How the XRP Ledger overflow bug could have minted 18 trillion XRP

For eleven years, a bug sat inside the XRP Ledger's payment engine that could have minted roughly 18 trillion XRP, about 180 times the token's entire 100 billion supply, in a single transaction, by security researcher Cayden Liao's estimate. The XRP Ledger Foundation disclosed the flaw on October 9 in its vulnerability disclosure report, three days after researcher Cayden Liao and security firm Veria Labs reported it through the ledger's bug bounty program. The fix shipped September 25 in xrpld 3.4.1, and developers found no sign anyone had used the flaw to create XRP on a live network.

How the wrap-around worked

The ledger tracks XRP balances as 64-bit whole numbers capped at a set ceiling. Per the disclosure, once a running total pushed past that ceiling the arithmetic rolled over to a much smaller value rather than stopping the payment. A payment that filled hundreds of order book offers had no check on its total, so a huge sum could quietly become a tiny one: sellers were paid in full while the buyer was charged almost nothing, leaving new spendable XRP behind.

The attack was cheap to set up and impossible to trigger by accident. The report states: The attack could not be triggered by accident. It required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once." Opening the accounts needed only a few hundred XRP, most of it recoverable, plus transaction fees.

Why two safety nets missed it

The ledger already runs a check after every transaction to make sure no new XRP has appeared. That check relied on the miscounted total, the disclosure explains, so it would have passed anyway. A separate limit on how much XRP a single account can receive would not have triggered either, because the attack spread the new tokens across hundreds of accounts.

Engineers at RippleX reproduced the attack on a standalone server and confirmed the newly created XRP could be spent in a later transaction. About 99.986 billion XRP exist today, all of it created at the ledger's 2012 launch, with fees burned along the way, so the supply is deflationary.

The post How the XRP Ledger overflow bug could have minted 18 trillion XRP appeared first on Techreport.