The XRP Ledger Foundation confirmed that a recently patched ledger vulnerability did not result in the creation of additional XRP tokens. The foundation addressed community concerns about a security issue that posed an unlimited XRP minting risk, clarifying that the total supply remains fixed at 100 billion coins since the network's launch.
According to the foundation, the payments engine vulnerability had existed since 2015. An attacker could theoretically create spendable XRP by setting up specially crafted offers on the built-in decentralized exchange and then consuming them in a single payment. The issue was discovered through the XRP Ledger Bug Bounty program by researchers at Veria AI, including Cayden Liao, before any exploitation occurred.
The XRP Ledger Foundation released the security fix through the emergency xrpld 3.4.1 upgrade after the community, including the Foundation, RippleX, core developers, and validators reached consensus on a rapid release. J. Ayo Akinyele, head of engineering at Ripple, described the vulnerability as serious and noted that security remains a top priority for preserving trust in the network.
The foundation stated that all account balances are publicly verifiable on the ledger and that supply has been monitored and confirmed throughout the network's history. It noted that no transaction is permitted to create new tokens, and the transaction fee burning mechanism is making the supply deflationary, currently standing at almost 99.986 billion XRP.
In addition to the payments engine fix, the foundation activated the Batch amendment on mainnet on October 9, which addressed a lower-severity validation issue in Batch transaction wrappers through the fixBatchV1_2 amendment.
The foundation committed to strengthened protections going forward, including expanded formal verification, AI adversarial testing, closer collaboration with security researchers, and an enhanced bug bounty program.
