XRP Ledger Discloses Critical Overflow Bug That Threatened Supply Cap
A long-hidden arithmetic flaw in the XRP Ledger could have allowed unauthorized token minting before being patched in September.
XRP Ledger Discloses Critical Overflow Bug That Threatened Supply Cap
A long-hidden arithmetic flaw in the XRP Ledger could have allowed unauthorized token minting before being patched in September.
Anatomy of the XRP Ledger Overflow Bug
The XRP Ledger recently disclosed a critical arithmetic flaw that could have permitted an attacker to generate new tokens out of thin air, bypassing the network's hard limit of 100 billion tokens. According to disclosures published on October 9, 2026, the vulnerability existed in xrpld versions 3.4.0 and earlier. Researchers from Veria AI and investigator Cayden Liao originally identified the issue, which is believed to have resided within the payment engine code since it was first built around 2015.
The software relied on a 64-bit integer to aggregate payment totals when a single transaction drew from multiple offers on the order book. If this running total exceeded the maximum capacity of the integer, it would wrap around and yield a figure significantly lower than reality. An attacker could exploit this discrepancy to spend non-existent tokens while the ledger's books appeared balanced, evading existing safety checks that failed to flag the scattered inflated balances.
Emergency Patch and Network Response
RippleX, the developer arm of Ripple, confirmed the vulnerability after successfully reproducing the attack on a standalone server. Investigators found no evidence that the exploit was ever utilized on any public network, and no funds or consensus mechanisms were compromised. To address the issue, developers deployed an emergency release designated as xrpld 3.4.1 on September 25, 2026.
Crucially, the emergency release bypassed the traditional validator voting and amendment process normally required for rule changes on the XRP Ledger. While this swift action closed the vulnerability immediately, it placed significant trust in the core development team and required node operators to upgrade promptly. Network participants still operating version 3.4.0 or earlier remain vulnerable to the supply-breaking flaw.
About The Author
