Image Credit: X.com
- Blockchain investigator ZachXBT criticized a $250,000 bug bounty paid to researchers who uncovered a critical XRP Ledger flaw.
- Veria Labs stated that the payment received on Oct. 8 was the maximum award available under the XRPL bug bounty program.
- The vulnerability could have created roughly 18 trillion spendable XRP through an integer overflow in the payment engine.
Blockchain investigator ZachXBT has criticized a $250,000 bug bounty awarded after researchers uncovered a critical XRP Ledger flaw that could have created spendable XRP beyond the network’s intended supply. Security firm Veria Labs said the payment was the maximum award available under the XRPL bug bounty program.
The vulnerability had been present in the XRP Ledger’s payment engine since around 2015. XRPL developers said they found no evidence that it was exploited on any public network before being patched.
ZachXBT Questions Size of Bug Bounty
ZachXBT argued that the compensation was too small relative to the potential consequences of the vulnerability. Ripple sponsors the XRPL bug bounty program, which is administered through Bugcrowd.
“Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?”
He also warned that insufficient rewards could weaken incentives for researchers to disclose severe vulnerabilities rather than exploit them. The $250,000 amount itself came from Veria Labs, which said it received the program’s maximum critical bounty on Oct. 8.
Bug Could Have Created Spendable XRP
The flaw involved an integer overflow when the payment engine added together XRP amounts across numerous specially constructed offers. Under the exploit, individual accounts could receive their full XRP amounts while the buyer was charged only a much smaller wrapped total.
Veria Labs said its proof of concept could have produced roughly 18 trillion XRP in a single transaction, vastly exceeding XRP’s original 100 billion supply. The official XRPL disclosure does not independently validate that figure but confirms the overflow could create spendable XRP beyond the intended supply.
The exploit could not occur through an ordinary payment. XRPL said it required hundreds of deliberately constructed offers and a payment specifically designed to consume them together.
Emergency Patch Skipped Normal Amendment Process
Veria reported the vulnerability on Sept. 22, and RippleX released the fix in xrpld 3.4.1 three days later. More than 80% of validators on the default Unique Node List were running the update on release day.
The XRP overflow fix took effect immediately as servers upgraded to xrpld 3.4.1 rather than going through XRPL’s normal amendment process. That release also addressed a separate Batch vulnerability whose fix followed the amendment process.
