The XRP Ledger Foundation has revealed why a serious software vulnerability that could have compromised XRP’s 100 billion supply limit remained undetected for years: everyday transactions never activated the conditions necessary to expose the flaw.
The bug could theoretically have allowed attackers to create new XRP without paying for it. According to the foundation, the vulnerability had remained in the ledger’s software for more than a decade because normal network activity did not reach the unusual conditions required to trigger it.
Researcher Cayden Liao and Veria AI identified the issue on September 22 and reported it internally. The discovery raised concerns because the vulnerability threatened a fundamental feature of the XRP Ledger: its supply is capped at the 100 billion tokens created when the blockchain launched in 2012.
RippleX subsequently released a fix. The foundation said no additional XRP was created and no damage from exploitation was identified. Approximately 99.986 billion XRP remain in circulation, according to the foundation.
The XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain whose native asset, XRP, was designed with a fixed supply. The network does not support the intended creation of new XRP tokens. XRP is mainly used to pay transaction fees and facilitate currency exchanges through the ledger’s built-in decentralized exchange (DEX).
The vulnerability, believed to have been present since 2015, could nevertheless have provided a theoretical route around those safeguards.
How the XRPL Flaw Could Have Enabled Unauthorized XRP Creation
The issue involved an error known as an “integer overflow.” This occurs when a calculation exceeds the maximum numerical value a system can handle, potentially causing the value to wrap around to a much smaller number. It resembles an old arcade game counter that resets after reaching its highest possible score.
On XRPL, the flaw could have caused exceptionally large transaction values to be calculated incorrectly, potentially bypassing standard checks on available funds. In a hypothetical exploit, sellers could have received the full XRP amounts associated with their offers even though buyers were charged almost nothing. The resulting imbalance could have created spendable XRP without a corresponding payment.
An attacker could theoretically have created dummy accounts and posted fabricated token offers involving enormous XRP amounts. The attacker could then act as the buyer and attempt to purchase the listed assets in one operation.
If successful, the transaction could have credited seller accounts with billions of XRP while recording only a negligible cost for the buyer. By exploiting the faulty calculation and bypassing normal balance checks, an attacker might have generated additional XRP and subsequently attempted to sell it on external cryptocurrency exchanges.
The scenario describes the vulnerability’s potential capabilities, not a confirmed attack. RippleX reported no evidence that the flaw had been exploited on a public network.
Why the Vulnerability Escaped Detection
The XRP Ledger Foundation attributed the lengthy detection period to the unusual scale and complexity required to activate the bug. In an explainer published Monday, the organization said normal payment activity never came close to triggering the vulnerable code. Exploitation would have required hundreds of carefully constructed operations.
The ledger’s own verification mechanisms also failed to reveal the issue. A check designed to run after transactions and ensure that no new XRP had appeared relied on the same incorrectly calculated total. Because the verification process used the faulty figure, it could fail to identify the discrepancy.
Another safeguard restricted how much XRP a single account could receive. However, that measure might not have stopped the theoretical exploit because the attacker could distribute the tokens across hundreds of accounts, keeping each balance below the individual account limit.
The case highlights a potential weakness in layered security systems: safeguards may not provide independent protection when they depend on the same underlying calculation or can be bypassed through carefully structured transactions.
Foundation Plans Stronger AI-Assisted Security Testing
The foundation also highlighted artificial intelligence as an increasingly important factor in vulnerability research. AI-assisted tools can help security researchers uncover defects in established software, but they can also give attackers new ways to identify weaknesses and develop exploits.
To strengthen XRPL’s defenses, the foundation plans to expand adversarial testing with AI, adopt formal verification methods, and improve its bug bounty program. The measures are intended to help uncover hidden software defects before they can threaten the ledger’s operation or its supply protections.
Although the flaw represented a theoretical risk to XRP’s fixed supply, the issue was patched without evidence of unauthorized token creation. The foundation said it would share further information as its security initiatives move forward.
