Crypto sleuth ZachXBT says the XRP Ledger Foundation (XRPL) can potentially look forward to losing upwards of $100 million next time it’s hacked after the company paid a whitehat hacker just $250,000 for uncovering and reporting an infinte supply XRP bug.

ZachXBT claimed XRPL “cheaply” paid the hacker, noting the crypto firm has “billions” in its treasury. 

He suggested that XRPL’s stingy reward could lead to cybercriminals in the future choosing to exploit similar major vulnerabilities rather than reporting them in good faith.

“This is why people do not take XRPL or Ripple seriously as an org,” he added.

By contrast, in 2022, an Ethereum hacker who could’ve printed an infinite supply of ETH was paid a $2 million bug bounty for disclosing the potential exploit. 

XRPL released a report last week that disclosed the flaw allowing the creation of new XRP tokens out of thin air.

This exploit was discovered by whitehat hackers Cayden Liao and Veria AI, and submitted to XRPL’s bug bounty program on September 22.

The pair found that an “integer overflow in the payment engine” could be manipulated with various XRP orders to underpay funds. 

XRPL said, “The engine paid each offer owner their full amount individually but charged the buyer only the wrapped-around total. The difference was new XRP that should never have existed.”

XRPL submitted a fix by September 25, claiming there’s “no evidence that this issue was exploited on any public network.” It added that the bug has been around since 2015.

Source link