XRP Ledger bug that threatened 100 billion supply cap went undetected for a decade
In brief
- Integer overflow bug in the XRP Ledger could have let an attacker create new XRP, CoinDesk reported.
- XRP Ledger Foundation said normal payments never came close to triggering the bug.
- Researcher Cayden Liao and Veria AI found the flaw on Sept. 22.
- RippleX shipped the fix and said no damage was done.
- About 99.986 billion XRP remain in circulation, the foundation said.
How the overflow worked
The flaw stemmed from an integer overflow vulnerability, CoinDesk reported. When a transaction's size went past the system's maximum numerical limit, the value wrapped around to a very small number. That bypassed fund checks (crediting sellers the full XRP amount while charging buyers next to nothing).
In theory, an attacker could have used dummy accounts to post fake token sales worth astronomical amounts of XRP, then bought all of those tokens at once as the buyer. That's a direct hit on the rule that supply can never exceed the 100 billion coins created at the blockchain's 2012 debut. XRP was built so no new tokens can ever be minted, and it's mainly used to pay transaction fees and bridge currency trades on the ledger's built-in DEX.
The scenario was theoretical, as CoinDesk described it.
Why it stayed hidden
The foundation said the bug went unnoticed mainly because it required a massive scale of action to trigger.
“No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations,” it said.
Two safeguards didn't catch it either. The check that runs after every transaction to confirm no new XRP has appeared relied on the same miscounted total, so it saw nothing unusual. A separate per-account limit on how much XRP can be received didn't fire, because the potential attack would've spread XRP across hundreds of accounts.
Discovery and the fix
Researcher Cayden Liao and Veria AI uncovered the bug on Sept. 22 and reported it internally, according to CoinDesk. It's believed to have existed since 2015. RippleX, which shipped the fix, said no damage was done.
The foundation said no new XRP was created and that about 99.986 billion XRP remain in circulation.
It also noted that AI is making it faster for both bad actors and defenders to find flaws like this one. The foundation said it plans to apply AI adversarial testing, implement formal verification and strengthen its bug bounty program.
Frequently asked questions
Why did the XRP Ledger bug go undetected for so long?
The XRP Ledger Foundation said the bug required a massive scale of action to trigger, and normal user activity never came close. The post-transaction supply check relied on the same miscounted total, and a per-account receive limit didn't fire because a potential attack would have spread XRP across hundreds of accounts.
How did the XRP integer overflow bug work?
Once a transaction's size exceeded the system's maximum numerical limit, the value wrapped around to a very small number. That bypassed fund checks, crediting sellers the full XRP amount while charging buyers next to nothing, according to CoinDesk.
Was any new XRP created because of the bug?
The XRP Ledger Foundation said no new XRP was created and about 99.986 billion XRP remain in circulation. RippleX, which shipped the fix, said no damage was done.
