XRP Ledger Patches 10-Year-Old Overflow Vulnerability That Could Mint Trillions of XRP

[XRP Ledger patches a decade-old payment engine overflow vulnerability that could theoretically mint trillions of XRP] According to The Block, the XRP Ledger has patched a critical integer overflow vulnerability in its payment engine that has existed since 2015. The flaw could theoretically allow a single transaction to mint XRP far exceeding the 100 billion supply cap, with the newly minted tokens fully transferable. The vulnerability was discovered by an AI agent from security firm Veria Labs, with co-founder Cayden Liao submitting the report; the team received the maximum $250,000 bounty under the program. RippleX released an emergency fix in version xrpld 3.4.1 on September 25, bypassing the standard validator voting process so the upgrade takes effect immediately. No evidence of exploitation on public networks has been detected. The vulnerability stems from the payment engine lacking overflow checks when aggregating order amounts. An attacker could set up hundreds of limit order accounts and craft malicious orders, enabling an attack with a single payment transaction. Sellers would receive the full amount of XRP, while the attacker pays only minimal fees; the network’s native anti-inflation checks fail to block the attack due to the same arithmetic overflow. This attack cannot be triggered accidentally—it requires specially constructed orders and dedicated transactions to activate.