The XRP Ledger Foundation stated that a vulnerability that could potentially undermine the supply cap of XRP went undetected for many years because normal parameters never triggered it.

If this vulnerability, which has existed for 11 years, is exploited, it could allow attackers to create billions of XRP, thereby potentially disrupting the maximum supply limit of 100 billion tokens for this cryptocurrency.

It is alleged that this integer overflow flaw requires hundreds of carefully constructed transactions in order to bring the manipulated cost back down to a value close to zero, while the seller's account receives the full payment.

Researchers reported this vulnerability on September 22nd, and RippleX fixed it after confirming that there was no evidence of it being exploited or used to create XRP without authorization on the public internet.

The XRP Ledger Foundation stated that this vulnerability, which could have allowed attackers to “create” new XRP ( XRP ) out of thin air, lay dormant in XRP Ledger for over a decade without being detected. The reason is that normal user activities never approached the conditions required to trigger it.

The foundation stated that this 11-year-old vulnerability is significant because it threatens a core rule relied upon by XRP holders: since the birth of blockchain in 2012, the total supply must not exceed 100 billion coins. Researchers Cayden Liao and Veria AI discovered this issue on September 22nd and reported it internally.

RippleX indicates that no damage was caused, and a fix has been released. The foundation stated that no new XRP were created, and the current circulation of XRP is approximately 99.986 billion coins.

XRP Ledger ( XRPL ) is an open-source, decentralized blockchain. The original design intention of its native token XRP was that no new tokens would ever be minted again. This token is mainly used to pay transaction fees and serves as a currency bridge within the decentralized exchange ( DEX ) built into the ledger.

However, it is believed that this vulnerability, which has existed since 2015, at least theoretically, provides a way to bypass this rule.

How a vulnerability may operate

The vulnerability stems from a flaw known as "integer overflow," which is similar to the score counters in old arcade games; once they reach their maximum value, they reset back to zero.

In the case of XRP Ledger, this flaw means that once the transaction volume exceeds the maximum value allowed by the system, the value will wrap around to a very small number. As a result, the standard funding checks are bypassed, and the seller receives the full amount of XRP they are entitled to, while the buyer only has to pay a minimal amount. In fact, the difference is essentially “created out of thin air,” thereby artificially increasing the total supply of XRP.

Attackers can set up fake accounts to sell fake tokens worth astronomical amounts. Subsequently, the attackers pay using XRP in the role of buyers, purchasing all the tokens at once. The ledger records billions of valid XRP tokens in the seller's account, and due to the enormous quantity of XRP, the system counts the total cost for the buyer as less than one cent.

By bypassing standard funding checks, the system essentially creates a difference out of thin air, allowing attackers to take away billions of new XRP and convert them into cash on external exchanges.

Why has it never been discovered?

The XRP Foundation stated in a statement released on Monday that the reason this vulnerability had not been discovered until now was mainly because triggering it required a very large scale of operations.

"None of the normal payments would come close to triggering it. It requires hundreds of deliberately constructed operations," said the foundation.

No issues were found with the protection mechanisms of the ledger itself. As reported by CoinDesk last week, the checks run after each transaction to confirm that no new XRP have appeared rely on the same mistakenly calculated total, hence no abnormalities were observed. Another limit that restricts the maximum amount of XRP that a single account can receive was not triggered either, as potential attacks would distribute the XRP across hundreds of accounts.

The foundation pointed out that artificial intelligence is enabling both "bad actors and good actors" to discover such vulnerabilities more quickly. To ensure future security, the foundation plans to more actively apply AI resistance testing, implement formal verification, and strengthen the vulnerability bounty program.

"As we move forward, you will hear more about it," the foundation stated.