How Critical XRP Ledger Bug Nearly Unleashed Unlimited XRP Mint

XRP Ledger Bug Exposed: How Critical Vulnerability Could Have Unleashed Unlimited XRP

Overview

The XRP Ledger developers recently released a vulnerability disclosure report for the latest reference server implementation of the XRP Ledger protocol, xrpld 3.4.1. This release was an emergency update to fix critical security vulnerabilities in the XRPL protocol.

Background

The bug was identified through the XRPL Bug Bounty program, where a researcher reported an integer overflow in the payment engine that could be exploited to create XRP from nothing. The overflow occurred when a sum of amounts from a single payment consumed many offers from the order book, resulting in new XRP that should never have existed.

Fix and Impact

The fix for the payment engine XRP overflow error was shipped in xrpld 3.4.1, and it applies immediately upon upgrade to v3.4.1. XRPL server operators are urged to upgrade to the latest version to maintain sync with the network. Although investigation revealed that the bug had been present since the current payment engine was written in 2015, it was only identified and reported last month. No evidence was found that this issue was exploited on any public network.

Conclusion

The XRP overflow fix applies immediately upon upgrade to v3.4.1, and XRPL server operators are urged to upgrade to the latest version to maintain sync with the network. This fix marks the first time a change to transaction processing was deliberately shipped this way since the amendment system was introduced more than ten years ago.