XRP Ledger skipped its vote to close a 2015 mint bug

The XRP Ledger closed a 2015 payment-engine bug without the usual validator vote. xrpld 3.4.1 shipped on September 25, 2026, and the overflow fix took effect as soon as a server upgraded. The October 9 disclosure says an attacker could have created spendable XRP from nothing, with no evidence of use on a public network.

For a custodian, that is a control failure, not a loss. The advisory calls it the first deliberate change to transaction processing shipped outside the amendment system since that system began more than 10 years ago. The same build also carried fixBatchV1_2, a Batch-wrapper fix that did take a vote and became enabled on Mainnet on October 9.

What the overflow would have done

Reported through the XRP Ledger bug bounty program on September 22, and rated Major by the reporter, the bug sits where the payment engine sums what a buyer owes across many order-book offers. Balances are integers with a fixed maximum. The sum used 64-bit addition with no overflow check, wrapped to a small number, and still paid each offer owner in full. The buyer was charged only the wrapped total. The gap would have been new XRP.

Related:DGLD opens one-ounce PAMP gold on Solana via SwissBorg

Two checks failed with it. The "no XRP created" invariant, added two years after the engine was written, used the same arithmetic and saw only a fee. A per-account check trips only when one account holds more than the total supply. RippleX reproduced the mint that day, raised it to critical, merged the fix on September 23, and shipped it on September 25. The path needed hundreds of offers no trader would price that way, and a few hundred XRP in reserves, later returned, plus fees. The advisory states no minted quantity, only an amount "far beyond the total supply".

Cayden Liao, security co-founder at Veria Labs, wrote on October 11 that one transaction could have created 18 trillion XRP, 184 times the 100 billion fixed at launch. That count is his. The advisory credits him and Veria AI, and does not say an agent found the bug. He wrote: "We suspect one reason nobody caught this vulnerability is that it chains together two bugs that would be low severity on their own." He said Ripple paid the program's maximum $250,000 bounty. The advisory does not confirm it.

Why the vote was skipped

Amendments stay off until more than 80 percent of trusted validators back them for two weeks. A public patch would have left this bug live through that clock, so the fix did not wait. The disclosure says the XRP Ledger Foundation, RippleX, and validators judged a mint worse than a halt. More than 80 percent of the default Unique Node List ran 3.4.1 on release day. The Foundation said on October 11 that the build went out through each xrp-ledger.toml contact, with public binaries the same day, September 25.

The clocks disagree by a day. The September 25 release note and the October 9 disclosure date the build to September 25. The note lists "integer-arithmetic hardening in the payment engine" and says the source was withheld. The GitHub release, dated October 10 and signed by Ayaz Salikhov, says binary-only packages went out on September 26. The October 9 report already said the source was published.

What a desk can check

The Foundation's October 11 post says supply was fixed at 100 billion at launch, fees are destroyed, and about 99.986 billion XRP exist. A mint would show in public balances. Neither that post nor the disclosure describes an exchange halt or a customer loss. From 3.4.1, an overflowing sum fails as a path-dry or partial-payment result, and the supply check uses a wider counter. Older servers are amendment blocked, so every operator must reach 3.4.1 or newer.

The Ripple Prime mandate to finance and clear Brevan Howard funds does not patch xrpld, but any desk that settles XRP still depends on the cap enforced there. Schwartz's reservation proposal targets front-running on the same order book. XRP exchange-traded funds that extended inflows for a third month, while bitcoin funds bled, are priced off that cap. Cactus Custody's Swiss launch left the audit in Asia.

A finding marked fixed, including a bounty or an AI red-team result, now stays open until the release candidate reproduces it. Amendments remain the normal path. Until nodes behind 3.4.1 upgrade, the amendment block, not a mint, is the live constraint.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.