coindesk.com
A bug that could have let an attacker print new $XRP ($XRP) out of nothing sat in the $XRP Ledger for more than a decade without anyone noticing because normal user activity never came close to triggering it, according to $XRP Ledger Foundation.
The 11-year-old bug mattered because it threatened the core rule $XRP holders rely on: that the total supply can never exceed the 100 billion coins created at the blockchain’s debut in 2012. It was uncovered Sept. 22by researcher Cayden Liao and Veria AI and reported internally.
No damage was done, according to RippleX, which shipped the fix. No new $XRP was created and about 99.986 billion $XRP remain in circulation today, the foundation said.
The $XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain. Its native token, $XRP, was built so that no new tokens can ever be minted. The coin is primarily used to pay transaction fees and bridge currency trades on the ledger's built-in decentralized exchange (DEX).
However, the bug, believed to have existed since 2015, provided a way around that, at least in theory.
Here’s how it could have worked
The bug stemmed from a vulnerability known as an “integer overflow,” which, like an old arcade game’s score counter, resets to zero every time it hits its maximum.
In the $XRP Ledger case, the flaw meant that once a transaction size exceeded the system's maximum allowed numerical limit, the value wrapped around to a very small number. That bypassed standard fund checks, crediting sellers their full $XRP amounts while charging buyers next to nothing, effectively minting the difference out of thin air and artificially inflating the total $XRP supply.
An attacker could have set up dummy accounts to post fake token sales worth astronomical amounts of $XRP. Then, acting as the buyer, the attacker could have paid in $XRP, buying all tokens at once. The ledger would credit the seller accounts with billions of valid $XRP and, overwhelmed by the sheer amount of $XRP, would have registered a total cost of only a fraction of a cent for the buyer.
By bypassing standard fund checks, the system would effectively mint the difference out of thin air, allowing the attacker to walk away with billions of new $XRP to liquidate on external exchanges.
Why it went unnoticed?
The bug went unnoticed mainly because it required a massive scale of action to trigger, the $XRP Foundation said in an explainer published Monday.
“No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations,” it said.
