Odometer of Damocles: A Decade-Old Glitch Almost Minted Billions in XRP Out of Nothing 💸

A vulnerability in the XRP Ledger's payment engine, present in the software since 2015, could have allowed an attacker to generate spendable $XRP without paying for it, breaking the network's fixed 100 billion $XRP supply cap, according to a vulnerability disclosure report published Friday. The bug was reported through the XRPL bug bounty program on September 22 by researcher Cayden Liao and Veria AI and patched three days later in server software version xrpld 3.4.1, released September 25. RippleX, Ripple's developer arm, said it found no sign the flaw was ever used on a public network. All 100 billion $XRP were created when the ledger launched in 2012, and its software is built so no more can ever be added.

The exploit relied on an integer overflow in the XRPL's built-in exchange, where accounts post offers to swap one token for another. An attacker could open a few hundred accounts, have each post an offer trading a tiny amount of a token for an unusually large amount of $XRP, then send a single payment that bought every offer at once. When the running total of $XRP owed grew past the 64-bit integer counter's maximum, the calculation wrapped to a tiny number, like an odometer rolling over. The selling accounts were credited in full while the buyer was charged almost nothing, leaving the attacker with newly created, spendable $XRP. A post-transaction check meant to catch new $XRP relied on the same miscounted total and missed the discrepancy. A separate limit on how much $XRP a single account can receive did not trigger either, because the attacker spread the proceeds across hundreds of accounts. The attack could be staged with a few hundred $XRP to open the accounts, most of which could be recovered, plus transaction fees.

The fix bypassed the XRPL's usual amendment process, which normally requires more than 80% support from trusted validators for two weeks before a change takes effect. "This is the first time a change to transaction processing has deliberately shipped this way since the amendment system was introduced more than ten years ago," RippleX said. In an X post on Sunday, XRPL developers wrote, "With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security." RippleX said the decision to skip a public vote was made jointly by the XRPL Foundation, RippleX, core developers and validators, and that more than 80% of default validators had upgraded on release day, before the fix's code was published. The XRPL Foundation said, "No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments." XRP Kuwait, an independent validator operator, added, "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

The disclosure came a day after Cyber Capital founder Justin Bons said marketing $XRP as decentralized amounted to "straight-up fraud," arguing during a public debate with Ripple's David Schwartz that the September 25 emergency release shipped as binaries only, temporarily withheld source code and pressured operators to upgrade. At publication, the token trades at $1.41, giving the fixed supply a market value of roughly $88.8 billion. The incident joins a string of long-dormant flaws surfaced with AI assistance since July, including a Coldcard wallet bug tied to the theft of at least 1,367 $BTC and vulnerabilities that prompted Core Lightning to advise bitcoin node operators to disconnect.