XRP SECURITY | THE 92× BUG EXPLAINED
A critical XRP Ledger vulnerability exposed an unusual weakness in how large payment totals were calculated.
The issue involved a 64-bit arithmetic limit. A carefully constructed payment containing multiple mispriced offers could push the total beyond the counter’s range causing it to wrap around. That could let sellers receive payment while the buyer was charged far less than intended bypassing the check designed to prevent XRP from being created without payment.
The theoretical threshold was more than 92 times the existing XRP supply requiring at least 93 deliberately mispriced offers in one payment.
The bug was reported on September 22, fixed in xrpld 3.4.1 on September 25 and publicly disclosed on October 9.
The XRPL team reported no evidence of exploitation on public networks.
$XRP
#XRPLedgerPatchesXRPCreationBug
A critical XRP Ledger vulnerability exposed an unusual weakness in how large payment totals were calculated.
The issue involved a 64-bit arithmetic limit. A carefully constructed payment containing multiple mispriced offers could push the total beyond the counter’s range causing it to wrap around. That could let sellers receive payment while the buyer was charged far less than intended bypassing the check designed to prevent XRP from being created without payment.
The theoretical threshold was more than 92 times the existing XRP supply requiring at least 93 deliberately mispriced offers in one payment.
The bug was reported on September 22, fixed in xrpld 3.4.1 on September 25 and publicly disclosed on October 9.
The XRPL team reported no evidence of exploitation on public networks.
$XRP
#XRPLedgerPatchesXRPCreationBug