XRP Ledger developers have disclosed and fixed a critical bug that could have allowed attackers to create counterfeit XRP. The flaw, an integer overflow in the payment engine, had been present since 2015 but went unnoticed because it required highly unusual payment conditions to trigger. The bug could have let an attacker generate spendable XRP beyond the token’s total supply in a single transaction, potentially causing significant disruptions in the network.
The issue was reported through the XRPL bug bounty program in September and patched in version 3.4.1 on Sept. 25. Notably, the fix bypassed the ledger’s usual amendment process, which typically requires a two-week waiting period for validators to approve changes. The maintainers justified this exception due to the severity of the bug, stating that an open-source fix would have revealed the vulnerability while leaving it exploitable for weeks.
There is no evidence that the bug was ever exploited, according to the XRP Ledger team. The flaw was particularly insidious because the ledger’s built-in safety check used the same flawed arithmetic, meaning it failed to detect the issue. The disclosure comes amid a broader context of counterfeiting vulnerabilities in cryptocurrencies, echoing a similar scare involving Zcash earlier this year.
XRP’s price did not escape unscathed, trading at $1.38 on Monday, down 1.6% over 24 hours and 9.4% over the past seven days, marking the worst performance among major cryptocurrencies during that period.