XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015

Developers behind the XRP Ledger have disclosed and fixed a critical vulnerability that, left unaddressed, could have let an attacker conjure XRP out of thin air, a flaw that sat dormant in the network’s code for roughly a decade. In a disclosure published Friday, the ledger’s maintainers said a researcher reported the bug through the XRPL bug bounty program in September. The issue was an integer overflow in the payment engine, the part of the software that processes payments.