XRP Ledger fixes bug that could have created 18 trillion XRP

The XRP Ledger patched a payment bug that could have created spendable XRP beyond the token’s 100 billion supply. Its vulnerability disclosure report says there is no evidence the flaw was exploited on a public network.

The bug was in the ledger’s payment engine and appears to date to 2015. The report says a researcher found it through the XRPL Bug Bounty program and reported it on Sept. 22, 2026. RippleX reproduced the problem and rated it critical.

How could one payment create new XRP?

A payment that bought through hundreds of specially crafted offers could make the engine’s total overflow. The engine used a fixed-size number to add up the XRP owed across the offers. When the sum exceeded the number’s limit, it wrapped around to a small amount instead of failing.

That meant the sellers could receive the full XRP amounts listed in their offers, while the buyer was charged only the much smaller wrapped total. The ledger’s safety check for newly created XRP used similar arithmetic, so it also failed to catch the difference.

The offers had to be set up deliberately across hundreds of accounts; ordinary trades would not trigger the flaw. The Block reported that Veria Labs co-founder Cayden Liao estimated one exploit could have created about 18 trillion XRP, around 184 times the original 100 billion supply.

When did the fix take effect?

RippleX included the fix in xrpld version 3.4.1, released on Sept. 25. The report by The Block says more than 80% of validators on the default Unique Node List were running the update that day.

Protocol changes on the ledger usually wait for a vote by validators, the computers that agree on which transactions count. This fix took effect as each server upgraded. The disclosure says developers chose that route because the normal process could have left the flaw open for weeks after the fix became visible in the public code.

In version 3.4.1, the payment engine now checks for overflow and rejects a payment if its total would exceed the limit. The ledger’s “no XRP created” check also uses a wider counter, designed to avoid the same wraparound problem. The disclosure says server operators must upgrade to version 3.4.1 or newer to stay in sync with the network.

Sources

• vulnerability disclosure report — xrpl.org
• report by The Block — theblock.co