XRP Ledger fixes payment bug that could mint spendable tokens

XRP Ledger server operators need to run version 3.4.1 or newer to guard against a payment bug that could create spendable XRP; RippleX says it found no evidence the flaw was exploited on a public network. The XRPL vulnerability disclosure report says the fix shipped on Sept. 25, and takes effect as soon as a server upgrades.

The bug could have broken XRP’s fixed-supply rule, so the upgrade closes a route to creating tokens that could be moved or traded like ordinary XRP.

How could a payment create new XRP?

A payment that consumed hundreds of specially priced offers could make the ledger’s payment engine miscount the total XRP owed. According to the XRPL report, the engine would credit each offer owner the full amount but charge the buyer only the much smaller total left after the number overflowed.

The problem was an unchecked addition in the payment engine: when the sum exceeded what its fixed-width counter could hold, it wrapped around instead of failing. The ledger’s “no XRP created” safety check used the same kind of counter and made the same mistake, while a separate balance limit could be avoided by spreading the tokens across many accounts.

Researchers Cayden Liao and Veria AI reported the flaw through the bug bounty program on Sept. 22. RippleX reproduced the exploit on a standalone server and confirmed the newly created XRP could be spent in a later payment, according to the disclosure report.

What does the fix require from operators?

Operators must upgrade to `xrpld` 3.4.1 or newer to stay in sync with the network. The software now checks for overflow when it totals offers and rejects the affected part of a payment; it also uses a wider counter for the “no XRP created” check.

The attack was not something an ordinary trade or payment could trigger. It required hundreds of accounts with deliberately bad offers, followed by a payment crafted to consume them all at once; the report says the attack could not happen by accident. The accounts would require a few hundred XRP in reserves, mostly recoverable when the objects were removed, plus normal transaction fees.

Was XRP actually created on the public ledger?

RippleX reported no evidence of exploitation on any public network. Its investigation indicates the bug may have been present since the current payment engine was written in 2015, but it was identified only when a researcher found and reported it.

The CoinDesk report on the patch describes the flaw as a threat to XRP’s 100 billion token supply cap, established when the ledger launched in 2012. XRPL developers shipped the fix without waiting for the usual amendment process, which normally requires validator support before a protocol change takes effect; the disclosure says that delay would have left the public exploit visible and usable for weeks.

Source material

• XRPL vulnerability disclosure report — xrpl.org
• CoinDesk report on the patch — coindesk.com