The XRP Ledger development team has fixed a payment engine integer overflow vulnerability that dates back to 2015. This flaw allowed attackers to generate spendable XRP out of thin air through specially crafted transactions, bypassing the total supply cap of 100 billion XRP.

Attackers could create hundreds of accounts, each posting offers to exchange a small amount of tokens for a large amount of XRP, and then execute a payment that simultaneously fulfilled all offers. Since the payment engine did not check for overflow when aggregating multiple offer amounts, the seller's account received the full XRP, while the buyer's account paid almost nothing.

Researchers Cayden Liao and Veria AI reported the issue through the XRPL bug bounty program on September 22. RippleX reproduced the attack on an independent server and confirmed that the newly generated XRP could be used in subsequent transactions.

The cost of the attack was only a few hundred XRP for account reserves and fees, most of which could be recovered later. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network.

The development team released version xrpld 3.4.1 on September 25 to complete the fix, which took effect immediately without waiting for an amendment to activate. The official technical details were disclosed on October 9.

Node operators can eliminate this risk by upgrading to 3.4.1; nodes that do not upgrade will be unable to sync after the relevant amendment is activated. Market trust in XRP's fixed supply relies on this cap not being breached. If attackers succeed, they could impact the price through selling, while validators and holders avoid supply dilution due to the timely fix.

The official report confirms that the vulnerability has existed since the current payment engine was written in 2015, remaining undetected because normal transactions did not hit the arithmetic limit.

Source: Public Information