Brief

The maintainers of XRP Ledger have disclosed and fixed a serious payment engine overflow vulnerability. This vulnerability was reported through a bounty program in September and could have allowed attackers to forge XRP.

Developers stated that this flaw went undetected for so long because normal payments did not trigger it, and the security checks in the ledger that are designed to prevent the creation of “XRP” also used problematic arithmetic logic.

XRP Ledger developers have disclosed and fixed a serious vulnerability. If left unaddressed, this vulnerability could allow attackers to create XRP out of thin air; this flaw has been lurking in network code for about ten years.

In the disclosure released on Friday, the ledger maintainer stated that a researcher reported the issue in September through the XRPL bug bounty program. The issue was located in the payment engine, which is the software part that handles payments, and it was a type of integer overflow vulnerability.

When a payment consumes hundreds of specially constructed quotes from the order book, the total amount that the buyer should pay exceeds the maximum value that the system can store, resulting in a number that becomes very small after "wrapping around." The engine makes full payments to each seller, yet charges the buyer almost nothing; the difference is equivalent to newly minted XRP.

Worse still, the built-in security checks in the ledger are designed to ensure that no transaction creates XRP, but they use the same flawed arithmetic, which also results in the same kind of issues and fails to detect such problems. The maintainers stated that attackers could have created a quantity of XRP that far exceeds the total token supply in a single transaction, and then transferred, traded, or sent it to exchanges.

Engineers from RippleX have confirmed that this vulnerability has existed since the current payment engine was developed in 2015; it has simply not been discovered because normal payments are far from sufficient to trigger an overflow.

The team stated that there is currently no evidence indicating that this vulnerability has been exploited. The fix was released on September 25 in version 3.4.1, and on that day, over 80% of network trusted validators were already running that version.

It is worth noting that this patch bypassed the usual revision process of the ledger. Normally, validators would need to vote and wait for two weeks before the changes would take effect. This is the first time in over a decade since the system was launched that changes at the transaction processing level have been intentionally released in this manner. The maintainers stated that they chose this approach because the severity of the issue was sufficient to justify it; if the fix had been made public through the regular process, the vulnerability would have been exposed and could still have been exploited for several weeks.

This revelation reminds people of a fake coin panic that shook Zcash this year. At that time, this privacy coin hurriedly patched a security vulnerability in its shielding pool, which could have allowed the creation of fake tokens. That incident led to a significant drop in ZEC, and it was only after an upgrade to the network's Ironwood that the problem was resolved.

XRP was not spared this week either. On Monday, the token traded at $1.38, showing a 1.6% decline in the past 24 hours, performing the worst among major cryptocurrencies; it has fallen by 9.4% over the past 7 days.