XRPL’s Long-Overlooked Vulnerability Exposed Risks to XRP’s 100 Billion Supply Cap

A critical vulnerability in the XRP Ledger could theoretically have allowed attackers to create XRP beyond the blockchain’s 100 billion supply limit, but the flaw remained undetected for years because ordinary transactions never triggered it, according to the XRP Ledger Foundation.

The foundation said the vulnerability persisted in the software for more than a decade without being activated through routine network activity. Researcher Cayden Liao and Veria AI identified the issue on September 22 and reported it internally.

The discovery was significant because it threatened one of XRPL’s fundamental safeguards: the maximum supply of 100 billion XRP established when the blockchain launched in 2012. RippleX subsequently released a software patch to address the problem.

According to the foundation, the vulnerability did not result in any new XRP being created, and no damage from exploitation was reported. Approximately 99.986 billion XRP remain in circulation.

The XRP Ledger is an open-source, decentralized layer-1 blockchain. Its native token, XRP, has a fixed supply and is primarily used to pay transaction fees and facilitate currency exchanges through the network’s built-in decentralized exchange (DEX). The vulnerability, believed to have existed since 2015, could theoretically have circumvented the mechanisms protecting that supply limit.

How the Vulnerability Could Have Created Additional XRP

The bug involved an integer overflow, a programming error that occurs when a calculation exceeds the maximum numerical value a system can represent. In certain circumstances, the value can wrap around to a much smaller number, causing the software to process an incorrect result.

Within XRPL’s payment engine, this flaw could have caused exceptionally large transaction values to be miscalculated, potentially bypassing standard checks on available funds. In a hypothetical exploit, sellers could have received the full XRP amounts associated with their offers while buyers were charged almost nothing. The difference could effectively have generated unauthorized XRP.

An attacker could theoretically have created dummy accounts and placed fabricated token offers involving enormous quantities of XRP. The attacker could then act as the buyer and attempt to purchase the listed assets in a single operation.

If successful, the exploit might have credited seller accounts with billions of XRP while requiring the buyer to pay only a negligible amount. The attacker could then have attempted to transfer the additional tokens to external exchanges and sell them.

This was a theoretical scenario describing the flaw’s potential impact, not a confirmed attack. RippleX reported no evidence that the vulnerability had been exploited on a public network.

Why the Bug Escaped Detection for Years

The XRP Ledger Foundation attributed the long delay in discovering the flaw to the unusual conditions needed to trigger it. In an explainer published Monday, the organization said normal payments never came close to activating the vulnerability. Exploitation would have required hundreds of deliberately constructed operations.

Existing safeguards also failed to identify the potential problem. A verification check designed to run after transactions and confirm that no new XRP had been created relied on the same incorrectly calculated total. Because the check used the faulty figure, it could fail to recognize the discrepancy.

Another protection restricted the amount of XRP that an individual account could receive. However, the hypothetical attack could have spread the tokens across hundreds of accounts, keeping each account below its individual balance limit.

The incident illustrates how a vulnerability can remain hidden when security mechanisms depend on the same flawed calculation or when an attack can be distributed to avoid individual account restrictions.

Foundation Plans to Expand AI-Based Security Testing

The foundation also highlighted the growing role of artificial intelligence in cybersecurity. AI-assisted tools can help researchers discover weaknesses in established software, but they can also make it easier for attackers to identify and analyze potential exploits.

To strengthen the ledger’s defenses, the foundation plans to expand AI-driven adversarial testing, introduce formal verification methods, and enhance its bug bounty program. These efforts are intended to uncover hidden vulnerabilities and improve the reliability of XRPL’s security controls.

Although the flaw presented a theoretical risk to XRP’s fixed supply, developers addressed it without evidence of unauthorized token creation. The foundation said it would provide further updates as its security initiatives advance.