Decade-old xrpld overflow bug could have minted XRP past its 100-billion cap

Even rounded up to 1,000 XRP, the attacker's few hundred XRP in reserves and fees comes to less than one hundred-millionth of the 100-billion cap ^[16]. According to the disclosure as reported by Crypto Briefing, a single transaction may have minted more XRP than the token's entire supply ^[7]. RippleX also confirmed that the excess could be spent in follow-up transactions ^[9].

The ledger's checks did not catch it either. The overflowed total came out smaller than the real one, so the books looked balanced while supply grew. When the inflated balances were spread across many accounts, the guardrails did not flag the discrepancy ^[5]. In our view, that means the cap was enforced by the same sum the bug corrupted.

The flaw is thought to date from the payment engine's construction around 2015 ^[13], about 11 years ^[17] before Cayden Liao reported it through the XRPL Bug Bounty program ^[8]. After the report the response was fast: three days to an emergency release ^[18], then 14 more days before the public disclosure ^[19]. Rule changes on the ledger normally go through a validator vote before taking effect, and this one was deployed immediately ^[11].

There are two readings of that sequence. One is that the process worked. The team reports no lost funds, no compromised keys and no consensus problems ^[12], and a bounty report became a shipped fix in three days ^[18]. The other is Crypto Briefing's: an emergency patch that skips normal procedure asks users to rely heavily on the core development team, and the network's security hinged on how fast validators and node operators upgraded ^[14].

We think both are right, and the second matters more to anyone who values XRP on a fixed supply. The cap held because a small team, or rather a small team plus whichever node operators upgraded in time, acted before any known use of the flaw ^[3][14]. The ledger's own accounting played no part in that ^[5]. The release itself shows where the effort went: no time on a governance vote ^[11], and two weeks between the quiet patch and the public disclosure ^[2][19].

We would be wrong if a reconciliation outside the payment engine, one that counts total XRP independently of the books the engine keeps, would have caught a mint like this anyway. The coverage does not describe one.