XRPL fixes overflow bug that could have minted spendable XRP
Security & Exploits ·
Ripple's ledger software shipped a patch for a critical payment-engine flaw that let crafted trades create new XRP out of thin air.
XRPL shipped xrpld 3.4.1 on September 25, 2026, closing a payment-engine overflow that could have let a specially built trade mint spendable XRP while the attacker paid only a few hundred drops plus a transaction fee, according to defiprime.com. A public disclosure dated October 9 said RippleX reproduced the mint and found no sign it had ever run on a live network, per the xrpl.org writeup.
The flaw surfaced through the bug bounty program on September 22 as a "Major" finding, then got bumped to critical once RippleX confirmed the newly created XRP could actually be spent in a follow-up payment. The underlying mechanics involved the built-in order book: an attacker could stand up hundreds of accounts, each offering a sliver of some other token for an outsized amount of XRP, then route a single payment to sweep every offer at once. The code totaled what the buyer owed with plain 64-bit addition and no overflow guard, so once the running sum exceeded the integer's ceiling it wrapped to a tiny number — leaving offer owners paid in full while the buyer was billed almost nothing, with the gap manifesting as freshly minted XRP.
A built-in rule meant to block any XRP creation should have caught this, but it relied on the same vulnerable 64-bit counter and wrapped the same way, making the transaction look like it merely burned a fee. A second safeguard that caps how much any single account can hold was sidestepped by spreading the minted tokens across hundreds of accounts, each staying under the limit. The report traces the bug back to the payment engine's original 2015 design, with the no-new-XRP check added two years later inheriting the same unprotected arithmetic — a path ordinary transactions never approach because total XRP supply sits well short of the overflow threshold.
Several other outlets covering the disclosure echoed the same core facts: a decade-old defect capable of generating unlimited or billions-equivalent XRP, patched without any reported loss of funds or disruption to network consensus, as summarized by coindesk.com and noted separately at leviathan.news.
The fix adds overflow checks when the engine sums offer amounts and when it merges results across multiple payment paths, swaps in a wider coun