Key facts
- A bug in the XRP Ledger's payment engine could have allowed for the creation of unlimited XRP.
- The XRP Ledger Foundation confirmed no new XRP was created and the total supply remains 100 billion tokens.
- An emergency patch was deployed quickly to address the security-sensitive vulnerability.
- The fix bypassed the usual amendment process, which requires a two-week validator vote.
- Researchers at Veria AI reported the vulnerability through the XRPL Bug Bounty program.
The XRP Ledger Foundation has clarified that a recently patched ledger bug did not create any additional XRP, maintaining the total supply at 100 billion tokens. The foundation addressed community concerns regarding an immediate security fix that prevented a risk of unlimited XRP minting.
The bug, present in the payments engine since 2015, could have allowed an attacker to create spendable XRP by setting up numerous specially crafted offers on the decentralized exchange and consuming them in a single payment. Researchers at Veria AI reported the vulnerability through the XRPL Bug Bounty program.
Due to the security-sensitive nature of the fix, the XRPL community, including the Foundation, RippleX, core developers, and validators, reached a social consensus to release the patch quickly via the emergency xrpld 3.4.1 release, bypassing the usual amendment process that requires a two-week validator vote. The foundation emphasized that no single party made the decision alone and that validators ultimately choose which software to run, noting that version 3.4.1 eventually received over 80% validator support.
Advances in AI make it easier to find dormant bugs, prompting the foundation to commit to stronger protections, including expanded formal verification, AI adversarial testing, and an enhanced bug bounty program. The XRP price saw a 1% jump in the past 24 hours, trading at $1.41.