A decade-old bug in the XRP Ledger could have allowed attackers to create spendable XRP out of nothing, according to a report published on Xrpl.org. The flaw, discovered by researcher Cayden Liao and Veria AI, was reported through the XRPL Bug Bounty program on September 22. The issue stemmed from the payment engine's failure to check for overflows when summing large amounts owed across multiple offers, potentially allowing attackers to mint XRP by exploiting a wrap-around calculation.
The bug had existed since the payment engine was written in 2015 but went unnoticed because ordinary payments rarely triggered the overflow condition. The exploit required only a few hundred XRP in reserves and minimal transaction fees, with no evidence of prior exploitation on public networks. Despite existing safeguards, the ledger's invariant check also failed to catch the issue due to similar arithmetic flaws.
Due to the severity of the bug, the fix was released in the xrpld 3.4.1 version on September 25, bypassing the usual validator-vote process. By the end of that day, more than 80% of default UNL validators had upgraded. RippleX Engineering confirmed the exploit's functionality on a standalone server, raising its severity from major to critical.
The decision to skip the typical two-week amendment process was justified by the need to minimize risk, as the report stated, "We judged a short upgrade window with this limited risk to be far safer than weeks of a publicly known, open exploit."