AI-Discovered XRPL Flaw Could Have Allowed Unauthorized Creation of 18 Trillion XRP in One Transaction
A critical security flaw in the XRP Ledger, or XRPL, could have allowed as many as 18 trillion XRP to be created through a single unauthorized transaction, prompting developers to issue an emergency patch.A security report released by the XRPL development team and cited by The Block on October 11 said the vulnerability stemmed from an integer overflow in the payment engine’s amount aggregation process. The flaw had existed in the code since 2015. No evidence has been found that it was exploited on the public network.The problem arose when multiple sell orders were executed at once. An attacker could create hundreds of accounts and place sell orders for small amounts of tokens at abnormally high prices. If all of those orders were then filled in a single transaction, the settlement amount could be calculated incorrectly. Sellers would still receive XRP as expected, while the buyer might be charged only a negligible amount. A similar flaw was also found in the process for verifying whether new XRP had been created, meaning illegitimate issuance would not have been blocked.Kaiden Liao, co-founder of security firm Veria Labs, wrote on X on October 10 that an AI agent found the flaw and produced working exploit code. His analysis showed that a single attack transaction could have generated about 18 trillion XRP. That is about 184 times the token’s original issuance of 100 billion XRP.Liao said the critical vulnerability resulted from the combination of two bugs that appeared low-severity on their own. That may help explain why the issue went undetected for so long. Ripple paid Veria Labs $250,000, the top reward in its bug bounty program, for reporting the flaw.Veria Labs reported the vulnerability on September 22, and RippleX released xrpld version 3.4.1 with the fix three days later on September 25. At the time, more than 80% of validators on the XRP Ledger’s default Unique Node List, or UNL, had completed the update.Notably, the patch was applied without going through the network’s usual amendment voting process. XRPL rule changes typically require support from more than 80% of validators for two weeks, but this fix took effect alongside the server update. Developers determined that following the usual process would have left the network exposed to attack after the vulnerability became public and before the fix was activated.The response also drew criticism because publication of the source code was delayed for about two weeks during the patching process. Justin Bons, founder of Cyber Capital, criticized XRP for having run on closed-source code during that period. RippleX engineer Mayuka Badari responded that advances in AI now allow attackers to quickly analyze public security patches and reverse-engineer the underlying vulnerability, underscoring the need for an emergency response.RippleX said it plans to expand AI-based vulnerability detection and formal verification following the incident. J. Ayo Akinyele, RippleX’s head of engineering, said AI is fundamentally changing how quickly vulnerabilities are discovered.