A vulnerability that could have allowed an attacker to mint billions of XRP and break the ledger's 100 billion token cap sat undetected in the codebase for more than a decade, the XRP Ledger Foundation disclosed this week. Researchers reported the flaw on Sept. 22, and RippleX has since patched it with no evidence of exploitation on the public network.
The flaw and the fix
The bug, an integer overflow believed to date to 2015, would have let an attacker construct hundreds of transactions that pushed numerical values past the system's maximum limit. Once that limit was exceeded, the cost wrapped to a near-zero figure while seller accounts were credited with the full nominal amounts, effectively creating XRP from nothing. RippleX said no unauthorized tokens were minted and circulation stands at roughly 99.986 billion XRP, unchanged from before the disclosure.
Why it went unnoticed
Normal activity never came close to triggering the condition, the foundation said. The exploit required a massive, deliberate sequence of operations spread across hundreds of accounts, which also sidestepped the ledger's per-account receive limits. The post-transaction supply check failed to catch it because that check relied on the same miscounted total the bug produced.
What changes now
The foundation said artificial intelligence is accelerating vulnerability discovery for both attackers and defenders, and it plans to expand its review processes. The episode underscores that a supply cap enforced only by code is only as reliable as the arithmetic underneath it.