AI exposes XRP Ledger flaw, sparks urgent fix and $250,000 bounty

Vulnerability Overview

The XRP Ledger's vulnerability was discovered by an AI agent from Veria Labs, which analyzed the software underpinning XRPL and identified two interconnected flaws. The first flaw involved an integer overflow in the payment engine, where deliberately constructed trading offers could cause the system to miscalculate the amount a buyer owed.

Exploit Details

The second vulnerability affected the network's supply-protection mechanism, relying on the same flawed arithmetic to fail recognize new XRP created. An attacker would need to prepare hundreds of accounts and trading offers before submitting the payment.

Emergency Fix

RippleX engineers independently reproduced the exploit and confirmed that the newly generated XRP could be spent in subsequent transactions. An emergency fix was deployed without waiting for the network's established amendment process, bypassing decade-old governance procedures.

Consequences

The severity of the discovery forced XRPL developers into an unusual decision, deploying a protocol-changing fix without waiting for the network's established amendment process. The patch was initially distributed as binaries, temporarily withholding its source code to limit the risk of attackers reverse-engineering the vulnerability during deployment.

Response

More than 80% of validators on the default trusted-validator list had upgraded by Sept. 25, substantially reducing the risk of server disagreement. The XRPL Foundation contributor Vet said the coordinated response preserved network integrity and established version 3.4.1 as the new minimum software requirement following the activation of separate Batch-related amendments on Oct. 9.