Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP XRP Ledger fixes key integer overflow vulnerability to block unauthorized issuance risks
A critical software vulnerability in the XRP Ledger (XRPL) protocol has been fixed after a flaw was discovered that could cause malicious actors to generate XRP tokens that exceed network rules limits. The problem stems from an integer overflow error in the XRPL payment engine, a core component on the ledger that handles transactions involving multiple assets.
Integer overflow exposes supply risk
Under certain conditions, transactions that consume a large number of carefully constructed quotes can cause the system to miscalculate the amount of XRP payable by the sender. If the transaction amount exceeds the range of representable numbers, the ledger does not reject the transaction as expected, but mistakenly "wraps around" the excess, resulting in a significant reduction in the calculated total. The recipient receives the full payment, but the sender only loses the wrong, reduced amount of XRP, not the total amount actually due.
This difference means that attackers can artificially inflate the supply of XRP, thereby essentially bypassing supply restrictions on cryptocurrencies. In addition, the vulnerability undermines the network's detection mechanism because its anti-creation mechanism relies on the same arithmetic logic, allowing unauthorized XRP generation to evade detection. In controlled testing, researchers confirmed that the flaw could enable unauthorized creation and subsequent transfer of XRPs that did not exist before the vulnerability was exploited.
Term resolution: integer overflow
Integer overflow is a programming error that occurs when the result of a calculation exceeds the storage capacity of the computer. This can cause extremely large numbers to be "wrapped around" to an extremely small value, posing serious security risks in financial and cryptographic systems.
Disclosure and Emergency Patches
Security researchers Cayden Liao and Veria AI reported the vulnerability to the XRPL Vulnerability Bounty Program on September 22. After review, developers upgraded the severity of the vulnerability from "significant" to "critical" due to the risk of systemic damage to the network.
Developers have concluded that if the regular protocol amendment process is followed, the vulnerability may be exposed before enough validators protect the network, increasing the likelihood of exploitation. Therefore, on September 25, the core implementation of xrpld was released version 3.4.1, adding additional overflow checks and strengthening supply protection mechanisms. Unlike standard protocol changes that require more than 80% of verifiers to approve amendments within two consecutive weeks, this emergency update takes effect immediately after verifiers immediately upgrade the software.
As of September 25, more than 80% of trusted verifiers have deployed a patched version to shut down the vulnerability before it becomes widely exploited.
Other vulnerabilities and governance disputes
In a report released on October 9, researchers also found another issue involving bulk transactions that could disrupt consensus on the XRPL network. Developers mitigated this risk with an additional amendment fixBatchV1_2, which came online at the same time as BatchV1_1 on October 9.
这些事件发生在 XRPL 一系列升级延迟之后，引发了关于网络治理以及应对关键安全问题所需快速协调响应的持续讨论。这些事件再次凸显了 XRP Ledger 社区中关于决策过程和透明度的疑问。
