Veria Labs has described an arithmetic flaw that could break XRP Ledger’s supply rule and says it received a $250,000 bounty. Its report is dated October 10; the fix shipped on September 25.
Veria Labs has published details of a security flaw that could create XRP outside the XRP Ledger’s supply rules. The company’s October 10 report describes how its AI tool identified the issue and demonstrated it on a local network. The fix shipped in xrpld 3.4.1 on September 25, ahead of the XRPL team’s public disclosure on October 9.
Veria co-founder Cayden Liao said in an October 11 X post that the finding earned the program’s maximum $250,000 bounty. The company’s timeline dates the award to October 8. The account of the AI discovery and the bounty comes from the researcher.
Two arithmetic errors defeated the safety check
XRP Ledger’s initial total supply was 100 billion XRP, and normal transactions are not supposed to create more. Veria says its local demonstration generated about 18.45 trillion XRP in one transaction. The report’s $94 billion risk figure refers to XRP’s market capitalization at the time, rather than an actual loss or the cash value that newly created tokens could have fetched.
According to the official XRPL disclosure, the payment engine could exceed its numerical limit when adding amounts from many order-book offers, causing the total to wrap around to a small number. Offer owners could receive their full amounts while the payer was charged much less. A separate safety check intended to prevent XRP creation used arithmetic that could fail in the same way.
No known theft was disclosed. RippleX says it found “no evidence that this issue was exploited on any public network.”
The issue described by the researchers would not arise accidentally in an ordinary transfer; it required specially constructed transactions. The relevant payment-engine code dates to 2015 and the safety check to 2017.
Emergency fix bypassed the usual voting delay
The September 25 release notice called 3.4.1 an emergency security update and told server operators to upgrade. Source code was temporarily withheld when that notice appeared, with a retrospective promised for a later date. Veria’s timeline records the report on September 22 and the fix being merged into the codebase on September 23.
The fix took effect without waiting for XRPL’s usual validator voting process for transaction-rule changes. The team says exposing the flaw in source code while leaving it exploitable for weeks would have increased the risk. Its official timeline states that more than 80% of validators on the default trusted list upgraded on the release date.
The same software release included a separate fix for Batch transactions. That amendment activated through voting on October 9, whereas the XRP issuance fix applied as soon as a server upgraded to 3.4.1. The new checks reject overflowing totals and use a wider counter to enforce the supply rule.
