A security flaw in the XRP Ledger's payment system could have allowed an attacker to create large amounts of new XRP without paying for it, breaking the token's fixed-supply rule, according to a security report published Friday.
The bug, believed to date to 2015, was found by researcher Cayden Liao and Veria AI and internally reported on Sept. 22. Engineers at RippleX, Ripple's developer arm, reproduced the attack on a standalone server and confirmed the newly created XRP could be spent in a later transaction. RippleX said it found no evidence the flaw was exploited on any public network.
All 100 billion XRP were created when the ledger launched in 2012, and its software is built so no more can ever be added. The vulnerability could have allowed an attacker to create XRP from nothing and sell it on exchanges, undercutting a supply cap that institutions using the network rely on.
How the exploit would have worked
The attack exploited the ledger's built-in exchange, where accounts post offers to swap one token for another.
- An attacker could open hundreds of accounts, each offering a tiny amount of a token for an unusually large amount of XRP.
- A single payment would then buy every offer at once.
- The total XRP owed would be too large for the software to count correctly, so selling accounts would be paid in full while the buying account was charged almost nothing — leaving the attacker with XRP that hadn't existed before.
- The ledger's usual check after every transaction, meant to confirm no new XRP has appeared, would have relied on the miscounted total and missed it.
- A separate limit on how much XRP a single account can receive wouldn't have triggered either, since the attack spread the XRP across hundreds of accounts.
