XRP Ledger Fixes Payment Engine Overflow Vulnerability That Could Generate XRP Out of Thin Air
The XRP Ledger development team has fixed a payment engine integer overflow vulnerability that dates back to 2015. This flaw allowed attackers to generate spendable XRP out of thin air through specially crafted transactions, bypassing the total supply cap of 100 billion XRP.
Attackers could create hundreds of accounts, each posting offers to exchange a small amount of tokens for a large amount of XRP, and then execute a payment that simultaneously fulfilled all offers. Since the payment engine did not check for overflow when aggregating multiple offer amounts, the seller's account received the full XRP, while the buyer's account paid almost nothing.
Researchers Cayden Liao and Veria AI reported the issue through the XRPL bug bounty program on September 22. RippleX reproduced the attack on an independent server and confirmed that the newly generated XRP could be used in subsequent transactions.
The cost of the attack was only a few hundred XRP for account reserves and fees, most of which could be recovered later. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network.
The development team released version xrpld 3.4.1 on September 25 to complete the fix, which took effect immediately without waiting for an amendment to activate. The official technical details were disclosed on October 9.
Node operators can eliminate this risk by upgrading to 3.4.1; nodes that do not upgrade will be unable to sync after the relevant amendment is activated. Market trust in XRP's fixed supply relies on this cap not being breached. If attackers succeed, they could impact the price through selling, while validators and holders avoid supply dilution due to the timely fix.
The official report confirms that the vulnerability has existed since the current payment engine was written in 2015, remaining undetected because normal transactions did not hit the arithmetic limit.
Source: Public Information
ABAB AI Insight
The XRP Ledger generated all 100 billion XRP at once at its inception in 2012, and subsequent software design strictly prohibits inflation; there have been instances where batch trading and other features were found to have critical flaws before activation and were delayed. The development team addresses long-standing arithmetic issues through bug bounties, independent audits, and emergency patch mechanisms.
RippleX prioritized engineering resources for urgent fixes and validator upgrade coordination, shortening the exposure window by first releasing binary patches and then disclosing details, converting bounty reports into protocol-level protections rather than waiting for the normal amendment cycle.
This is similar to how early Bitcoin integer overflow vulnerabilities were fixed and how Ethereum intercepted consensus risks multiple times before activation; the XRP Ledger is currently in an expansion phase, adding features like batching and lending while maintaining its fixed supply commitment, with complex transaction logic becoming a new attack surface.
Essentially, this is a strengthening of the defense layer in technical alternatives. The integer overflow bypassed supply checks when aggregating large orders, and the fix adds overflow detection to ensure abnormal payments fail cleanly, thus eliminating the possibility of "generating out of thin air" from the protocol level and maintaining the verifiability of the total supply cap.
ABAB News · Cognitive Laws
Fixed supply relies on code enforcement, not promises
The more complex transaction paths, the easier it is to breach arithmetic boundaries
Emergency patches first seal risks, then give attackers time after details are disclosed