Verify a decision

{"actor":"system:backfill","investigation_id":"052edb8e-ba16-4060-9aaf-69a1dc6ad87b","kind":"publish","page_slug":"ripple-bug-bounty-controversy-xrpl-250k-payout-for-18-trillion-xrp-flaw","published_at":"2026-10-14T12:12:27.214Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ripple Bug Bounty Controversy — XRPL $250K Payout for 18-Trillion-XRP Flaw","sections":[{"content":"On September 21-22, 2026, security researcher Cayden Liao and Veria Labs — using an AI agent — identified two chained integer overflow flaws in the XRP Ledger's C++ payment engine. The first flaw (the BookStep overflow) resided in a signed 64-bit accumulator used during offer aggregation: when a crafted payment consumed enough offers in a single transaction, the accumulator wrapped around to a small or negative value, creating a large discrepancy between XRP charged and XRP disbursed. The second flaw (the XRPNotCreated invariant overflow) caused the network's own internal invariant checker — designed to detect exactly this kind of unauthorized creation — to itself overflow, masking the discrepancy as a fee burn rather than flagging it. Together, the flaws meant that a single transaction consuming 256 specially constructed DEX offers could mint approximately 18.45 trillion XRP spendable by the attacker, while charging the attacker only a negligible fee. The code containing the first flaw was written in 2015; the invariant code dates to 2017. Veria Labs estimated the potential market exposure at approximately $94 billion at the XRP price prevailing at time of discovery.","heading":"Vulnerability Overview","severity":"critical","sources":[{"credibility":2,"name":"Veria Labs blog: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"Forklog: Critical Decade-Old Vulnerability in XRP Ledger Resolved","type":"news_article","url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"credibility":2,"name":"FinanceFeeds: XRP Ledger Fixes Decade-Old Bug That Could Have Minted Trillions of XRP","type":"news_article","url":"https://financefeeds.com/xrp-ledger-fixes-decade-old-bug-that-could-have-minted-trillions-of-xrp/"},{"credibility":2,"name":"Crypto.news: XRP Ledger Confirms 100B Supply Is Safe After Major Security Flaw","type":"news_article","url":"https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/"}]},{"content":"RippleX engineers reproduced the exploit on a standalone test server by September 22-23, 2026, confirmed that the newly created XRP was spendable in a subsequent transaction, and classified the issue as critical severity. A fix was merged on September 23 and shipped as xrpld 3.4.1 on September 25. Ripple elected to bypass the XRP Ledger's standard amendment process — which normally requires 80 percent of default validators to signal support over a rolling two-week window — for the first time in the protocol's history. Ripple's rationale was that the open-source nature of the codebase meant publishing a patch through the ordinary amendment vote would expose the vulnerability publicly before most validators had upgraded, providing a window for exploitation. According to Crypto.news, over 80 percent of default validators had upgraded to 3.4.1 by September 25, the same day the release was made public. Full public disclosure of the vulnerability followed on October 9, 2026, two weeks after the patch reached supermajority validator adoption. Separately, xrpld 3.4.1 also patched a Batch transaction validation error that allowed incorrect transaction structure recording; that fix was processed through the standard amendment mechanism. No evidence of exploitation on any public network was found by RippleX.","heading":"Patch and Governance Process","severity":"high","sources":[{"credibility":2,"name":"Veria Labs blog: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"Crypto.news: XRP Ledger Confirms 100B Supply Is Safe After Major Security Flaw","type":"news_article","url":"https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/"},{"credibility":2,"name":"TechTimes: XRP Ledger Bypasses Own Amendment Vote for First Time","type":"news_article","url":"https://www.techtimes.com/articles/328904/20261013/xrp-ledger-bypasses-own-amendment-vote-first-time-what-validator-speed-reveals.htm"},{"credibility":2,"name":"KuCoin News: XRPL Vulnerability Could Have Minted 18T XRP, Fixed in xrpld 3.4.1","type":"news_article","url":"https://www.kucoin.com/news/flash/xrpl-vulnerability-could-have-minted-18t-xrp-fixed-in-xrpld-3-4-1"}]},{"content":"On October 8, 2026, Ripple paid Veria Labs and Cayden Liao $250,000 — the maximum payout available