A critical vulnerability that had been present in the XRP Ledger payment engine for more than a decade has been patched by Ripple before public disclosure. According to Ripple and the XRP Ledger Foundation, the flaw could theoretically have allowed attackers to create spendable XRP beyond the network’s fixed 100 billion supply cap, although no evidence of exploitation or unauthorized issuance was found.
The bug was located in the payment engine that calculates amounts when a transaction trades through offers on the XRP Ledger’s built-in exchange. Under specially constructed conditions, an arithmetic overflow could cause the calculation to wrap around and return a much smaller number than actually owed. That mismatch created the potential for sellers to receive more XRP than the buyer paid. Because all 100 billion XRP were created at inception and validators do not mine new coins, the flaw struck at a fundamental monetary rule rather than an individual account issue.
The fix shipped in xrpld 3.4.1 on September 25, before public disclosure on Friday, October 9. RippleX senior director of engineering J. Ayo Akinyele said, “The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply.” RippleX said developers tested the patch and coordinated upgrades with operators before releasing details publicly. The XRP Ledger Foundation’s vulnerability disclosure report documented the payment-engine overflow and remediation. Veria AI helped uncover the issue through the XRPL bug bounty program, and Akinyele added, “AI is fundamentally changing how quickly vulnerabilities can be discovered.” The incident is being treated as a serious vulnerability that was patched, not a confirmed supply breach.
