XRP Ledger Fixes Payment Engine Vulnerability With No Exploitation Found

The XRP Ledger fixed an integer-overflow vulnerability in its payment engine on Sept. 25, addressing a flaw that affected xrpld version 3.4.0 and earlier releases.

The fix shipped with xrpld 3.4.1. More than 80% of default UNL validators were running version 3.4.1 or later on Sept. 25.

The vulnerability required specially constructed offers and a payment designed to consume them. If exploited, it could have created spendable XRP. Normal payments could not trigger the flaw accidentally.

No evidence showed that the issue had been exploited on any public network.

“We have found no evidence that this issue was exploited on any public network.”

The issue involved an integer overflow, a software error that can occur when a calculation exceeds the amount a computer program is designed to store. In a payment engine, that type of error can produce incorrect processing if specific conditions are met.

The disclosure does not establish a connection between the vulnerability and any earlier XRP price movement. The confirmed action is the software fix and the validator upgrade progress recorded on Sept. 25.