XRP Ledger Discloses Decade-Old Overflow Bug That Could Have Created XRP Beyond Its 100 Billion Cap

Researchers showed that a single payment on the XRP Ledger could create spendable XRP that the sender never funded. The demonstration led to an emergency software release. The flaw had been in the code since 2015.

The bug existed in the payment engine that matches trades against the ledger's built-in order book. An attacker could open hundreds of accounts, and each account would post an offer to give a tiny amount of some token in return for an unusually large amount of XRP. A specially built payment could then consume all of those offers in one pass. The engine added up the XRP the buyer owed in a 64-bit integer. According to the RippleX disclosure summarized by Crypto Briefing, that sum could overflow, so the ledger would credit XRP that no one had paid in. This is an arithmetic overflow, a logic error in core protocol code. It is not a smart-contract flaw.

RippleX, Ripple's engineering arm, shipped the fix in xrpld version 3.4.1 on September 25 and did not describe what it repaired. It published the full disclosure on October 9. Changes to XRP Ledger rules normally go through an amendment process in which validators vote before a change takes effect. This fix went out as an ordinary software update and skipped that vote. RippleX says it has found no evidence that anyone used the flaw.

The disclosure came as a large holder of XRP prepared to list in the United States. Evernorth completed its merger with Armada Acquisition Corp. II and holds about 473 million XRP, with gross cash proceeds of about $300 million and Nasdaq trading expected on October 12. A treasury company's valuation rests on the fixed supply of the asset it holds. A flaw that could have broken that cap goes to the core of the investment case.

The quiet patch was a sound security decision, because announcing the bug before validators upgraded would have shown attackers how to use it. It also shows how this ledger works in practice. One engineering organization found the flaw, wrote the fix, and decided when to tell the public. The validator vote, which is the decentralized part of the process, was bypassed.