An AI agent uncovered a decade-old bug in the XRP Ledger (XRPL) that could create trillions of XRP, prompting an emergency fix.

The vulnerability could have let an attacker generate about 18 trillion XRP through a single payment transaction, roughly 180 times the cryptocurrency's original 100 billion token supply, according to security firm Veria Labs.

Veria founder Cayden Liao said the flaw potentially threatened XRP's $94 billion market capitalization by undermining the cryptocurrency's fixed supply.

The vulnerability was reported on Sept. 22 and patched three days later. RippleX later confirmed that no unauthorized XRP was created, no funds were lost, and investigators found no evidence of exploitation on public networks. The incident was publicly disclosed on Oct. 9.

The discovery emerged from Veria's AI-powered security system, which analyzed rippled, the software underpinning XRPL, and identified two weaknesses that could be combined to bypass its monetary safeguards.

The first involved an integer overflow in the payment engine, where deliberately constructed trading offers could cause the system to miscalculate the amount a buyer owed.

Under the exploit, sellers would receive their full XRP payments while the buyer would be charged only a fraction of the actual amount. The difference would effectively create XRP that had never existed.

A second vulnerability affected the network's supply-protection mechanism. Because it relied on the same flawed arithmetic, it could fail to recognize that new XRP had been created.

The attacker would need to prepare hundreds of accounts and trading offers before submitting the payment. According to the official vulnerability report, the attack required only a few hundred XRP in largely refundable reserves and ordinary transaction fees.

Source link