XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015
Summary
XRPL developers disclosed and fixed a decade-old integer overflow in the payment engine that could have let an attacker create vast amounts of spendable XRP by exploiting specially crafted order-book offers. The ledger’s supply-checking safeguard shared the same flawed arithmetic and would not have detected the counterfeit tokens. There is no evidence the bug was exploited. The fix shipped in version 3.4.1 on Sept. 25, bypassing the usual validator-vote amendment process to avoid leaving the flaw exposed. More than 80% of trusted validators had installed it that day.
