Hacking News
XRP Ledger Payment Engine Counterfeiting Bug
XRP Ledger, the platform behind the XRP cryptocurrency, has disclosed and fixed a critical vulnerability in its payment engine. The bug, which was dormant since 2015, could have allowed an attacker to mint spendable XRP beyond the token's total supply. A researcher reported the issue through the XRPL bug bounty program in September. The vulnerability was an integer overflow in the payment engine, which processes payments. If exploited, an attacker could have created spendable XRP far beyond the token's total supply in a single transaction. The fix was implemented in version 3.4.1 on September 25, and more than 80% of the network's trusted validators were running it at the time. The maintainers confirmed the bug had been present since the current payment engine was written in 2015 and went unnoticed because no ordinary payment comes close to triggering the overflow. The fix bypassed the usual amendment process, which requires validators to vote and wait two weeks before a change takes effect. The disclosure highlights a counterfeiting scare that rocked the privacy coin Zcash this year, where a similar vulnerability could have allowed forged coins. XRP's price fell 1.6% over 24 hours and 9.4% over the past seven days, reflecting the network's performance after the vulnerability was disclosed.