XRP Ledger Patches 11-Year-Old Flaw That Could Mint New XRP

The XRP Ledger has patched a long-standing vulnerability in its payment system that may have been present since 2015, according to ChainThink. The issue could let an attacker evade limits used to calculate token-exchange amounts by submitting specially crafted payment transactions, potentially creating and spending large amounts of XRP and threatening the network's 100 billion coin supply cap. The attack scenario involves creating hundreds of accounts and posting offers that swap small token amounts for large quantities of XRP. By triggering many trades at once with a single payment, the system's flawed aggregation of total transaction value could result in the seller receiving all the XRP while the buyer pays almost nothing. Researchers Cayden Liao and Veria AI disclosed the vulnerability on September 22. RippleX later reproduced the behavior and confirmed that any XRP generated through the exploit could be used in subsequent transactions. RippleX said it has found no evidence of exploitation on any public network. A fix was released in xrpld version 3.4.1 on September 25.