Tuesday 13 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Crypto

XRP Ledger fixes decade-old counterfeiting bug in payment engine

Integer overflow flaw, undetected since 2015, could have allowed creation of fake XRP

By LineZotpaper
Published
Read Time2 min
Developers of the XRP Ledger have disclosed and patched a critical vulnerability in the network's payment engine that could have let an attacker create counterfeit XRP. The integer overflow flaw sat dormant in the code for roughly a decade before a researcher reported it through the XRPL bug bounty program in September.

The XRP Ledger's maintainers have disclosed and fixed a critical vulnerability that, left unaddressed, could have allowed an attacker to conjure XRP out of thin air, a flaw that sat undetected in the network's code for about a decade.

In a disclosure published Friday, the developers said a researcher reported the issue through the XRPL bug bounty program in September. The problem was an integer overflow in the payment engine, the part of the software that processes payments.

The bug could be triggered when a single payment consumed hundreds of specially crafted offers from the order book, causing the total amount the buyer owed to exceed the maximum value the system could store. No ordinary payment triggers that condition, which is why the flaw went unnoticed since 2015. The ledger's "no XRP created" safety check used the same broken arithmetic, meaning the check would not have caught the overflow.

Developers say there is no evidence the bug was ever exploited.

§

Analysis

Why This Matters

  • The flaw threatened a core promise of the XRP Ledger: that no new XRP can be created outside the fixed supply established at the network's launch, a guarantee any payment network must uphold.
  • A counterfeiting-class bug sitting undetected for roughly a decade in critical payment-processing code raises questions about how deeply the codebase had been reviewed.
  • The discovery came through a bug bounty program, highlighting the role of external researchers in surfacing flaws that internal processes missed.

Background

The XRP Ledger is a blockchain-based network designed for payments, with XRP as its native token. A foundational rule of the ledger is that users cannot create XRP; safeguards in the code are meant to enforce that rule. The vulnerability disclosed this week defeated that safeguard by exploiting arithmetic limits in the payment engine: under specific conditions, the numbers involved in a transaction could overflow the maximum value the software could store. Because the safeguard check relied on the same flawed arithmetic, it offered no protection against the overflow.

Key Perspectives

XRP Ledger developers: They disclosed the issue, patched it, and stated there is no evidence it was ever exploited in the wild. Bug bounty researchers: The discovery demonstrates that external security review can surface critical flaws in long-running systems, and that bounty programs give researchers a channel for responsible disclosure. Skeptics and network participants: A vulnerability of this severity lying dormant for a decade may prompt questions about the depth of previous code audits and whether similar overflow conditions exist elsewhere in the codebase.

What to Watch

  • Whether further integer overflow issues are found in other parts of the payment engine or related software.
  • How quickly node operators, exchanges and other network participants apply the patch.
  • Any additional disclosures from the XRPL bug bounty program as researchers examine the fix.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe