XRP Ledger Fixes Long-Standing Counterfeiting Vulnerability

XRP Ledger Addresses Critical Payment Engine Bug

The developers of the XRP Ledger have unveiled and corrected a significant vulnerability in its payment engine that could have allowed unauthorized creation of XRP tokens. This issue, reported through the XRPL bug bounty program in September, had remained dormant since 2015.

The flaw was identified as an integer overflow within the payment processing software, which could be triggered when a single transaction involved numerous specially crafted offers. This situation could cause the total owed by the buyer to exceed the system's maximum storage capacity, resulting in a wraparound effect that produced counterfeit XRP, while sellers received full payment.

Additionally, the built-in safety mechanism intended to prevent the creation of new XRP utilized the same erroneous arithmetic, failing to detect the issue. As a result, an attacker theoretically could have created a vast amount of spendable XRP in a single transaction, which could then be traded or moved to exchanges.

Fortunately, the XRP Ledger team confirmed there was no evidence that this vulnerability had been exploited. The fix was implemented in version 3.4.1 on September 25, and over 80% of the network's trusted validators had adopted the update by that date. This was a notable deviation from the ledger’s typical amendment process, which usually requires a voting period before changes take effect. However, the critical nature of the vulnerability warranted immediate action to prevent potential exploitation.

The incident draws parallels to a recent scare in the Zcash network, where a similar bug raised concerns about the potential for counterfeit coins. Following the patch, XRP has seen a decline in value, trading at $1.38, a 1.6% drop over 24 hours and a 9.4% decrease over the past week, marking it as one of the underperformers among major cryptocurrencies.