Ripple Fixes Payment Engine Vulnerability to Prevent XRP Minting

Ripple has released the xrpld 3.4.1 vulnerability disclosure report, addressing two issues. An integer overflow in the payment engine has been rated as critical, affecting versions 3.4.0 and earlier. This vulnerability allows for the minting of spendable XRP due to a lack of overflow checks when aggregating amounts across multiple orders, leading to a wraparound effect. Attackers would need to create hundreds of malicious orders, costing reserves and fees amounting to several hundred XRP, and ordinary payments cannot trigger this path. The report states that no evidence has been found of this issue being exploited on any public network. The internal encapsulation check for batch transactions (fixBatchV1_2) has been listed as a blocking item before activation, affecting versions 3.3.0 and 3.4.0. The XLS-56 batch functionality requires internal transactions to be encapsulated in the RawTransaction field, but the server did not enforce this, which could lead to consensus discrepancies in field definitions among nodes of different versions. Activating BatchV1_1 without a fix poses risks of network activity interruptions or leaving malformed records in the ledger. This issue has been resolved through the fixBatchV1_2 amendment in 3.4.1, which was activated on the mainnet on October 9. The report indicates that this issue did not result in any loss of funds or exposure of private keys. The payment engine overflow fix has been effective since the release of 3.4.1 on September 25, without the need for an amendment process.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.