XRP Ledger Fixes Critical 11-Year-Old Bug That Could "Mint" XRP via Crafted Payments

Huoxing Finance reported that the XRP Ledger has patched a payment-related vulnerability that may date back to 2015. The flaw could let an attacker evade exchange-calculation limits by submitting a specially crafted payment, effectively creating and spending large amounts of XRP and weakening the safeguard intended to cap total XRP supply at 10 billion. According to the disclosure, an attacker could create hundreds of accounts, post offers swapping tiny amounts of tokens for huge quantities of XRP, then use a single payment to fill all offers at once. Because of an error in the software's aggregation of transaction totals, seller accounts could receive the full XRP proceeds while buyer accounts would pay almost nothing. Researchers Cayden Liao and Veria AI reported the issue on September 22. RippleX later reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX said it has found no evidence the vulnerability was exploited on any public network. A fix was released in xrpld version 3.4.1 on September 25.