XRPL fixes bug that could mint 18 trillion XRP in one payment

The XRP Ledger patched a payment bug that could have created spendable XRP out of nothing, putting its fixed supply at risk. The XRPL vulnerability report says the flaw was fixed in server software version 3.4.1, released on Sept. 25.

How much XRP could the bug have created?

Veria Labs co-founder Cayden Liao estimated that one exploit could have created about 18 trillion XRP, according to The Block’s report on the flaw. That is about 184 times the 100 billion XRP initially created for the ledger.

The XRPL report says a researcher reported the flaw through the bug bounty program on Sept. 22. RippleX engineers reproduced it on a standalone server and confirmed that the newly created XRP could be spent in a later payment. The developers say they found no evidence of exploitation on any public network.

How could one payment create new XRP?

The flaw was in the payment engine that handles trades across multiple offers in the ledger’s built-in exchange. An attacker could set up hundreds of accounts, each offering a tiny amount of another token for an unusually large amount of XRP, then use one payment to take all the offers.

The software added up the XRP owed across those offers using a fixed-size number. When the total exceeded what that number could hold, it wrapped around to a much smaller figure. The sellers would still receive their full amounts, while the buyer was charged only the smaller total.

A ledger safety check also missed the extra XRP because it used the same kind of calculation and wrapped around in the same way. The attack required hundreds of deliberately arranged offers and a payment built to consume them; the report says normal trades would not trigger it.

What changed in the patch, and what comes next?

Version 3.4.1 adds an overflow check to the payment engine. If the total would exceed the number’s limit, that part of the payment fails instead of creating XRP. The report says the flaw appears to have been present since the payment engine was written in 2015.

The XRP overflow fix took effect as each server upgraded, rather than waiting for the ledger’s usual amendment process. The next signal to watch is whether developers find any evidence that the flaw was exploited on a public network; the XRPL report says there is none so far.

Source material

• XRPL vulnerability report — xrpl.org
• The Block’s report on the flaw — theblock.co