Critical XRP Ledger Bug Could Have Allowed XRP to Be Minted From Nothing

XRP Ledger developers disclosed on 9 October a flaw in the network’s payment engine, dating to 2015, that could have let an attacker mint XRP from nothing. They found no evidence that it was exploited on any public network, the disclosure report states. Their fix went out in xrpld 3.4.1, the ledger’s server software, on 25 September. The bug sat where the engine adds up amounts in a single payment that consumes many order-book offers. XRP amounts in that sum are integers with a fixed maximum, and a total past that limit wrapped around to a small number.