Critical Decade-Old Vulnerability in XRP Ledger Resolved

XRP Ledger's critical flaw allowing new XRP creation fixed.

A critical vulnerability in the XRP Ledger (XRPL) that allowed the creation of new XRP bypassing emission rules has been resolved. According to developers, the flaw had existed in the payment mechanism code since 2015.

The issue was initially discovered by specialists at Veria Labs. Co-founder Cayden Liao noted that the flaw was identified by an AI agent, which also created a working exploit.

The vulnerability was based on integer overflow in the calculation mechanism. When a single transaction executed multiple orders from the order book, the final amount could be calculated incorrectly.

To exploit the vulnerability, an attacker would need to create several hundred accounts and place sell orders for small amounts of tokens at disproportionately high prices in XRP. A large initial capital would not be necessary; only a few hundred coins would be spent on reserves and regular fees.

The attacker would then send a transaction specifically designed to execute all orders simultaneously. Due to the overflow, the buyer would pay only a few hundred drops and a fee, while sellers would receive the full order value. The attacker would effectively mint new XRP, which could be transferred and sold.