XRPL Overpaid Hacker, Leaving Network Vulnerable to Exploits

Background Context

The XRP Ledger released an emergency security patch to address a critical vulnerability that could have allowed attackers to create approximately 18.5 trillion spendable XRP. The patch was released directly, bypassing the standard amendment process, to address the potential severity of the flaw.

The Vulnerability

Infinite XRP hack charged buyers less than intended XRPL released a report last week that disclosed the flaw allowing the creation of new XRP tokens out of thin air. This exploit was discovered by whitehat hackers Cayden Liao and Veria AI, and submitted to XRPL’s bug bounty program on September 22. The pair found that an “integer overflow in the payment engine” could be manipulated with various XRP orders to underpay funds.

Hacker Reward

XRPL paid a whitehat hacker $250,000 to discover the bug, but critics argue the reward is too low, potentially emboldening cybercriminals to exploit similar vulnerabilities. By contrast, an Ethereum hacker who could’ve printed an infinite supply of ETH was paid a $2 million bug bounty for disclosing the potential exploit.

Implications

The incident highlights concerns over decentralized networks' balance between emergency security responses and transparent governance. XRPL said, “The engine paid each offer owner their full amount individually but charged the buyer only the wrapped-around total. The difference was new XRP that should never have existed.”

The vulnerability has been around since 2015, and there are 100 billion XRP in circulation from XRP’s 2012 launch, which now has a market cap of $86.5 billion. XRPL submitted a fix by September 25, claiming there’s “no evidence that this issue was exploited on any public network.”