Developers of the XRP Ledger have identified and patched a critical integer overflow vulnerability within the network's payment engine. The flaw, which existed since 2015, could have allowed an attacker to generate unauthorized XRP tokens by manipulating payment processing logic.
The vulnerability occurred when a transaction processed hundreds of specific offers, causing the system to miscalculate the buyer's obligation. This error bypassed internal safety checks, potentially enabling the creation of XRP beyond the established total supply.
A researcher discovered the bug through the XRPL bug bounty program in September. RippleX engineers confirmed that the issue remained dormant for nearly a decade because standard transactions were unlikely to trigger the overflow condition.
The fix was released in version 3.4.1 on September 25. To ensure immediate security, maintainers bypassed the standard two-week validator voting process, marking the first time such an emergency patch was deployed in the system's history.
The team stated there is no evidence that the vulnerability was ever exploited. Following the disclosure, the price of XRP saw a decline, trading at $1.38 on Monday, representing a 9.4% drop over the previous seven days.
