#xrpledgerpatchesxrpcreationbug
Few things matter more to a fixed-supply asset than the supply itself. That's why a newly disclosed XRP Ledger vulnerability, one that could have allowed unauthorized XRP to be created, drew attention this week, even though the fix has been out for weeks.
Here's the sequence, as reported:
• The report: On September 22, researchers Cayden Liao and Veria AI reported the issue through the XRPL Bug Bounty program. RippleX reproduced it on a standalone test server and confirmed the created XRP could be spent. • The flaw: An integer overflow in the payment engine. If a single payment consumed enough order-book offers, a calculation could wrap around to a much smaller number, so sellers would be credited in full while the buyer paid far less. The difference could become newly created XRP. The bug appears to date back to 2015. • The fix: Version xrpld 3.4.1 shipped on September 25, adding overflow checks and a wider safety counter. It was released as an emergency patch without the usual validator amendment vote, to avoid leaving the flaw exposed during a public voting window. RippleX says over 80% of default UNL validators were on the patched version or later by that day. • The disclosure: The details were published on October 9. RippleX reports no evidence of exploitation. A second, lower-severity bug affecting the Batch feature was also fixed, and it wasn't active on mainnet when identified.
Why it matters: A minting bug is a different category from a theft bug, since it goes directly at supply integrity. Exploiting it would have required a carefully prepared setup of hundreds of offers plus a few hundred XRP in reserves, which may help explain why it went unnoticed. The episode also shows two sides of the process: a bug bounty working as intended, and the trade-off between moving quickly on a patch and the decentralized, vote-based way the network normally changes.
When a critical fix has to ship before the community can vote on it, how should networks balance speed, transparency and consensus?
