Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
XRP XRP ledger discloses payment engine integer overflow vulnerability
On October 9, XRP ledger (XRPL) publicly disclosed an integer overflow vulnerability in its payment engine. The vulnerability once allowed the creation of expendable XRP beyond the network's expected supply caps through carefully crafted transactions. The disclosure follows an emergency software update released on September 25. XRPL said that after investigation, it found no evidence of exploitation on any public network.
released xrpld 3.4.1 to add overflow checking
as part of an emergency security update, and XRPL released a version of xrpld 3.4.1 on September 25. This version adds overflow checking to payment calculations and strengthens the ledger's "no XRP generation" invariant, aiming to ensure that transactions cannot generate new XRPs. Two weeks later, the network detailed the underlying flaws. In an October 9 disclosure document, XRPL noted that the integer overflow issue affected payment engines and could result in the creation of expendable XRPs that exceeded the expected limit.
How carefully constructed quotes bypass protection mechanisms
This issue is not a simple single transaction attack. According to XRPL, an attacker would need hundreds of deliberately priced quotations and then initiate a payment transaction to trigger vulnerable computing logic. This sequence of operations can bypass the protection mechanisms that prevent XRPs from being generated, causing the amount of XRPs that can be spent to exceed the supply limit of the ledger design, rather than just producing erroneous displays or accounting results.
No evidence of exploitation found on public networks
Although XRPL said it found no evidence that the vulnerability was exploited on public networks, this assessment did not change the severity of the vulnerability described in the disclosure. According to a report by Bitcoin.com News on October 10, the vulnerability was regarded as a legacy of ten years ago that could have caused the supply of XRP to exceed the 100 billion token limit set by the network. The report also pointed out that the patch had been deployed before the vulnerability was publicly disclosed.
