USD
XRP Ledger Patch Closes Bug That Could Mint Trillions of XRP
Emergency fix and $250,000 bounty trigger governance and security debate
TL;DR
- An integer-overflow flaw in the XRP Ledger could have created spendable XRP beyond the token’s fixed supply, though developers said they found no evidence it was exploited.
- RippleX pushed an emergency fix without waiting for the usual amendment process because publishing the flaw before activation could have exposed the network to attackers.
- The response has drawn criticism over XRPL decentralization and the size of the maximum bug bounty paid to Veria Labs.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
XRP Ledger developers patched a critical payment-engine flaw that could have created XRP beyond the network’s fixed supply, closing a vulnerability that had been present since 2015. Veria Labs found the bug and built a working exploit, while developers said there was “no evidence that this issue was exploited on any public network.”
The emergency response has since opened two separate debates: whether bypassing the normal amendment process weakened XRPL’s decentralization claims, and whether the reward paid to the researchers was large enough for the severity of the discovery.
How the XRP Ledger bug could create new XRP
The flaw was an integer overflow in the XRP Ledger’s payment engine. XRP balances are stored as 64-bit integers with a fixed maximum. When a calculation crossed that limit, the total could wrap around to a much smaller value instead of failing.
An attacker could create hundreds of specially priced offers demanding enormous XRP payments and then consume them together. Seller accounts would receive the full amounts while the buyer could be charged “only a few hundred drops plus the fee,” effectively creating the difference as spendable XRP.
The vulnerability was difficult to trigger through ordinary activity.
“The attack could not be triggered by accident,” the disclosure said. “It required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once.”
The XRP Ledger Foundation similarly said normal payments never approached the conditions required:
“No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations.”
Cayden Liao, security co-founder at Veria Labs, said the firm’s AI agent found the vulnerability and produced a working exploit. Liao suggested the flaw survived because it combined weaknesses that appeared less severe individually.
“We suspect one reason nobody caught this vulnerability is that it chains together two bugs that would be low severity on their own,” he wrote.
RippleX skips normal amendment process for emergency patch
Veria reported the vulnerability on Sept. 22. RippleX released xrpld version 3.4.1 on Sept. 25, and the fix became active on each server as it upgraded instead of waiting for the standard amendment process. More than 80% of validators on the default Unique Node List were already running the update that day. Normal rule changes require support above that threshold for two weeks, making the security response the first deliberate bypass of that process in more than a decade.
XRPL developers said delaying activation while publishing the open-source fix would have created an attack window.
“With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security,” they said.
RippleX engineer Mayukha Vadari made a similar argument:
“AI has changed things. You can't sneak a critical bug patch into a routine public release process, it'll get spotted and reverse-engineered immediately.”
Source code for the update was published about two weeks after the binaries.
Cyber Capital founder Justin Bons criticized that approach, saying XRP had been “running closed-source code for the last two weeks.” He also said marketing XRP to retail investors as decentralized amounted to “straight-up fraud,” arguing that operators had been pressured to install binaries while the source was temporarily withheld.
The XRP Ledger Foundation rejected the claim that one entity controlled the response. It said the decision involved the Foundation, RippleX, core developers and validators.
“No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments,” the foundation said.
XRP Kuwait, an independent validator operator, also rejected the idea that coordination itself proved centralized control.
“We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control,” it said. “Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence.”
$250,000 bounty draws criticism after critical discovery
Liao said Ripple paid Veria Labs the program’s maximum $250,000 bounty.
“To our knowledge, that's the largest ever paid out for a vulnerability discovered entirely by an AI agent,” he said.
The payout nevertheless triggered criticism from parts of the crypto community, with complaints arguing that the reward was too small relative to a flaw capable of breaking XRP’s supply constraint.
Blockchain investigator ZachXBT criticized the size of the payout, contrasting it with the value held by Ripple.
“Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?
Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.
This is why people do not take XRPL or Ripple seriously as an org….”
The broader backlash included warnings that inadequate rewards could weaken incentives for responsible disclosure. Other comments characterized the payment as an “absolute joke,” argued that the researchers deserved more for finding a potentially catastrophic flaw, and warned that future hackers could choose exploitation over reporting. Those objections were directed at the bounty rather than evidence of actual unauthorized XRP creation; the Foundation said no new XRP was created.
RippleX Head of Engineering J. Ayo Akinyele said the team would expand its use of AI-assisted bug hunting and formal verification following the disclosure. “AI is fundamentally changing how quickly vulnerabilities can be discovered,” he wrote.
The same software release also fixed a separate flaw involving Batch, a feature that had not yet gone live when the issue was identified. The flaw could have stalled the network, while an attacker would “not gain anything on-chain.” The disclosure said: “The payoff is a permanently malformed record and the chance to break off-chain indexers, explorers, and SDKs.” Batch and its fix later activated together, and older servers could no longer remain synchronized.
This article has been refined and enhanced by ChatGPT.
