XRPL patches decade-old bug that risked uncapped XRP creation
Security & Exploits ·
A payment-engine flaw dating to 2015 could have let a crafted transaction mint far beyond XRP's fixed supply before engineers closed it last month.
RippleX and the XRP Ledger Foundation disclosed the overflow issue, which sat in the network's transaction-processing code for roughly ten years before being caught. A fix landed in xrpld version 3.4.1 on September 25, and over 80% of default validators had applied the update that same day, according to wublockchain.xyz.
The bug surfaced through XRPL's bug bounty program. Researcher @Cayden_Liao reported that a proof-of-concept transaction built by his team was able to generate roughly 18 trillion XRP in one go — about 184 times the ledger's intended 100 billion token cap. The disclosure earned the maximum payout under the bounty program, $250,000, the largest figure attached to the case.
A second account of the episode, covered by theblock.co, attributes the discovery to Veria Labs and confirms RippleX applied the fix on September 25, aligning with the timeline given elsewhere.
XRPL's operators said they have found no indication the vulnerability was ever triggered on a live, public network, meaning the inflated supply scenario stayed confined to testing rather than reaching real transactions or wallets. That assessment relies on the project's own review rather than an independent audit disclosed publicly.
What remains unclear is how validator upgrade rates evolved after the initial 80% mark on patch day, whether any non-default or lagging nodes ran unpatched software for an extended window, and if further details on the bounty review process or the researchers' methodology will be published. No additional incidents tied to the same overflow class have been reported since the September 25 fix.