI Executive Apologises Over Botched Handling of Australian Data Incidents
Found Through the Bug Bounty
A researcher filed the flaw through the XRPL Bug Bounty programme on 22 September, and the report credits Cayden Liao and Veria AI. Ripple’s engineering arm, RippleX, reproduced the flaw the same day and raised its severity to critical.
Veria Labs says its AI agent found two overflows and chained them into a working exploit on a local network. By Veria’s count, a single transaction could have created 18 trillion XRP, 184 times total supply. Veria says it received the programme’s maximum US$250,000 (AU$357,500) bounty.
The attack needed only a few hundred XRP in reserves plus fees, the report notes. It also required hundreds of offers priced in a way no real trader would use.
Changes to transaction processing normally ship as amendments, which take effect only after more than 80% of trusted validators back them for two weeks. This fix applied on each server as soon as it was upgraded.
Because xrpld is open source, a fix waiting on a vote would have exposed the bug for weeks while it stayed exploitable, the report says. More than 80% of validators on the default list ran 3.4.1 on release day, before its source code was published.
They added that amendments remain the rule, with this route kept for the most severe bugs. Their security model layers audits and public contests, such as Ripple’s US$200,000 (AU$286,000) attackathon on the lending protocol, on top of the bounty.
Read more: Bitcoin Falls Below $83K as US Government Moves $332M in BTC to Coinbase Prime
Be the first to comment