Skip to content
Crypto Bulletin

Markets, protocols and policy news

ID a7ed9d

XRP Ledger fixes flaw that could mint spendable tokens

XRPL's Sept. 25 release fixed an overflow flaw that could mint spendable XRP; developers say they found no evidence of exploitation on public networks.

Crypto Bulletin Newsroom 2 min read

XRP Ledger fixes flaw that could mint spendable tokens

The XRP Ledger’s xrpld 3.4.1 release, shipped Sept. 25, fixed a payment-engine flaw that could create spendable XRP, according to the XRPL vulnerability disclosure report. Published Oct. 9, the report says RippleX found no evidence that the bug had been exploited on a public network.

The report credits researcher Cayden Liao and Veria AI with reporting the issue through the XRPL bug bounty program on Sept. 22. RippleX reproduced the attack on a standalone server and confirmed the resulting XRP could be spent in a later payment.

How could the payment create XRP?

The payment engine summed XRP amounts from offers using unchecked 64-bit integer addition, the XRPL report says. When a payment consumed hundreds of specially priced offers, the total could exceed the counter’s limit and wrap to a small number.

The engine then credited offer owners with the full XRP amounts while charging the buyer only the wrapped total. The ledger’s “no XRP created” check used the same kind of arithmetic and also wrapped; splitting the proceeds across hundreds of accounts avoided the per-account balance limit, according to the report.

What did XRPL change in the release?

Version 3.4.1 makes the payment engine reject a sum that would overflow and uses a wider counter for the no-creation check, the disclosure says. The attack required hundreds of deliberately crafted offers and a payment designed to consume them; ordinary payments and trades would not trigger it.

The report says the exploit could have created XRP beyond the total supply and required only a few hundred XRP for account and offer reserves, most of which would be returned when the objects were removed, plus transaction fees. CoinDesk’s report on the patch said the XRP Ledger launched with a fixed supply of 100 billion XRP.

Sources