RippleX engineer Mayukha Vadari warned that artificial intelligence is raising the security stakes for the XRP Ledger, after developers disclosed a decade-old critical vulnerability that could have let attackers mint 18.45 trillion XRP from thin air. The flaw was identified on Sept. 21 by Veria AI, an artificial intelligence-based security system built by Veria Labs, which filed a bug report through the XRP Ledger bug bounty program the next day. According to Veria Labs, a single transaction could have minted 18.45 trillion XRP, more than 184 times the cryptocurrency's initial supply of 100 billion tokens, and the newly minted tokens could have been spent and transferred to various cryptocurrency exchanges; researchers estimated the vulnerability could have affected XRP's whole market cap, which they put at around $94 billion when they filed the report. The issue was an integer overflow in XRP Ledger's payment engine, traced to code added in 2015 for calculating payment amounts when processing multiple offers on the network's decentralized exchange, and the ledger's native mechanism meant to prevent minting XRP from thin air suffered from a similar calculation flaw. XRPL developers said they have found no evidence the vulnerability was exploited on the public network, and they released an emergency update, xrpld 3.4.1, on Sept. 25 while withholding the source code containing the security fixes, drawing criticism over whether sharing binaries without immediately making the code public is consistent with the network's open-source nature.
XRPA decade-old critical integer-overflow vulnerability in the XRP Ledger could have minted 18.45 trillion XRP, undermining confidence in the network's security.
Veria Labs' AI security system Veria AI identified the critical XRP Ledger flaw and filed the bug report, showcasing its detection capability.
