Skip to the article
Web3 Hub

Markets, protocols and policy, reported

XRPL fixed decade-old flaw that could mint 18 trillion XRP

XRPL says it fixed an integer-overflow flaw in version 3.4.1 on Sept. 25; a crafted payment could have created spendable XRP, with no public exploitation found.

By Web3 Hub Newsroom2 min read

XRPL fixed decade-old flaw that could mint 18 trillion XRP

XRPL developers said Oct. 9 that RippleX had fixed a payment-engine flaw that could let an attacker create spendable XRP, putting the ledger’s fixed supply at risk. The XRPL vulnerability disclosure report says the bug was reported through its bounty program on Sept. 22 and fixed in software released three days later.

How could one payment create XRP?

The payment engine added amounts from many order-book offers using 64-bit arithmetic without checking for overflow, according to the report. If the sum exceeded the maximum, it wrapped to a small number: offer owners received their full XRP amounts while the buyer was charged only the smaller total.

An existing safety check for newly created XRP used similar arithmetic and also wrapped around, so it did not detect the difference. The exploit required hundreds of specially priced offers and a payment designed to consume them together; XRPL said ordinary trades would not trigger it.

How much XRP could the flaw have created?

Veria Labs co-founder Cayden Liao estimated that one exploit transaction could have created about 18 trillion XRP, 184 times the 100 billion XRP supply at launch, The Block reported. The XRPL report confirms the flaw could create XRP beyond the total supply, but does not give that estimate.

XRPL said it found no evidence the bug had been exploited on a public network. It said investigation suggests the flaw had existed since the payment engine was written in 2015.

When did the fix take effect?

The fix shipped in xrpld 3.4.1 on Sept. 25 and took effect on each server as it upgraded, rather than waiting for the ledger’s usual validator amendment vote. XRPL said more than 80% of default Unique Node List validators were running the fixed version on release day.

The disclosure says operators must upgrade to 3.4.1 or newer to stay in sync. A separate amendment, fixBatchV1_2, activated on Oct. 9; older servers can no longer stay in sync with the network.

References