Why Did a Bug That Could Have Threatened the 100-Billion XRP Supply Cap Remain Hidden for Years?

The XRP Ledger Foundation said normal parameters never create a bug that could break the XRP supply cap, which is why it went undetected for years.

According to the XRP Ledger Foundation, a bug that could have allowed an attacker to print new XRP (XRP) out of nothing had been in the XRP Ledger for more than a decade without anyone noticing because normal user activity never came close to triggering it.

The 11-year-old bug was significant because it threatened a key rule that XRP holders rely on: that the total supply can never exceed the 100 billion coins created on the first blockchain in 2012. The issue was discovered and reported internally on September 22 by researcher Cayden Liao and Veria AI.

According to RippleX, who posted the fix, no damage was done. The foundation said no new XRP was created and about 99.986 billion XRP are in circulation today.

XRP Ledger (XRPL) is an open source decentralized layer 1 blockchain. Its native token, XRP, is built in such a way that no new tokens can be created. This coin is mainly used to pay transaction fees and bridge currency transactions on the ledger's internal decentralized exchange (DEX).

However, the bug, which is believed to have been around since 2015, provided a workaround, at least in theory.

The bug stems from a vulnerability called "integer overflow", which, like the score counter of old arcade games, resets to zero every time it's maxed out.

In the case of the XRP Ledger, the flaw meant that when the transaction size exceeded the system's maximum numeric limit, the value would be reduced to a very small number. which bypassed standard fund checks and credited sellers with their full amount of XRP while charging buyers almost nothing, effectively eliminating the difference and artificially increasing the total supply of XRP.

An attacker could create fake accounts to post fake token sales worth astronomical amounts of XRP. Then, the attacker, as the buyer, could pay with XRP and buy all the tokens at once. The ledger credits the seller's accounts with billions of valid XRP, and by drowning in the vast amount of XRP, the total cost to the buyer is only a fraction of a cent.

By bypassing standard fund checks, the system effectively eliminates the difference, allowing an attacker to walk away with billions of new XRP to cash out on foreign exchanges.

The bug went largely unnoticed because it required massive action to begin with, the XRP Foundation said in a statement released on Monday.

"No normal payment comes close to that. It took hundreds of deliberately crafted operations," it said.

The ledger's own measures have also lost it. As CoinDesk reported last week, the check performed after each transaction to verify that there was no new XRP relied on the same miscalculated sum, so it didn't see anything unusual. A separate limit on the amount of XRP an account can receive was also not established, as a potential attack would spread XRP across hundreds of accounts.

The foundation noted that AI would make finding such flaws faster for both the "bad guys" and the good guys." To ensure future safety, the foundation plans to strictly enforce adversarial AI testing, implement formal verification, and strengthen its bug bounty program.

"You'll be hearing more about this as we move forward," the statement said.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto funding drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.