XRP Ledger Patches 11-Year-Old Critical Vulnerability That Could Create XRP Out of Thin Air

Huoxing Finance reports that the XRP Ledger has recently patched a payment system vulnerability potentially dating back to 2015. This vulnerability could allow attackers to bypass the system’s limits on token exchange calculations through a specially crafted payment transaction, artificially generating and spending large amounts of XRP, thereby undermining the mechanism that caps the total supply of XRP at 10 billion. According to the disclosure, attackers could create hundreds of accounts, place offers to exchange small amounts of tokens for massive quantities of XRP, and then execute a single payment transaction to fill all these offers simultaneously. Due to a flaw in how the software calculates total transaction amounts, seller accounts could receive the full amount of XRP while buyer accounts pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22; RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version xrpld 3.4.1 on September 25 to patch the vulnerability.