$XRP #Tether冻结Ledger盗窃案相关USDT
#XRP账本修复可增发XRP的漏洞 XRP Ledger patches decade-old bug that could create XRP out of thin air
XRP Ledger has patched a major vulnerability that had remained hidden for about a decade. According to a vulnerability disclosure report published by the official XRPL account on October 9, an integer overflow error in the payment engine could have allowed an attacker to create spendable XRP out of thin air using a set of specially crafted offers and a single payment. The amount could even have exceeded XRP’s total supply. The patch was released in xrpld version 3.4.1, and officials say there is currently no evidence that the vulnerability was exploited on any public network.
How the vulnerability worked: numbers got too large, and the sum “wrapped around” to a smaller value
According to the report, the problem lay in how the payment engine calculated the amount owed by a buyer. When a payment passed through the on-chain order book and consumed many offers at once, the engine added up the amounts of those offers using a 64-bit integer without overflow checks. XRP balances are stored as bounded integers. Once the sum exceeded the limit, it did not produce an error; instead, it “wrapped around” to a very small number.
As a result, the engine paid offer owners the full amount of each offer as usual, but charged the buyer only the small amount left after the wraparound. The difference was XRP created out of thin air. More troublingly, XRP Ledger’s built-in safety check against “creating XRP” used the same method to calculate the sum, so it also wrapped around and failed to detect anything. Another check that looked at the balance of a single account was not triggered because the newly created XRP was spread across hundreds of accounts.
The bar for an attack was also not high. The report said an attacker only needed to open hundreds of accounts, each placing an offer to sell a huge amount of XRP for a tiny amount of tokens, then use another account to submit a payment that consumed all those offers at once. The actual cost was just a few hundred XRP for the accounts and offer reserves (which could be reclaimed afterward), plus transaction fees. However, this attack would not be triggered accidentally; the amounts involved in normal transactions are nowhere near the overflow threshold.
Hidden since 2015, discovered through the bug bounty program
The report said the error may have existed since 2015, when the current payment engine was written. Researchers reported it through the XRPL bug bounty program on September 22. According to CoinDes
#XRP账本修复可增发XRP的漏洞 XRP Ledger patches decade-old bug that could create XRP out of thin air
XRP Ledger has patched a major vulnerability that had remained hidden for about a decade. According to a vulnerability disclosure report published by the official XRPL account on October 9, an integer overflow error in the payment engine could have allowed an attacker to create spendable XRP out of thin air using a set of specially crafted offers and a single payment. The amount could even have exceeded XRP’s total supply. The patch was released in xrpld version 3.4.1, and officials say there is currently no evidence that the vulnerability was exploited on any public network.
How the vulnerability worked: numbers got too large, and the sum “wrapped around” to a smaller value
According to the report, the problem lay in how the payment engine calculated the amount owed by a buyer. When a payment passed through the on-chain order book and consumed many offers at once, the engine added up the amounts of those offers using a 64-bit integer without overflow checks. XRP balances are stored as bounded integers. Once the sum exceeded the limit, it did not produce an error; instead, it “wrapped around” to a very small number.
As a result, the engine paid offer owners the full amount of each offer as usual, but charged the buyer only the small amount left after the wraparound. The difference was XRP created out of thin air. More troublingly, XRP Ledger’s built-in safety check against “creating XRP” used the same method to calculate the sum, so it also wrapped around and failed to detect anything. Another check that looked at the balance of a single account was not triggered because the newly created XRP was spread across hundreds of accounts.
The bar for an attack was also not high. The report said an attacker only needed to open hundreds of accounts, each placing an offer to sell a huge amount of XRP for a tiny amount of tokens, then use another account to submit a payment that consumed all those offers at once. The actual cost was just a few hundred XRP for the accounts and offer reserves (which could be reclaimed afterward), plus transaction fees. However, this attack would not be triggered accidentally; the amounts involved in normal transactions are nowhere near the overflow threshold.
Hidden since 2015, discovered through the bug bounty program
The report said the error may have existed since 2015, when the current payment engine was written. Researchers reported it through the XRPL bug bounty program on September 22. According to CoinDes