Key Takeaways
- The XRP Ledger fixed a vulnerability that could have allowed attackers to create spendable XRP beyond its intended 100 billion supply limit.
- Researchers demonstrated that a specially crafted transaction could potentially create around 18 trillion XRP, but developers found no evidence of exploitation on a public network.
- The emergency fix was released in xrpld version 3.4.1 on September 25, with the technical details disclosed on October 9.
The XRP Ledger Foundation has reassured the community that XRP’s 100 billion token supply remains intact after developers fixed a critical software vulnerability that could have allowed attackers to create additional XRP.
The flaw, believed to have existed since 2015, affected the ledger’s payment engine and could have allowed specially crafted transactions to create spendable XRP without the corresponding payment. Researchers demonstrated the issue during controlled testing, but the development team said it found no evidence that the vulnerability had been exploited on a public network.
The emergency fix was released in September, although the full technical details were not made public until October 9. The disclosure has raised questions about how the vulnerability escaped detection for years and why developers decided to bypass the XRP Ledger’s usual amendment process to address it.
XRP Ledger Fixes Bug That Could Have Created Trillions of XRP
The vulnerability involved an integer overflow in the XRP Ledger’s payment engine, which processes payments and transactions involving offers on the network’s built-in exchange.
An integer overflow occurs when a calculation exceeds the maximum value that a computer system can represent using a particular data type. Instead of producing an error, the calculation can wrap around to a much smaller number.
According to the official vulnerability disclosure report, the payment engine could incorrectly calculate the total amount owed when a transaction consumed hundreds of specially prepared offers.
The engine could credit offer owners with the full XRP they were owed while charging the buyer only the incorrectly calculated total. The difference would effectively create new XRP that had not previously existed.
Security researcher Cayden Liao and Veria AI discovered the vulnerability and reported it through the XRP Ledger’s bug bounty program on September 22. RippleX engineers reproduced the issue in a controlled environment and confirmed that the newly created XRP could be spent in a subsequent transaction.
The researchers showed that a carefully constructed transaction could create about 18 trillion XRP, far exceeding the ledger’s intended supply.
That figure represents the potential impact demonstrated in testing, not XRP that was actually created or entered circulation.
Why the 100 Billion XRP Supply Limit Was at Risk
All 100 billion XRP were created when the XRP Ledger launched in 2012. Unlike Bitcoin, which issues new coins through mining rewards, XRP does not have an ongoing mining-based issuance process.
The ledger’s software includes checks intended to prevent transactions from creating new XRP. However, the vulnerability affected both the payment calculation and a safety check designed to detect changes in the total XRP supply.
Because the safety check relied on similar fixed-width arithmetic, it could experience the same overflow and fail to detect the newly created tokens.
The researchers’ method also involved distributing the amounts across multiple accounts, helping avoid a separate limit on how much XRP a single account could receive.
The attack required hundreds of deliberately constructed offers and a specially designed payment. According to the official report, it would have required only a few hundred XRP in account and offer reserves, most of which could be recovered, along with transaction fees.
This made the flaw particularly concerning: the potential damage was far greater than the resources needed to attempt the exploit.
However, developers said they found no evidence that the vulnerability was used on a public network. The disclosure therefore describes a serious potential attack rather than a confirmed loss of XRP.
Emergency Patch Released Without the Usual Amendment Vote
RippleX released xrpld version 3.4.1 on September 25, three days after the vulnerability was reported. The XRP Ledger’s technical disclosure followed on October 9, after developers had worked to protect the network.
The decision to release the fix without waiting for the normal amendment process was unusual.
Under the XRP Ledger’s standard procedure, protocol changes generally require support from more than 80% of trusted validators to remain in favor for two weeks before an amendment activates. Developers said publicly disclosing the vulnerability while waiting for that process to finish could have given attackers time to exploit it.
More than 80% of validators on the default Unique Node List had installed version 3.4.1 by September 25, according to the disclosure.
The software fix adds overflow checks to the payment engine and uses a wider counter for the supply safety check. This helps prevent the calculation from wrapping around and makes it easier for the system to detect an invalid change in XRP balances.
The same release also addressed a separate issue involving Batch transactions. That issue was handled through the fixBatchV1_2 amendment, which activated on October 9. It was distinct from the payment-engine overflow fix, which took effect when operators installed the updated software.
What the XRP Ledger Vulnerability Means for XRP Holders
The incident exposed a weakness in the software that enforces one of XRP’s core monetary properties: its fixed supply.
If successfully exploited, a vulnerability that could create spendable XRP beyond the intended limit would undermine confidence in the ledger’s accounting system. Attackers could transfer or sell newly created tokens, affecting market participants before the issue was detected.
The absence of evidence of public-network exploitation is therefore an important distinction. Developers have not reported that the vulnerability increased the XRP supply or confirmed losses resulting from this flaw.
The incident also demonstrates why a cryptocurrency’s supply limits depend on software implementation as well as its stated rules. A protocol may be designed to prevent additional issuance, but its code must correctly enforce those rules under unusual transaction conditions.
The disclosure highlights the value of security researchers, bug bounty programs, testing, and independent review. It also raises questions about how long vulnerabilities can remain hidden in mature blockchain software and how quickly developers can coordinate a response when a critical flaw is discovered.
What Comes Next
The XRP Ledger team has released the technical findings and the fix for the payment-engine overflow vulnerability. Node operators should run xrpld version 3.4.1 or a newer compatible release to remain protected and synchronized with the network. Older versions may be unable to keep up with the ledger following the activation of the relevant amendments.
Further security work will focus on strengthening transaction validation and improving testing so that future releases are checked against previously reported vulnerabilities.
What This Means for You: XRP holders do not need to assume that their tokens were affected or that additional XRP entered circulation. Developers reported no evidence that the flaw was exploited on a public network, and the vulnerability has been fixed in version 3.4.1. If you operate an XRP Ledger server, check that it is running a current compatible release and follow official XRPL updates for further security guidance.
