{"schema":"postcutoff/event@1","as_of":"2026-10-12T07:22:00+02:00","url":"https://postcutoff.com/e/2026-10-09-xrp-ledger-xrp-overflow-bug-veria-ai/","md":"https://postcutoff.com/e/2026-10-09-xrp-ledger-xrp-overflow-bug-veria-ai/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"Adam Bicz","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-09-xrp-ledger-xrp-overflow-bug-veria-ai","date":"2026-10-09","date_precision":"day","short_title":"XRP Ledger discloses a critical decade-old overflow bug that could mint XRP beyond the fixed supply; report credits Cayden Liao and Veria AI","deck":null,"takeaway":"On Oct 9, 2026 the XRP Ledger's maintainers disclosed a critical integer-overflow bug in the payment engine, believed to date from 2015, that could create spendable XRP beyond the fixed 100-billion supply in a single validated transaction.","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"XRPL: Vulnerability disclosure report (Oct 9, 2026)","url":"https://xrpl.org/blog/2026/vulnerabilitydisclosurereport-bug-20261009","type":"official","group":"primary","domain":"xrpl.org"},{"n":2,"title":"CoinDesk: XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing (Oct 10)","url":"https://www.coindesk.com/tech/2026/10/10/xrp-ledger-patched-decade-old-bug-that-could-create-billions-of-dollars-in-xrp-from-nothing","type":"press","group":"press","domain":"coindesk.com"}],"official":1,"filed":"2026-10-12","updated":"2026-10-12","orgs":["XRPL Foundation","Ripple"],"title":"XRP Ledger discloses a critical decade-old overflow bug that could mint XRP beyond the fixed supply; report credits Cayden Liao and Veria AI","summary":"On Oct 9, 2026 the XRP Ledger's maintainers disclosed a critical integer-overflow bug in the payment engine, believed to date from 2015, that could create spendable XRP beyond the fixed 100-billion supply in a single validated transaction. It was reported through the bug bounty on Sept 22 by researcher Cayden Liao and Veria AI and fixed in xrpld 3.4.1 on Sept 25; there is no evidence it was exploited. Press headlines called it an AI-found bug. The disclosure credits \"Veria AI\" but does not say what the AI did.","key_facts":["Disclosure: XRPL vulnerability report published Oct 9, 2026; acknowledgements credit 'Cayden Liao and Veria AI' for the original report and proof of concept, submitted through the XRPL bug bounty programme","Bug: unchecked 64-bit addition when the payment engine sums offer amounts; the 'no XRP created' invariant used the same arithmetic and so missed it. Affects xrpld 3.4.0 and earlier; the flaw is believed to date to 2015 (CoinDesk)","Attack (CoinDesk): open hundreds of accounts, each offering a little of a token for a large amount of XRP, then send one payment that fills all offers; the total overflows, sellers are paid in full and the buyer is charged almost nothing. Cost: a few hundred XRP in account reserves plus fees","Severity: rated Major by the reporter, raised to critical by RippleX Engineering after it reproduced the attack on a standalone server and spent the newly created XRP","Timeline: reported and confirmed Sept 22; fix merged Sept 23; xrpld 3.4.1 released Sept 25 without saying what it repaired (over 80% of default-UNL validators upgraded that day); public report Oct 9","The fix shipped without the amendment vote, which the report calls the first deliberate change to transaction processing shipped that way since amendments were introduced","'No evidence the flaw was exploited on any public network' (RippleX, per CoinDesk)","AI role: not described. Neither the XRPL report nor CoinDesk names a model or explains Veria AI's part; the report says XRPL's own defences include 'AI-assisted red teaming'. CoinDesk notes other crypto flaws surfaced with AI help since July (Coldcard firmware, Core Lightning)","Earlier: in Feb 2026 an autonomous AI audit tool (Cantina's Apex, with researcher Pranamya Keshkamat) found a signature-validation flaw in XRPL's pending Batch amendment before activation (per press reports; not checked against a primary source)"],"key_numbers":[],"tags":["cybersecurity","vulnerability-discovery","blockchain","crypto","bug-bounty","ai-assisted-security"],"science":null,"body_md":"## What happened\n\nThe XRP Ledger has had a fixed supply of 100 billion XRP since 2012. A researcher working with a firm called Veria AI found that one\ncarefully built payment across hundreds of accounts could overflow the ledger's arithmetic and pay out XRP that nobody had funded, and\nthat the safety check meant to catch exactly this used the same faulty sum. Ripple's engineers confirmed it within a day, shipped a\nfix three days later without explanation, and published the details on Oct 9 once most validators had upgraded.\n\n## Why it matters\n\nIt is one more case in the 2026 pattern of old, severe bugs in financial infrastructure surfacing quickly, often with AI tools on the\nfinder's side. It came out in the same week as Justin Drake's \"bunker mode\" warning about AI and cryptography, which is a different\nrisk (breaking the maths, not finding code bugs).\n\nUncertain: how much of the discovery was done by an AI system. Headlines such as \"AI uncovers XRP Ledger bug\" (AOL) go beyond what the\nprimary report states.","disputed":[],"related":[{"id":"2026-10-07-justin-drake-bunker-mode-ai-cryptography","url":"https://postcutoff.com/e/2026-10-07-justin-drake-bunker-mode-ai-cryptography/","date":"2026-10-07","date_precision":"day","short_title":"After OpenAI's math release, Justin Drake urges crypto 'bunker mode' over AI-broken ECDSA","deck":"Vitalik Buterin warns lattices may take 'serious hits'","takeaway":"OpenAI's math release led prominent Ethereum researchers to say publicly that AI-accelerated mathematics could break widely used public-key cryptography (elliptic curves, possibly lattices) years before quantum computers, and to recommend defensive steps.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":12,"official":0,"filed":"2026-10-08","updated":"2026-10-12","orgs":["Ethereum Foundation","OpenAI"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-12","type":"filed","text":"Created (XRPL report and CoinDesk read directly)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-12","run":null,"sources_read":"XRPL report and CoinDesk read directly","updated":"2026-10-12","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":162,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":101,"in_training_data":false},{"model_id":"gemini-3-8-flash","name":"Gemini 3.8 Flash","cutoff":"2026-03","days_after":192,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":131,"in_training_data":false}],"short_url":null}