Ten years hiding in the ledger, and XRPL's integer overflow almost minted itself a bailout 🚰

A critical integer overflow vulnerability sat dormant in the XRP Ledger's built-in decentralized exchange payment engine for roughly a decade before researchers flagged it, RippleX has confirmed, and an emergency patch shipped in xrpld 3.4.1 on September 25 with public disclosure following on October 9. The flaw, if exploited, could have silently minted billions of XRP and broken the network's fixed 100 billion token supply, according to RippleX. More than 80% of default UNL validators were running xrpld 3.4.1 on the day of release, the developer team said, and RippleX confirmed there is no evidence the bug was ever exploited in the wild.

The vulnerability was identified by researchers Cayden Liao and Veria AI, who reported it through the XRPL Bug Bounty program on September 22, 2026. It traced back to payment engine code written around 2015 and involved the way the engine summed XRP amounts across offers on the built-in DEX, creating conditions for an integer overflow. The discovery has drawn attention at a moment when XRP's supply integrity underpins a wave of institutional activity, including Evernorth, Ripple Prime, and Meritz, all of which have exposure to the token's fixed-cap economics.

RippleX moved to ship the fix before disclosing the flaw publicly, a sequencing decision consistent with the team's stated approach to responsible patching. The integer overflow sat undetected for over ten years and was only surfaced once Liao and Veria AI submitted their finding via the official bug bounty channel. The patch in xrpld 3.4.1 addressed the summation logic that could have allowed artificial XRP creation through manipulated DEX offer paths, and RippleX said validator adoption crossed the 80% threshold within hours of the coordinated release.

The episode comes against a backdrop of accelerating institutional infrastructure built around $XRP, with Evernorth, Ripple Prime, and Meritz cited as recent entrants tying balance sheet or product strategy to the asset. Supply integrity has been repeatedly cited as a core property of XRP, and the absence of any confirmed exploitation is expected to feature in ongoing technical due diligence. The 100 billion fixed supply cap remains intact, according to RippleX, and the patched client is available to node operators who had not yet upgraded at the time of disclosure.