under the XRPL Bug Bounty program. Cayden Liao publicly described it as the largest bounty he was aware of for a vulnerability discovered entirely by an AI agent. On October 12, 2026, blockchain investigator ZachXBT posted criticism on X, writing that the finding 'should be a 7 fig pay day at minimum' and questioning what he characterized as cheaply paying the researcher $250K for a critical infinite XRP supply bug when the organization's treasury holds billions. ZachXBT further warned that systematically low bounties for critical-severity finds could disincentivize future responsible disclosure, increasing the risk that a comparable flaw would be exploited rather than reported. ZachXBT also referenced a seven-figure reward paid in the Zcash ecosystem for a recent counterfeiting bug as a point of comparison. As of the date of publication of the reporting relied upon here, neither Ripple nor the XRP Ledger Foundation had publicly responded to ZachXBT's comments.","heading":"Bug Bounty Payout and Criticism","severity":"medium","sources":[{"credibility":2,"name":"CryptoTimes: ZachXBT Slams $250K Bounty for XRP Ledger Bug That Could Have Minted 18 Trillion XRP","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"credibility":2,"name":"CryptoAdventure: ZachXBT Slams Ripple Over $250K Reward for Critical XRP Supply Bug","type":"news_article","url":"https://cryptoadventure.com/zachxbt-slams-ripple-over-250k-reward-for-critical-xrp-supply-bug/"},{"credibility":2,"name":"247 Wall St.: ZachXBT Criticizes Ripple's $250,000 Bounty for the XRP Ledger Bug","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/13/zachxbt-criticizes-ripples-250000-bounty-for-the-xrp-ledger-bug-here-is-what-ethereum-solana-and-others-pay-for-the-same-kind-of-find/"},{"credibility":2,"name":"Benzinga: Ripple Faces Criticism Over $250,000 Reward for Finding Critical XRP Flaw","type":"news_article","url":"https://www.benzinga.com/crypto/cryptocurrency/26/10/62302157/ripple-faces-criticism-over-250000-reward-for-finding-critical-xrp-flaw"},{"credibility":2,"name":"Veria Labs blog: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"}]},{"content":"The $250,000 XRPL maximum sits materially below the critical-severity ceilings of several comparable blockchain bug bounty programs. The Ethereum Foundation raised its maximum bug bounty payout from $250,000 to $1,000,000 in March 2025, specifically covering bugs capable of enabling infinite ETH creation, affecting 50 percent or more of validators, or taking down the network via a single on-chain transaction — a threat category directly analogous to the XRPL integer overflow. The Solana ecosystem hosts multiple Immunefi-listed programs with critical-severity maximums ranging from $500,000 (Firedancer) to $1,500,000 (Kamino). Cross-chain infrastructure programs sit higher still: LayerZero has offered up to $2,000,000 and Wormhole's program has reached $10,000,000 for critical severity. These comparisons are not exact equivalents — program scope, asset value, and discovery conditions vary — but they provide the industry frame within which critics are evaluating the XRPL maximum. The XRPL bug bounty program is not listed on Immunefi, though Ripple has run a separate time-limited Immunefi Attackathon; this may limit the program's visibility to professional security researchers who monitor the Immunefi marketplace.","heading":"Industry Bounty Program Context","severity":"medium","sources":[{"credibility":1,"name":"Ethereum Foundation Bug Bounty Program","type":"official","url":"https://ethereum.org/bug-bounty/"},{"credibility":1,"name":"GovInfoSecurity: Ethereum Offers Up to $1M Bounty for Critical Bug Reports","type":"news_article","url":"https://www.govinfosecurity.com/ethereum-offers-up-to-1m-bounty-for-critical-bug-reports-a-19922"},{"credibility":1,"name":"Wormhole Bug Bounty on Immunefi","type":"official","url":"https://immunefi.com/bug-bounty/wormhole/information/"},{"credibility":2,"name":"Sherlock: Best Web3 Bug Bounties in 2026","type":"research","url":"https://sherlock.xyz/post/best-web3-bug-bounties-in-2026-the-highest-paying-programs-on-every-platform"},{"credibility":1,"name":"Immunefi XRPL/Ripple Attackathon","type":"official","url":"https://immunefi.com/audit-competition/xrpl-ripple-attackathon/scope/"}]},{"content":"Veria Labs used an automated AI agent to identify the vulnerability on September 21, 2026. Cayden Liao, co-founder of Veria Labs, developed a working proof-of-concept exploit on a local test network the following day and submitted the report. Liao stated publicly that the $250,000 payout