How an XRPL Bug That Threatened XRP’s 100 Billion Supply Cap Went Undetected for Years

The XRP Ledger Foundation explained that a long-standing vulnerability remained undetected because ordinary transaction activity never reached the conditions required to activate it. The flaw could theoretically have allowed attackers to create new XRP without authorization, but routine network operations did not trigger the issue.

A vulnerability that might have enabled the creation of XRP (XRP) from nothing remained in the ledger’s codebase for more than a decade, according to the XRP Ledger Foundation. The issue was discovered on September 22 by researcher Cayden Liao and Veria AI and was subsequently reported through internal channels.

The 11-year-old flaw was significant because it threatened one of the XRP Ledger’s fundamental guarantees: its total supply cannot exceed the 100 billion tokens created when the blockchain launched in 2012. RippleX developed and released a fix, and the company reported no resulting damage. The foundation said no additional XRP was created and approximately 99.986 billion XRP remain in circulation.

The XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain. Its native cryptocurrency, XRP, was designed with a fixed supply, meaning the network is not supposed to mint new tokens. XRP is primarily used to pay transaction fees and facilitate currency exchanges through the ledger’s built-in decentralized exchange (DEX).

However, the vulnerability, believed to have been present since 2015, could theoretically have circumvented that supply restriction.

How the Vulnerability Could Have Worked

The issue involved a programming flaw known as an “integer overflow.” This occurs when a numerical value exceeds the maximum number a system can represent, causing the value to wrap around to a much smaller number. The behavior is similar to an old arcade game’s score counter resetting after reaching its maximum value.

On XRPL, the flaw could have caused an excessively large transaction value to wrap around, potentially bypassing standard balance checks. Under the theoretical exploit, sellers could have received the full XRP amounts associated with their offers while buyers were charged almost nothing. The difference could effectively have resulted in unauthorized XRP creation.

An attacker could theoretically have created dummy accounts and listed fabricated token sales for extraordinarily large amounts of XRP. The attacker could then act as the buyer and attempt to purchase the listed tokens in a single operation.

If the vulnerability were triggered, the seller accounts could have been credited with billions of valid XRP, while the buyer’s recorded cost might have been negligible. By circumventing the ledger’s normal fund checks, the exploit could have generated a discrepancy between the amount credited and the amount actually paid.

An attacker might then have attempted to move the newly created XRP to external exchanges and sell it. This scenario remained theoretical, however, and there is no evidence that the vulnerability was exploited on a public network.

Why the XRPL Bug Remained Hidden for Years

The XRP Ledger Foundation said the vulnerability escaped detection primarily because activating it required an unusually large and deliberately engineered sequence of operations. In an explainer published Monday, the foundation emphasized that ordinary payments did not approach the conditions needed to trigger the flaw.

The ledger’s existing security checks also failed to identify the potential problem. As CoinDesk previously reported, a post-transaction check designed to verify that no new XRP had been created relied on the same incorrectly calculated total. Consequently, it could fail to recognize the discrepancy.

Another safeguard limited the amount of XRP an individual account could receive. However, that restriction might not have prevented the hypothetical attack because the attacker could have distributed the tokens among hundreds of separate accounts rather than concentrating them in one wallet.

The incident demonstrates how multiple safeguards can fail to detect a vulnerability when they depend on the same underlying calculation or when an attack is structured to remain within individual account limits.

The foundation also highlighted the growing influence of artificial intelligence in cybersecurity, noting that AI tools are making it easier for both attackers and security researchers to discover software weaknesses.

To strengthen XRPL security, the foundation plans to expand adversarial testing with AI, introduce formal verification methods, and improve its bug bounty program. These measures are intended to identify overlooked vulnerabilities and strengthen confidence in the ledger’s safeguards.

The foundation indicated that further updates would follow as the work progresses.

About The Author

ctleditor

See author's posts