A vulnerability hidden in XRP’s code for over 10 years: one transaction could theoretically create around 18 trillion XRP out of thin air 😳
The total supply of XRP is capped at 100 billion. According to the discoverer’s estimate, this bug could create about 184 times the total supply in a single transaction.
The good news first: the XRP Ledger Foundation confirmed that no new XRP appeared on-chain. The vulnerability was fixed in version 3.4.1, and around 99.986 billion XRP are currently in circulation on the ledger.
📌 How the vulnerability worked
1️⃣ The problem was in the payment engine: when a single payment consumed many offers, the sum wasn’t checked for overflow. Once the number got large enough, it could wrap around to a very small value.
2️⃣ The attack plan: create hundreds of accounts, each offering a small amount of a token in exchange for a large amount of XRP, then execute all the offers in one payment. The sellers would receive the full amount of XRP, while the buyer would pay only a few hundred drops plus a fee.
3️⃣ The check that was supposed to prevent new XRP from being created had a similar overflow, so it didn’t stop the attack.
4️⃣ This code had been there since 2015. The developers said they found no evidence that it had been exploited on any public network.
🤖 Who discovered it
An AI agent from AI security company Veria Labs reported it on September 22 and even wrote working exploit code. RippleX released a fix three days later, and Ripple paid the maximum bug bounty of $250,000. According to Veria, this is the largest bounty ever paid for a vulnerability found entirely by AI.
🔒 The fix was unusual, too
Instead of the usual approach—publicly releasing the fix and then waiting two weeks for a vote—the patch took effect directly through a node upgrade. The official reason: a public patch would give attackers a clue. AI can now speed up vulnerability analysis, so waiting two weeks was too risky.
My three takeaways:
• Two bugs that each seemed low-risk on their own became critical when combined. A long-running blockchain doesn’t mean its code is free of flaws.
• AI is finding vulnerabilities faster and faster, and both attackers and defenders are using it. Fixing issues before disclosing them may become more common, and there will surely be debate about how to balance transparency and security.
• For those holding XRP: coins kept on an exchange or in a regular wallet require no action, and the total supply hasn’t changed. If you run your own node, make sure it’s been upgraded.
Do you think quietly fixing a vulnerability first and disclosing it later is responsible, or not transparent enough?
This is only my personal opinion and does not constitute investment advice. DYOR.
#XRP #加密安全 #AI #Ripple
The total supply of XRP is capped at 100 billion. According to the discoverer’s estimate, this bug could create about 184 times the total supply in a single transaction.
The good news first: the XRP Ledger Foundation confirmed that no new XRP appeared on-chain. The vulnerability was fixed in version 3.4.1, and around 99.986 billion XRP are currently in circulation on the ledger.
📌 How the vulnerability worked
1️⃣ The problem was in the payment engine: when a single payment consumed many offers, the sum wasn’t checked for overflow. Once the number got large enough, it could wrap around to a very small value.
2️⃣ The attack plan: create hundreds of accounts, each offering a small amount of a token in exchange for a large amount of XRP, then execute all the offers in one payment. The sellers would receive the full amount of XRP, while the buyer would pay only a few hundred drops plus a fee.
3️⃣ The check that was supposed to prevent new XRP from being created had a similar overflow, so it didn’t stop the attack.
4️⃣ This code had been there since 2015. The developers said they found no evidence that it had been exploited on any public network.
🤖 Who discovered it
An AI agent from AI security company Veria Labs reported it on September 22 and even wrote working exploit code. RippleX released a fix three days later, and Ripple paid the maximum bug bounty of $250,000. According to Veria, this is the largest bounty ever paid for a vulnerability found entirely by AI.
🔒 The fix was unusual, too
Instead of the usual approach—publicly releasing the fix and then waiting two weeks for a vote—the patch took effect directly through a node upgrade. The official reason: a public patch would give attackers a clue. AI can now speed up vulnerability analysis, so waiting two weeks was too risky.
My three takeaways:
• Two bugs that each seemed low-risk on their own became critical when combined. A long-running blockchain doesn’t mean its code is free of flaws.
• AI is finding vulnerabilities faster and faster, and both attackers and defenders are using it. Fixing issues before disclosing them may become more common, and there will surely be debate about how to balance transparency and security.
• For those holding XRP: coins kept on an exchange or in a regular wallet require no action, and the total supply hasn’t changed. If you run your own node, make sure it’s been upgraded.
Do you think quietly fixing a vulnerability first and disclosing it later is responsible, or not transparent enough?
This is only my personal opinion and does not constitute investment advice. DYOR.
#XRP #加密安全 #AI #Ripple