XRP Ledger patched a bug that could have minted 18 trillion XRP - Startup Fortune
Security researchers discovered a decade-old flaw in the XRP Ledger that could have created 18 trillion XRP in a single transaction, prompting Ripple to issue a patch and a $250,000 bounty.
For several days in September, the integrity of one of cryptocurrency's largest networks hung on a bug that had remained undetected since 2015. Security firm Veria Labs reported the flaw to XRPL's bug bounty program on September 22, and RippleX developers responded quickly, releasing xrpld 3.4.1 just three days later on September 25. The patch addressed a payment engine vulnerability that could have minted approximately 18 trillion XRP in a single transaction—about 180 times the entire 100 billion XRP supply cap.
The Bug's Mechanics
The vulnerability resided in how the XRP Ledger's payment engine handles value from multiple offers in the network's order book. When processing payments that pull value from several offers, the system adds these amounts using a 64-bit integer without checking if the sum exceeds the integer's maximum value. Beyond this ceiling, the number wraps around to a small value, similar to an odometer rolling back to zero.
The ledger continued paying each offer owner their full, correct amount while the buyer was only charged the wrapped-around total—a potentially tiny fraction of what was actually owed. This arithmetic oversight could have allowed an attacker to create massive amounts of XRP without detection.
AI Discovery and Response
Cayden Liao, founder of Veria Labs, revealed that the discovery began with an AI agent operated by his firm. The AI found the vulnerability on September 21, spent the next day developing a proof-of-concept exploit, and demonstrated how to chain it with a second bug. Liao noted that the $250,000 payout represented the largest reward he knows of for a vulnerability found entirely by an AI agent.
That detail matters as much as the bug itself: this wasn't a researcher staring at diffs for weeks. It was a model finding a decade-old arithmetic blind spot and proving it was exploitable, on its own.
Emergency Patch
XRPL typically changes its rules through an amendment process requiring validator votes and supermajority agreement, a deliberately slow procedure. However, this fix was deployed as an emergency release that took effect immediately after node upgrades, bypassing the standard amendment vote. According to The Block, over 80% of validators on the network's default Unique Node List were running the patched version on release day.
RippleX found no evidence the bug was exploited on any public network. No unauthorized XRP was created, and the original 100 billion supply has continued to slightly shrink as transaction fees are burned. Nevertheless, the incident raises concerns about how long basic overflow protections remained unchecked in widely used financial infrastructure.
Broader Implications
XRP's value proposition centers on its fixed supply of 100 billion tokens, distinguishing it from inflationary currencies. A bug that could silently mint 180 times that amount threatens this fundamental promise. The fact that the flaw existed in one of the ledger's most frequently used features rather than an obscure edge case is particularly concerning.
The incident signals a new era in security research where both defenders and attackers have access to faster tools. While the protocol's defenses took three days to respond, that margin may not be sufficient next time. As AI becomes more sophisticated in identifying vulnerabilities, cryptocurrency networks may need to develop even more rapid response capabilities to maintain security.
Related
