XRP Ledger developers have disclosed a decade-old payment-engine flaw that could have allowed a deliberately constructed transaction to create new, spendable XRP outside the network’s fixed supply.
The official vulnerability report says an integer overflow occurred when the payment engine added amounts across hundreds of specially crafted exchange offers. Individual sellers could receive their full XRP amounts while the buyer was charged only the wrapped total. The network’s supply invariant used a similar counter and could have missed the artificial creation.
RippleX reproduced the exploit on a standalone server and confirmed that the resulting XRP could be spent. The attack required only a few hundred XRP for account reserves and transaction fees, although it could not be triggered accidentally through normal trading.
The fix shipped in xrpld 3.4.1 on September 25. More than 80% of validators on the default trusted list upgraded that day. Developers bypassed the usual amendment activation process because publishing the patch while leaving the flaw active for weeks would have exposed a cheap and severe exploit path.
No evidence of exploitation on a public network was found. The same disclosure also documents a separate Batch transaction wrapper flaw that could have caused mixed-version validators to disagree. Its fixBatchV1_2 amendment and the repaired Batch feature activated on mainnet on October 9.
TOKEN RECON ASSESSMENT
The network is protected, but the disclosure exposes a difficult governance tradeoff. An emergency patch prevented a known minting path from remaining open, yet temporarily created a mixed-version consensus risk. The useful confirmation is not only that validators upgraded, but that older servers are now amendment-blocked and public ledger analysis finds no historical exploit pattern.
