about 18 trillion $XRP —that’s how much, according to Veria’s estimate, a single transaction could create. while the cap on the entire supply is 100 billion
A bug in XRPL’s payment code had been around since 2015: offer amounts were added up with a 64-bit counter, with no checks. It overflowed—and a huge number turned into a small one
Found by Veria’s AI agent; the team got a $250000 bounty
XRPL says it found no evidence of an exploit on public networks
But two things bother me more:
1. The “XRP can’t be created” check used the same counter. It overflowed too and only saw the fee. So the check stayed silent precisely where it should have sounded the alarm
2. The fix in xrpld 3.4.1 went out without a validator vote
And the code was published about two weeks after the binaries. Justin Bons puts it this way: XRP ran on closed-source code for two weeks
The fix was quick, good. But closed-source code on a network of validators? I don’t know, I don’t know
#XRPL #xrp
A bug in XRPL’s payment code had been around since 2015: offer amounts were added up with a 64-bit counter, with no checks. It overflowed—and a huge number turned into a small one
Found by Veria’s AI agent; the team got a $250000 bounty
XRPL says it found no evidence of an exploit on public networks
But two things bother me more:
1. The “XRP can’t be created” check used the same counter. It overflowed too and only saw the fee. So the check stayed silent precisely where it should have sounded the alarm
2. The fix in xrpld 3.4.1 went out without a validator vote
And the code was published about two weeks after the binaries. Justin Bons puts it this way: XRP ran on closed-source code for two weeks
The fix was quick, good. But closed-source code on a network of validators? I don’t know, I don’t know
#XRPL #xrp