represents the largest reward he is aware of for a vulnerability discovered entirely by an AI agent. The discovery is an early documented case of AI-assisted identification of a critical consensus-layer vulnerability in a major production blockchain. Liao's positive characterization of the payout from that specific reference point is notable context alongside ZachXBT's criticism: Liao was not himself publicly disputing the amount, while ZachXBT's concern was directed at the incentive structure the program creates for the broader researcher community.","heading":"AI-Assisted Discovery","severity":"low","sources":[{"credibility":2,"name":"Veria Labs blog: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"Forklog: Critical Decade-Old Vulnerability in XRP Ledger Resolved","type":"news_article","url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"credibility":2,"name":"247 Wall St.: AI Uncovers XRP Ledger Bug — Is It a Threat or a Defense?","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/11/ai-uncovers-xrp-ledger-bug-is-it-a-threat-or-a-defense/"}]},{"content":"Several material facts remain unconfirmed as of this investigation. Ripple and the XRP Ledger Foundation had not issued a public response to ZachXBT's criticism of the bounty amount; whether they intend to raise the program ceiling is unknown. The exact language of ZachXBT's original X post has been paraphrased across multiple secondary news articles; the original post was not directly retrieved for this investigation and quoted language should be treated as attributed via Tier 2 sources rather than as direct primary sourcing. The claim that LayerZero pays up to $2,000,000 for critical bugs appears in multiple news summaries but was not independently verified against a current LayerZero program page for this report. The XRPL Immunefi Attackathon identified in search results is a separate time-limited audit competition whose scope and payout structure were not confirmed as directly comparable to the ongoing bug bounty program.","heading":"Outstanding Questions and Source Limitations","severity":"low","sources":[{"credibility":1,"name":"Immunefi XRPL/Ripple Attackathon information page","type":"official","url":"https://immunefi.com/audit-competition/xrpl-ripple-attackathon/information/"}]}],"sources_used":[{"credibility":2,"name":"Veria Labs blog: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"FinanceFeeds: XRP Ledger Fixes Decade-Old Bug That Could Have Minted Trillions of XRP","type":"news_article","url":"https://financefeeds.com/xrp-ledger-fixes-decade-old-bug-that-could-have-minted-trillions-of-xrp/"},{"credibility":2,"name":"Forklog: Critical Decade-Old Vulnerability in XRP Ledger Resolved","type":"news_article","url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"credibility":2,"name":"Crypto.news: XRP Ledger Confirms 100B Supply Is Safe After Major Security Flaw","type":"news_article","url":"https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/"},{"credibility":2,"name":"CryptoTimes: ZachXBT Slams $250K Bounty for XRP Ledger Bug That Could Have Minted 18 Trillion XRP","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"credibility":2,"name":"CryptoAdventure: ZachXBT Slams Ripple Over $250K Reward for Critical XRP Supply Bug","type":"news_article","url":"https://cryptoadventure.com/zachxbt-slams-ripple-over-250k-reward-for-critical-xrp-supply-bug/"},{"credibility":2,"name":"247 Wall St.: ZachXBT Criticizes Ripple's $250,000 Bounty for the XRP Ledger Bug","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/13/zachxbt-criticizes-ripples-250000-bounty-for-the-xrp-ledger-bug-here-is-what-ethereum-solana-and-others-pay-for-the-same-kind-of-find/"},{"credibility":2,"name":"Benzinga: Ripple Faces Criticism Over $250,000 Reward for Finding Critical XRP Flaw","type":"news_article","url":"https://www.benzinga.com/crypto/cryptocurrency/26/10/62302157/ripple-faces-criticism-over-250000-reward-for-finding-critical-xrp-flaw"},{"credibility":2,"name":"KuCoin News: XRPL Vulnerability Could Have Minted 18T XRP, Fixed in xrpld 3.4.1","type":"news_article","url":"https://www.kucoin.com/news/flash/xrpl-vulnerability-could-have-minted-18t-xrp-fixed-in-xrpld-3-4-1"},{"credibility":2,"name":"TechTimes: XRP Ledger Bypasses Own Amendment Vote for First Time","type":"news_article","url":"https://www.techtimes.com/articles/328904/20261013/xrp-ledger-bypasses-own-amendment-vote-first-time-what-validator-speed-reveals.htm"},{"credibility":1,"name":"Ethereum Foundation Bug Bounty Program","type":"official","url":"https://ethereum.org/bug-bounty/"},{"credibility":1,"name":"GovInfoSecurity: