XRP Ledger Patches Decade-Old Bug That Allowed Infinite Token Minting

A severe vulnerability in the XRP Ledger's payment system that could have allowed an attacker to bypass the network's fixed supply cap and mint large amounts of free tokens has been patched, according to a security report published Friday. The flaw, which researchers believe has existed since 2015, was discovered by Cayden Liao and Veria AI and internally disclosed to Ripple developers on September 22. To execute the exploit, an attacker would open hundreds of accounts on the ledger's built-in exchange, post offers to swap tiny amounts of a token for massive quantities of XRP, and execute a single payment to buy every offer simultaneously. The sheer volume of XRP owed would cause the software to miscount the total, paying the selling accounts in full while charging the buying account almost nothing, successfully bypassing the network's automated supply checks that relied on the same flawed math. RippleX developers reproduced the attack on a standalone server and confirmed the newly minted XRP was spendable, but stated they found no evidence the bug was ever exploited on a public network. The vulnerability was quietly resolved in the xrpld 3.4.1 server software update on September 25 without disclosing the specific fix.