RippleX, the developer arm of Ripple, disclosed on Friday that the XRP Ledger had a flaw that could have let an attacker create spendable XRP without paying for it. It says it fixed the bug in a software release on 25 Sep and has found no evidence that anyone exploited it on a public network.
The XRP Ledger is a so-called layer-1 blockchain, a network run by independent validators, the computers that agree which transactions are final. Its supply is fixed at 100 billion XRP, all created at launch, so a bug that minted more would break the token’s central rule.
The flaw sat in the ledger’s built-in exchange, where accounts post offers to swap one asset for another. When a single payment bought through many offers at once, the payment engine added up what the buyer owed with a 64-bit counter and no overflow check, according to RippleX’s disclosure report.
An integer overflow happens when a number outgrows the space reserved for it and wraps around to a small one. Here, a few hundred offers asking for very large amounts of XRP added up to a tiny total. Each seller was paid in full while the buyer was charged almost nothing.
Two safety checks should have caught it, the report says, and neither did. The check that no transaction creates XRP used the same kind of counter and wrapped the same way. The per-account check only trips if one account holds more than the total supply, which an attacker could avoid by spreading the coins over hundreds of accounts.
Researcher Cayden Liao and Veria AI reported the issue through the XRPL bug bounty on 22 Sep, according to the report. RippleX reproduced it on a local server, confirmed the new XRP could be spent and raised the severity from “Major” to critical. “If it had been exploited, this would have been a critical issue,” the report says.
The attack was cheap. The report puts the real cost at a few hundred XRP in account and offer reserves, which are returned when the objects are removed, plus ordinary fees. It says no normal payment or trade could reach the faulty path by accident.
Why the fix skipped the usual vote
Rule changes on the XRP Ledger normally ship as amendments. They switch on only after more than 80% of trusted validators have backed them for two weeks.
This fix took effect on each server as soon as it upgraded to xrpld 3.4.1, the ledger’s server software. The report calls it the first time a change to transaction processing has deliberately shipped that way since amendments were introduced more than ten years ago.
RippleX’s reasoning is that xrpld is open source, so a release containing the fix would also show where the bug was. An amendment would have left the flaw public and exploitable for weeks. “We judged a short upgrade window with this limited risk to be far safer than weeks of a publicly known, open exploit,” the report says.
The report names the trade-off. While servers ran mixed versions, upgraded and non-upgraded ones would have disagreed about an exploit transaction, and in the worst case the network could have halted. More than 80% of validators on the default list ran 3.4.1 on release day, it says, before the source code was published. The code went public with Friday’s report.
The same report covers a second fix. A gap in how the ledger checked Batch transactions, a feature that lets one account bundle up to eight transactions, could have stalled validation across mixed software versions. The report says no funds or Mainnet transactions were affected, because Batch had not yet switched on. Its fix, the fixBatchV1_2 amendment, and the Batch feature itself both activated on Friday. Servers still on older software are now blocked from syncing.
A public XRPL server reported build 3.4.1 at about 09:45 UTC on Saturday, with both amendments enabled. Its latest ledger, 107,558,692, showed about 99.9856 billion XRP in existence, below the 100 billion cap. That figure fits the report’s account, but it is not proof by itself that nothing was minted.
The disclosure follows delegated permissions went live on Thursday. A separate fix, fixCleanup3_4_0, was still waiting on its two-week clock on the same server. RippleX also says every security finding marked as fixed will now be re-tested against the release candidate before it is closed.
XRP traded near $1.41 as of 09:45 UTC on Saturday, up about 0.6% in 24 hours, according to CoinGecko. Evernorth, the XRP treasury company, is due to start trading as XRPN on Monday. This week’s Chain Check has the wider altcoin picture.
This article is for information only and is not investment advice.