Ethereum Offers Up to $1M Bounty for Critical Bug Reports","type":"news_article","url":"https://www.govinfosecurity.com/ethereum-offers-up-to-1m-bounty-for-critical-bug-reports-a-19922"},{"credibility":1,"name":"Wormhole Bug Bounty on Immunefi","type":"official","url":"https://immunefi.com/bug-bounty/wormhole/information/"},{"credibility":2,"name":"Sherlock: Best Web3 Bug Bounties in 2026","type":"research","url":"https://sherlock.xyz/post/best-web3-bug-bounties-in-2026-the-highest-paying-programs-on-every-platform"},{"credibility":1,"name":"Immunefi XRPL/Ripple Attackathon","type":"official","url":"https://immunefi.com/audit-competition/xrpl-ripple-attackathon/scope/"},{"credibility":2,"name":"DeFiPrime: XRPL Patches Payment Engine XRP Overflow","type":"news_article","url":"https://defiprime.com/xrpl-patches-payment-engine-xrp-overflow"},{"credibility":2,"name":"247 Wall St.: AI Uncovers XRP Ledger Bug — Is It a Threat or a Defense?","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/11/ai-uncovers-xrp-ledger-bug-is-it-a-threat-or-a-defense/"}],"summary":"In September 2026, an AI-assisted security team discovered a critical decade-old integer overflow in the XRP Ledger's payment engine that could theoretically have minted 18.45 trillion XRP in a single transaction — 184 times the protocol's fixed 100 billion supply cap. Ripple patched the flaw in xrpld 3.4.1 on September 25, with no evidence of prior exploitation, and paid the discoverers $250,000 — the stated program maximum. The payout size drew public criticism from blockchain investigator ZachXBT and others, who argued it was systematically inadequate relative to the severity of the flaw and to the bug bounty programs maintained by comparable networks.","timeline":[{"date":"2015-01-01","event":"Integer overflow code containing the BookStep vulnerability written and incorporated into XRP Ledger's payment engine (approximate year per Veria Labs; exact date not publicly disclosed).","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2017-01-01","event":"XRPNotCreated invariant code written, which would later itself overflow and mask the exploit (approximate year per Veria Labs).","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-21","event":"Veria Labs' AI agent identifies the integer overflow vulnerability in the XRP Ledger payment engine.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-22","event":"Cayden Liao builds a working proof-of-concept exploit and submits the vulnerability report to Ripple via the XRPL bug bounty program. RippleX raises severity classification to critical.","source":"FinanceFeeds / Forklog","source_url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"date":"2026-09-23","event":"RippleX engineers reproduce the exploit and merge a fix.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-25","event":"xrpld 3.4.1 released. Over 80 percent of default validators upgrade. Ripple bypasses the standard amendment voting process for the first time in the ledger's history to prevent premature public exposure of the flaw.","source":"Crypto.news / TechTimes","source_url":"https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/"},{"date":"2026-10-08","event":"Ripple pays Veria Labs and Cayden Liao $250,000 — the stated maximum under the XRPL Bug Bounty program.","source":"Veria Labs blog / CryptoTimes","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-10-09","event":"Full public disclosure of the vulnerability published. A separate Batch transaction validation error patched in the same release also disclosed.","source":"FinanceFeeds / Crypto.news","source_url":"https://financefeeds.com/xrp-ledger-fixes-decade-old-bug-that-could-have-minted-trillions-of-xrp/"},{"date":"2026-10-12","event":"ZachXBT publicly criticizes the $250,000 bounty on X, stating the finding should be a seven-figure payday at minimum and warning that low payouts disincentivize responsible disclosure.","source":"CryptoTimes / CryptoAdventure","source_url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"date":"2026-10-13","event":"Multiple outlets including 247 Wall St. and Benzinga publish comparative analyses of bug bounty maximums across Ethereum, Solana, LayerZero, and Wormhole. Neither Ripple nor the XRP Ledger Foundation had responded publicly as of those publications.","source":"247 Wall St. / Benzinga","source_url":"https://247wallst.com/investing/cryptocurrency/2026/10/13/zachxbt-criticizes-ripples-250000-bounty-for-the-xrp-ledger-bug-here-is-what-ethereum-solana-and-others-pay-for-the-same-kind-of-find/"}]},"v":1}