XRP Ledger Discloses and Patches Bug That Could Have Broken Its Supply Cap

The XRP Ledger disclosed on October 9 an integer-overflow vulnerability in its payment engine that could have allowed specially crafted transactions to create spendable XRP beyond the network’s intended supply cap. The disclosure followed an emergency software update released on September 25, with XRPL saying it found no evidence of exploitation on any public network.

xrpld 3.4.1 added overflow checks before disclosure

XRPL released xrpld 3.4.1 as an emergency security update on September 25. The release added overflow checks to payment calculations and strengthened the ledger’s “no-XRP-created” invariant, the control intended to ensure transactions cannot generate XRP.

The network publicly detailed the underlying flaw two weeks later. In its October 9 disclosure, XRPL said the integer overflow affected the payment engine and could have produced spendable XRP beyond the intended cap.

How crafted offers could have bypassed the invariant

The issue was not described as a simple one-transaction exploit. According to XRPL, an attacker would have needed hundreds of deliberately priced offers, followed by a single payment, to trigger the vulnerable calculation.

That sequence could have bypassed the protection against XRP creation, potentially allowing spendable XRP to be created above the ledger’s designed supply limit rather than producing merely an erroneous display or accounting result.

No public-network exploitation found

Although XRPL said it found no evidence that the vulnerability had been exploited on a public network, the network’s stated assessment does not change the severity of the flaw described in the disclosure.

Bitcoin.com News, reporting on October 10, characterized the vulnerability as a decade-old issue that could have enabled XRP creation beyond the network’s 100-billion-token cap. Its report also noted that the patch had been deployed before the vulnerability was publicly disclosed.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.