A Decade-Old Ripple XRP Ledger Flaw Was Patched Before Disclosure
A decade-old flaw in the Ripple XRP Ledger payment engine could theoretically have let attackers create spendable XRP beyond the network’s fixed 100 billion supply cap.
Ripple says the fix shipped in xrpld 3.4.1 on September 25, before public disclosure, and investigators found no evidence that the vulnerability was exploited on a public network or that unauthorized XRP was issued.
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let's clear them up.
No. XRP's supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around…
That distinction matters: the bug threatened the ledger’s supply rules, but the available evidence does not show that XRP’s cap was actually breached.
J. Ayo Akinyele, RippleX’s senior director of engineering, said, “The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply.”
The flaw sat in the payment engine, which calculates amounts when a transaction trades through offers on the XRP Ledger’s built-in exchange. Under specially constructed conditions, arithmetic could overflow: instead of returning the true total owed across the offers, the calculation could wrap around and produce a much smaller number.
That mismatch created the potential for sellers to receive more XRP than the buyer paid. The ledger’s supply limit was set when all 100 billion XRP were created at inception; unlike proof-of-work networks, validators don’t mine new XRP as they process transactions. A flaw that could make extra XRP spendable therefore struck at a basic monetary rule, not simply at an individual account.
RippleX said developers tested the patch and coordinated upgrades with operators before publicly disclosing it. The fix was included in xrpld 3.4.1, the server software that processes transactions and maintains ledger records. The XRP Ledger Foundation’s vulnerability disclosure report details the payment-engine overflow and its remediation.
That rapid software rollout is distinct from the ledger’s amendment process, which validators use to activate changes to protocol rules. Earlier XRPL amendment activation illustrates how validator support can determine when a protocol change takes effect; the supply-flaw fix instead took effect as servers upgraded to the patched release.
Security remains our top priority for preserving trust in the XRP Ledger (XRPL). Sharing a few thoughts following yesterday's disclosure of the critical payments engine vulnerability reported by Veria AI.
The documented risk was the possible creation of unauthorized, spendable XRP-not a confirmed loss of user funds. Investigators found no evidence of public-network exploitation, and the primary disclosure does not establish that funds were lost. The correct reading is a serious vulnerability that was patched, not a confirmed supply breach.
The bug’s age is still significant. A defect in a core payment path remained in the codebase for more than a decade, while a safety check intended to guard against XRP creation failed to catch the same arithmetic problem. In trading terms, the vulnerability exposed a blind spot in a rule that should have acted like a circuit breaker.
XRP-related security incidents can involve very different systems: a wallet or service compromise, for example, is not the same as a flaw in the ledger’s transaction rules, as the distinction around an XRP-related healthcare hack makes clear.
RippleX executive J. Ayo Akinyele outlined the response on X on October 10, after disclosure on Friday, October 9. Veria AI helped uncover the issue through the XRPL bug bounty program. Akinyele said, “AI is fundamentally changing how quickly vulnerabilities can be discovered.”
Follow 99Bitcoins on X For the Latest Market Updates and Subscribe on YouTube For Daily Expert Market Analysis.
Established in 2013, 99Bitcoin’s team members have been crypto experts since Bitcoin’s Early days.
Alex is a seasoned cryptocurrency trader and market analyst with over seven years of active experience in the digital asset space. Since entering the markets in 2017, Alex has specialized in identifying emerging "meta" trends and high-volatility narratives. Notably, Alex... Read More
Asanat Analysis — Why it matters
A decade-old vulnerability in XRP Ledger's core payment engine—discovered and patched before public disclosure—represents a critical class of risk in mature blockchain systems: supply-cap violations. Had it been exploited, the flaw could have undermined XRP's primary value proposition: a capped, predictable monetary policy of exactly 100 billion tokens. This mirrors historical incidents like the 2014 Bitcoin transaction overflow bug, illustrating that foundational code can harbor structural flaws long after deployment.
The responsible disclosure process here—patch before public announcement—signals mature security practices within Ripple's development team, yet raises questions about how many other established chains harbor similar dormant vulnerabilities. XRP Ledger's decade-long operational history without apparent exploitation suggests either effective access controls or, more likely, that the attack surface required specific conditions. The incident underscores why blockchain systems require continuous code auditing despite network maturity, and why supply-cap confidence remains partially contingent on implementation correctness, not just consensus rules.