100 Billion XRP Supply Was Nearly Broken by a 10-Year Bug
A flaw within the XRP Ledger’s cost software program may have let an attacker create spendable XRP out of skinny air, in keeping with a safety report revealed Friday. The bug had seemingly gone unnoticed since 2015.
XRP’s provide is capped at 100 billion tokens, and the token is price about $88.8 billion at $1.41. RippleX, Ripple’s developer arm, mentioned it discovered no signal anybody used the flaw.
How One Payment Could Have Printed New XRP
The XRP Ledger has a built-in market the place accounts record provides to commerce one token for an additional.
According to the report, an attacker may open a few hundred accounts. Each would supply a tiny quantity of a token in alternate for a enormous quantity of XRP.
A single cost would then purchase each supply without delay. The software program’s working complete grew too massive for its counter and reset to a tiny quantity, very similar to an odometer rolling previous its restrict.
The promoting accounts had been paid in full whereas the customer paid virtually nothing. A security examine meant to identify new XRP used the identical counter, so it missed the hole too.
Researcher Cayden Liao and Veria AI reported the flaw by the XRPL bug bounty program on September 22.
Why Ripple Bypassed the XRP Ledger Validator Vote
Rule modifications on the XRP Ledger usually want backing from greater than 80% of trusted validators, the servers that verify transactions, for 2 weeks.
This repair, launched in server software program model 3.4.1 on September 25, took impact as quickly as every operator upgraded.
“This is the primary time a change to transaction processing has intentionally shipped this manner because the modification system was launched greater than ten years in the past,” RippleX indicated.
RippleX mentioned a public vote would have uncovered the bug in open code for weeks whereas it stayed exploitable. More than 80% of default validators upgraded on launch day, earlier than the repair’s code was revealed.
The disclosure lands a day after Cyber Capital founder Justin Bons known as promoting XRP as decentralized “fraud,” in an XRP decentralization debate with Ripple’s David Schwartz. The report says the XRPL Foundation, RippleX, and validators made the decision collectively.
RippleX mentioned votes stay the rule for future modifications.
The publish 100 Billion XRP Supply Was Nearly Broken by a 10-Year Bug appeared first on BeInCrypto.
