XRPN shareholders voted on September 30 to proceed with taking Evernorth Holdings, Ripple and Arrington Capital's XRP treasury company, public on Nasdaq. Shareholders did not know about an XRP Ledger payment-engine bug that could have allowed hackers to mint trillions of new XRP for almost nothing. XRP trades today near $1.35 per token. The vulnerability made promises of a fixed XRP supply unenforceable on the network itself.
Shareholders faced a September 28 deadline to redeem XRPN shares for cash or withdraw from the plan to take Evernorth public through a merger. Evernorth's core value proposition rests on XRP's limited supply. No one disclosed the vulnerability to shareholders while the redemption window was open. XRPN shareholders made irreversible decisions during that period. The merger closed on October 9.
According to the official account, an ethical researcher privately reported the bug to Ripple's developer arm on September 22. Researcher Cayden Liao and Veria AI reported the overflow issue through a bug bounty program. RippleX and the XRP Ledger Foundation reproduced the exploit, raised the severity rating to critical and paid the bounty. Ripple shipped an emergency, closed-source fix on September 25, describing the release as "integer-arithmetic hardening." The patch shipped in xrpld 3.4.1 without an amendment vote. XRP Ledger validators have patched the bug.
An official report disclosed on October 9 that the September 25 patch fixed an inflation vulnerability. The vulnerability could have driven XRP's price to nearly $0. No one exploited the vulnerability while the vulnerability was active. The official report said the flaw likely dated to 2015. The bug report said a single validated transaction using the exploit "could have created spendable XRP far beyond the total supply."
Evernorth CEO Asheesh Birla, a former Ripple executive, said on the SPAC Insider podcast that XRP was a pre-mined digital asset. Evernorth filed the podcast transcript with the Securities and Exchange Commission. Birla said 100 billion XRP were created at inception and "that number will never change." Birla also said Ripple held a significant portion in escrow. Evernorth's proxy filing stated that all 100 billion XRP tokens were created at the XRP Ledger's launch in 2012. The supply has never changed, but the vulnerability could have allowed hackers to mint orders of magnitude more XRP over the past decade.
Ripple Labs is an investor in Evernorth and a named counterparty to the business combination agreement that took Evernorth public. Evernorth's registration statement included a generic warning that the cryptography underlying the XRP Ledger could "be flawed or ineffective." Shareholders received that warning in the prospectus. The disclosures during the redemption window did not reveal that the XRP supply cap had been technically unenforceable for most of the XRP Ledger's existence.
XRP Shareholders Voted Ignorant of Inflation Bug Before Evernorth's Nasdaq Listing
ProtosShare
Summary
On-chain news reveals XRP shareholders voted on Sept. 30 to list Evernorth on Nasdaq without knowing of a critical XRP Ledger bug. The flaw, reported Sept. 22 and fixed Sept. 25, could have let hackers mint trillions of XRP. Inflation data shows the vulnerability undermined XRP’s fixed supply, a key part of Evernorth’s value. The merger closed Oct. 9, with a report stating the bug likely existed since 2015.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.