XRPL fixes payment bug that could have created 18 trillion XRP
XRPL's 3.4.1 patch blocks a payment overflow that could create spendable XRP; the flaw dated to 2015, and developers found no evidence of public exploitation.
The Blockheight Editors··2 min read
RippleX released an XRP Ledger patch on September 25 that fixes a payment bug capable of creating spendable XRP, according to the XRPL vulnerability disclosure report. The flaw, which developers said may have been in the payment engine since 2015, was fixed in software version 3.4.1.
How could one payment create new XRP?
The payment engine can fill multiple offers in an order book at once. The report says that when it added amounts across hundreds of specially crafted offers, a 64-bit integer could overflow and wrap to a small number: offer owners received the full XRP amounts, while the buyer was charged only the wrapped total.
The ledger’s “no XRP created” safety check used similar arithmetic and could miss the resulting difference. The exploit required hundreds of unusual offers and a payment built to consume them together; the report says ordinary payments would not trigger it. The Block reported Veria Labs co-founder Cayden Liao’s estimate that one exploit transaction could have created about 18 trillion XRP.
What did version 3.4.1 change?
The patch makes the payment engine check for overflow when it totals offers and combines results across payment paths. The report says an overflowing payment now fails rather than creating XRP; it also widens the counter used by the “no XRP created” check to prevent it wrapping around.
RippleX confirmed the issue on September 22 after a bug bounty report and released version 3.4.1 three days later. Unlike the ledger’s usual amendment process, the payment fix took effect on each server as it upgraded, the report says. More than 80% of validators on the default Unique Node List were running the patched version on release day.
Was the flaw exploited, and what happens next?
The XRPL report says developers found no evidence that the bug was exploited on any public network. XRPL says server operators must upgrade to version 3.4.1 or newer to remain in sync; whether anyone tried the exploit on a private network is not stated in the report.
Source material
- XRPL vulnerability disclosure report — xrpl.org
- reported Veria Labs co-founder Cayden Liao’s estimate — theblock.co