Developers behind the XRP Ledger have disclosed a bug in its payment engine that could have let an attacker create XRP far beyond the token’s total supply in a single transaction.
The flaw had been in the code since the current payment engine was written in 2015. A researcher reported it through the XRPL bug bounty programme in September, and a fix shipped on 25 September. The disclosure came on Friday. Developers say there is no evidence the bug was ever exploited.
How it worked
The bug was an integer overflow. When a single payment consumed hundreds of specially crafted offers from the order book, the total the buyer owed grew larger than the maximum number the system could store. Instead of failing, it wrapped around to a tiny figure.
The engine then paid each seller in full while charging the buyer almost nothing. The difference was new XRP, created from nothing. According to the maintainers, an attacker could have moved, traded or sent that XRP to exchanges.
The ledger has a safety check designed to confirm that no transaction creates XRP. It used the same arithmetic, wrapped the same way, and would have caught nothing. The bug went unnoticed for so long because no ordinary payment comes anywhere near triggering it.
A fix without a vote
Changes to how the XRP Ledger processes transactions normally go through its amendment process, which needs a validator vote and a two-week wait. This fix skipped it, the first time a transaction-processing change has shipped that way since the system launched.
The maintainers said the severity justified it. Publishing the fix through the usual open process would have revealed the bug while leaving it exploitable for weeks. More than 80% of the network’s trusted validators were running the patched version 3.4.1 on the day it shipped.
The price
XRP traded at $1.38 on Monday, down 1.6% on the day, the weakest of the major cryptocurrencies, and 9.4% over the week.
