XRP Ledger fixes critical 2015 vulnerability

XRP Ledger security vulnerability integer overflow bug bounty blockchain governance

Developers of the XRP Ledger (XRPL) have deployed an emergency patch to fix a critical security vulnerability that had existed in the network's payment engine since 2015. The flaw, discovered by researcher Cayden Liao and Veria Labs using an AI agent, involved an integer overflow that could have allowed an attacker to mint approximately 18 trillion XRP—roughly 184 times the total supply—through a single, carefully constructed transaction.

To prevent the vulnerability from being exploited while the fix was being developed, the XRPL team bypassed the standard two-week validator amendment process, releasing the patch on September 25. This unprecedented move has sparked a debate regarding the network's decentralization, with some critics questioning whether coordinated emergency updates undermine the protocol's governance. The XRP Ledger Foundation and RippleX defended the decision, stating that the standard process would have made the vulnerability public weeks before the fix could be implemented, creating an unacceptable security risk.

There is currently no evidence that the flaw was ever exploited on a public network. Veria Labs received a $250,000 reward, the highest in the program, for their discovery. The XRP Ledger Foundation has since committed to enhancing security through increased AI-based testing and formal verification.

Entities

Cayden Liao · RippleX · Veria AI · Veria Labs · XRP Ledger · XRP Ledger Foundation

Claims

What the coverage asserts, and how many sources carry each claim.

[● 6 SOURCES] The vulnerability could have allowed the creation of approximately 18 trillion XRP in a single transaction. phocapblockchain.net · bitcoinbasis.de · www.crypto-insiders.nl · crypto.news · www.sondakika.com
[● 3 SOURCES] The emergency patch bypassed the standard two-week validator voting process. zombit.info · www.cryptobreaking.com · cointelegraph.com
[● 4 SOURCES] Developers released an emergency patch (version xrpld 3.4.1) on September 25. zombit.info · bitcoinbasis.de · crypto.news · www.sondakika.com
[● 8 SOURCES] There is no evidence that the vulnerability was exploited on any public network. phocapblockchain.net · zombit.info · newsbit.nl · bitcoinbasis.de · crypto.news · +1 more
[● 6 SOURCES] Veria Labs received a $250,000 reward for reporting the bug. phocapblockchain.net · www.crypto-insiders.nl · crypto.news · www.sondakika.com · timestabloid.com
[● 10 SOURCES] Veria Labs and researcher Cayden Liao discovered the vulnerability. phocapblockchain.net · newsbit.nl · bitcoinbasis.de · www.crypto-insiders.nl · crypto.news · +4 more
[● 9 SOURCES] The security flaw was caused by an integer overflow in the payment engine. zombit.info · bitcoinbasis.de · www.tokenpost.com · phocapblockchain.net · cryptonewsland.com · +3 more
[● 14 SOURCES] The bug had existed in the XRP Ledger codebase since 2015. phocapblockchain.net · zombit.info · newsbit.nl · bitcoinbasis.de · crypto.news · +8 more
[● 17 SOURCES] A vulnerability in the XRP Ledger payment engine existed since 2015. phocapblockchain.net · zombit.info · newsbit.nl · bitcoinbasis.de · www.blockmedia.co.kr · +9 more
[● 4 SOURCES] Veria Labs received a $250,000 reward for discovering the vulnerability. phocapblockchain.net · www.crypto-insiders.nl · crypto.news · www.sondakika.com
[● 9 SOURCES] There is no evidence the vulnerability was exploited on a public network. phocapblockchain.net · zombit.info · newsbit.nl · bitcoinbasis.de · crypto.news · +4 more
[● 8 SOURCES] The emergency patch was released on September 25. zombit.info · www.blockmedia.co.kr · crypto.news · www.cryptobreaking.com · www.tokenpost.com · +3 more