XRPL 3.4.1 fixes payment overflow allowing 18 trillion XRP creation
RippleX and the XRP Ledger Foundation disclosed and patched a payment-engine vulnerability that could have theoretically created about 18 trillion spendable XRP in a single transaction, far above the intended 100 billion XRP supply. Investigators reported no evidence of exploitation on public networks and no unauthorized XRP creation. The fix shipped in xrpld 3.4.1.
XRP Ledger Payment Overflow: Mechanics and Fix
The payment engine aggregates offers from the order book when routing a payment across a path. An unchecked integer overflow could occur while summing amounts from many offers: once the sum exceeded the integer’s maximum, it wrapped to a smaller value. The engine still paid each offer owner the full individual amount but charged the buyer only the wrapped total. The difference represented newly credited XRP. The “no XRP created” invariant used the same wrapping arithmetic, so it failed to detect the discrepancy.
Scope: affected xrpld 3.4.0 and earlier. The issue was reported via the XRPL Bug Bounty on September 22, 2026. The current payment engine dates to 2015, and the flaw may have existed since then. xrpld 3.4.1, released September 25, added overflow checks to fail paths that would exceed limits and updated the supply-invariant check to use a wider counter, with additional hardening in balance-summing code.
It's official.
XRP Ledger patches a decade-old overflow bug in its payment engine that could have let an attacker mint about 18 trillion spendable XRP in a single transaction. pic.twitter.com/mP6Mv6fkTK
— MSB Intel (@MSBIntel) October 11, 2026
Impact Assessment: Theoretical Exposure, No Observed Breach
The approximate 18 trillion XRP figure describes a single-transaction theoretical exposure, about 180 times the intended supply. Triggering required specially crafted offers and a payment consuming many offers simultaneously. Disclosures reported no confirmed exploitation on public networks and no lost funds.
Mitigation in 3.4.1: overflow detection during summation with path failure on overflow, broader counters for the no-XRP-created invariant, and hardening of balance-summing logic.
XRPL Upgrade Context and Additional Patch
XRP Ledger version 3.4.1 is now the minimum required version after the recent amendments were activated.
This release patched critical parts of the XRP Ledger.
The vulnerability report can be found here:https://t.co/sYIwuDomjY
Public release notes:https://t.co/JqX4UYDDg6 pic.twitter.com/pH9Gnsnpqi— XRP Ledger Operations (@XRPLOperations) October 10, 2026
xrpld 3.4.1 fixed two issues. The second: validation of inner transaction wrappers in Batch transactions, affecting 3.3.0 and 3.4.0. The BatchV1_1 amendment was not active on Mainnet when identified. This batch issue is separate from the payment overflow.
Security lesson: safety checks must not replicate unsafe arithmetic used in core transaction logic. The practical risk arose because both the payment calculation and the independent supply-invariant check could overflow in the same way.
Authors credited by the source: Daniel Francis
Published by Holder based on an external source.
