In a hypothetical scenario, an attacker might be able to create numerous accounts, each offering a small amount of a specific token in exchange for a disproportionately high quantity of XRP. They could then make a single payment that would accept all these offers simultaneously.
Due to the total XRP owed being too substantial for the system to accurately calculate, the selling accounts would receive full payment while the buying account would incur only a minimal charge. This would result in the attacker obtaining XRP that was previously nonexistent.
The XRP Ledger has a verification process after each transaction to ensure that no new XRP has been created, but this would depend on the incorrectly calculated total, which could lead to an oversight. Additionally, a cap on the amount of XRP that can be received by a single account would not activate, as the attack distributed the XRP across many accounts.
The technique required only a few hundred XRP to set up those accounts, most of which could be retrieved, along with necessary transaction fees.
An update to the server software, xrpld 3.4.1, was released on September 25 to address this vulnerability, although the specific details of the fix were not made public.
This incident is part of a series of previously unnoticed crypto security vulnerabilities revealed with the assistance of AI since July. This includes a bug in the Coldcard wallet linked to the theft of over 1,367 BTC and other vulnerabilities that compelled Core Lightning to advise Bitcoin node operators to disconnect.