XRP Ledger Reveals Critical Bug That Could Have Created Unlimited XRP

According to an official disclosure published October 9, the vulnerability could have been exploited through specially constructed transactions. Developers patched the issue on September 25 and found no evidence of exploitation on public networks.

How an 11-Year-Old Bug Threatened XRP's Supply

The vulnerability involved an integer overflow in XRPL's payment engine, which processes transactions involving different assets. When a payment consumed hundreds of specially constructed offers, the software could incorrectly calculate the total XRP owed.

Instead of rejecting a calculation exceeding its numerical limit, the system could wrap the amount around to a much smaller number. Recipients would receive their full payments, while the sender would be charged only the incorrectly calculated total.

The difference could effectively create XRP from nothing, bypassing the cryptocurrency's intended supply restrictions. More concerningly, the ledger's existing protection against unauthorized XRP creation relied on the same vulnerable arithmetic, meaning the manipulation could escape detection.

Researchers reproduced the vulnerability during controlled testing and confirmed that improperly created XRP could subsequently be transferred.