XRP Ledger developers have disclosed a critical payment-engine flaw that could have created spendable XRP beyond the token’s intended supply. The October 9 report says the issue was patched in September, with no evidence of exploitation on any public network.
The bug involved an arithmetic overflow when combining amounts across order-book offers. A specially crafted payment could credit accounts with more XRP than the buyer paid. The network’s safeguard against creating XRP used the same faulty arithmetic and could miss the discrepancy.
Reported through the bug-bounty program on September 22, the vulnerability was reproduced by RippleX engineers in local testing. The team credited Cayden Liao and Veria AI with the discovery. Its investigation suggests the flaw may have existed since 2015.
The emergency release, xrpld 3.4.1, shipped on September 25 with integer-arithmetic hardening and other security fixes. The overflow protection took effect immediately upon upgrade, bypassing the usual amendment vote because of the severity.
CoinScreamer previously covered XRPL’s upgrade requirements and how outdated nodes can lose network synchronization. Separately, the latest disclosure confirms an additional Batch validation fix activated on October 9; the XRP minting protection had already shipped in September.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
