Ripple's Hidden Vulnerability Could Have Created 18T XRP
Key Summary
RippleX and the XRP Ledger Foundation disclosed a payment-engine vulnerability that could theoretically have created approximately 18 trillion spendable XRP in one transaction, far exceeding the ledger's intended 100 billion XRP supply. The fix was released in xrpld 3.4.1, and there is no evidence of exploitation on a public network or unauthorized XRP creation.
Impact AssessmentThe vulnerability was a supply-integrity risk, not a confirmed supply breach. The disclosure explicitly states that investigators found no evidence of exploitation on a public network or unauthorized XRP creation. The available disclosure does not report confirmed public-network compromise or lost funds, and the potential scale should not be mistaken for an observed market or supply event.
Bug DetailsThe payment engine can consume offers from the order book as one payment crosses a trading path. The vulnerability occurred when adding amounts from many offers, causing an unchecked integer overflow. This overflow led to a difference between the amount paid to offer owners and the amount charged to buyers, resulting in newly created XRP. The ledger's