Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP Key XRP ledger vulnerability exposed: Developers urgently upgrade to fix potential unlimited issuance risks
Core points:
- XRP Ledger developers have disclosed a key vulnerability in a payment engine that allowed attackers to create unauthorized and expendable XRP tokens.
- A security researcher has discovered an integer overflow flaw dating back to 2015, exposing a weak link in the network supply protection mechanism.
- Developers released version 3.4.1 of xrpld via an emergency upgrade that bypasses the standard amendment process. There is currently no evidence of exploitation on public networks.
XRP ledger payment engine flaw exposes significant supply risk
A key XRP ledger vulnerability could allow an attacker to generate unauthorized XRP tokens and transfer them through ordinary accounts. XRP developers disclosed the security flaw in an October 9 report detailing the vulnerability addressed through the emergency release of xrpld 3.4.1.
According to the disclosure, there was an integer overflow error in the payment engine that could bypass security measures to protect the supply of XRP. It is possible for attackers to exploit this vulnerability through a single transaction to create expendable XRP that exceeds the network's expected supply limit.
The vulnerability affects xrpld 3.4.0 and earlier, raising concerns about flaws that have been embedded in the protocol for years. Developers also discovered a separate batch internal transaction wrapper verification error, which was resolved in an emergency update dated September 25.
A security researcher discovered a payment engine vulnerability on September 22 and submitted the results of the investigation through the XRPL Vulnerability Bounty Program. The researchers demonstrated how specially constructed trading quotes manipulate the calculation process when paying for multiple orders on a consumption ledger.
Under normal circumstances, the payment engine calculates the total amount of XRPs needed to complete transactions involving multiple orderbook quotes. However, the vulnerability caused some calculations to exceed the allowed integer limit, resulting in an unexpected reset of the result value.
Therefore, the seller can receive the full XRP payment, while the buyer bears the fees far less than the actual transaction amount. This difference effectively creates an unauthorized XRP that an attacker can transfer, trade or deposit into a cryptocurrency exchange account.
Investigators also found that because the ledger's built-in supply protection mechanism also experienced the same spillover problems, its protection could fail. Further inspection traced the vulnerability to payment engine code introduced in 2015, which means the vulnerability went undetected for approximately eleven years.
Emergency XRPL upgrades bypass the Standard Amendment process
Developers addressed the overflow with xrpld 3.4.1, which was released on September 25 to protect the network from potential exploitation. Given the severity of the issue, developers did not follow the XRP ledger's established amendment approval process to implement the amendment.
This is the first time that transaction processing changes have been intentionally made outside of the standard process since the establishment of the front-end amendment system more than a decade. Importantly, investigators found no evidence that the attacker exploited the payment engine vulnerability on any public XRP ledger network.
When server operators installed xrpld 3.4.1, the correction took effect immediately, eliminating the identified overflow vulnerability. Developers are urging operators to upgrade their servers to keep the network synchronized and ensure that revised transaction processing rules are applied.
An October 9 disclosure document documents both vulnerabilities and explains the emergency measures developers took to protect XRP ledger operations.
