- Published on
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing
- Authors
- Name
- DeepHorus
RippleX patched a decade-old XRP Ledger flaw that could have let attackers create billions of dollars in spendable XRP from nothing. The bug, dating to 2015, threatened the ledger's fixed 100 billion token supply. A fix shipped Sept. 25 in the xrpld 3.4.1 software release.
Researcher Cayden Liao and Veria AI found the flaw and reported it internally on Sept. 22. RippleX engineers reproduced the attack on a standalone server. They confirmed the newly created XRP could be spent in a later transaction.
All 100 billion XRP were created when the ledger launched in 2012. Its software is built so no more can ever be added. The vulnerability could have let an attacker create XRP from nothing and sell it on exchanges, undercutting a supply cap institutions rely on.
The attack exploited the ledger's built-in exchange, where accounts post offers to swap tokens. An attacker could open hundreds of accounts, each offering a tiny amount of a token for an unusually large amount of XRP. A single payment then bought every offer at once.
The total XRP owed was too large for the software to count correctly. Selling accounts were paid in full while the buying account was charged almost nothing. The attacker ended with XRP that had not existed before.
A post-transaction check meant to catch new XRP relied on the miscounted total, so it missed the theft. A limit on how much one account can receive did not trigger because the XRP was spread across hundreds of accounts. RippleX said no public network showed exploitation, and the incident joins AI-assisted crypto flaw discoveries since July.
