Ripple fixed a critical vulnerability in the XRP Ledger (XRPL) that could generate XRP equal to 184 times the fixed supply, but it faced criticism that the bug bounty paid to the reporter was too small. The reward paid to prevent exploitation was $250,000, about 360 million won. Security experts said the payout was insufficient given the severity of a flaw that could have put large assets at risk.

On Oct. 12, local time, blockchain media outlet Cryptopolitan reported that blockchain investigator ZachXBT publicly criticised Ripple's bug bounty paid to security firm Veria Labs. He said reporting the vulnerability required a reward of at least $1 million. He argued it was far too small for a company holding assets worth billions of dollars to pay only $250,000 to security researchers.

ZachXBT warned that a low payout could instead distort security researchers' incentives. He said if researchers do not receive sufficient compensation after finding a serious vulnerability, others who discover similar flaws in the future could be more likely to exploit them rather than report them publicly.

At the centre of the controversy is an integer overflow vulnerability found in the XRP Ledger's payment engine. The payment engine settles trades through an order book built into the network. The problem was that overflow checks were not properly performed when amounts were added up as multiple orders were filled in a single payment.

An integer overflow is a phenomenon in which a calculation result changes abnormally when numbers exceed the range a computer can handle. In this vulnerability, the total amount could be processed as a value far smaller than the actual amount. This structure meant sellers could receive full payment while buyers would pay only a reduced amount, and the difference could be newly created as XRP.

A safeguard to prevent new XRP creation, called 'XRPNotCreated', had the same type of flaw and failed to block it. Veria Labs said its artificial intelligence (AI) agent succeeded in a proof of concept by linking vulnerabilities in code written in November 2015 and February 2017.

The proof of concept resulted in crediting a total of 1,845,000,000,000 XRP to 256 accounts in a single transaction. That is about 184 times XRP's fixed supply of 100 billion. This tested what could be possible if the vulnerability were exploited, and it does not mean XRP of that scale was actually created and circulated.

Veria Labs co-founder Kaden Liao (케이든 랴오) said Ripple paid $250,000, the maximum reward set under its bug bounty program. He said it was the largest payout ever for a vulnerability discovered entirely by an AI agent. ZachXBT, however, said the cap itself failed to provide sufficient motivation to researchers who find serious security vulnerabilities.

Ripple said it found no signs of actual exploitation. It said an attack would have required hundreds of orders to be placed at prices that real traders do not generally use.

Veria Labs reported the vulnerability on Sept. 22 through the XRP Ledger bug bounty program, and RippleX confirmed it the same day. It then verified that newly created XRP could be used and classified the vulnerability as critical.

Ripple moved quickly to fix and deploy the vulnerability. The patch was merged on Sept. 23 and was reflected in xrpld 3.4.1, XRPL software, on Sept. 25. Typically, changes to transaction processing must go through an amendment procedure requiring more than 80 percent of trusted validators to agree for two consecutive weeks. This time, a separate method was applied so that it took effect as soon as each server updated. On the day 3.4.1 was released, more than 80 percent of validators included in the default Unique Node List (UNL) were already running that version.

Ripple said the move was the first case in more than 10 years of changing transaction processing without going through the amendment procedure. It said the decision reflected the risk that attackers could exploit the flaw if it remained exposed for a long time while the vulnerability was public.

There was also controversy over delays in fully releasing the source code during the fix process. Cyber Capital founder Justin Bons (저스틴 본스) criticised XRPL as having operated on what was effectively a closed-source basis until the full 3.4.1 code was released. RippleX engineer Mayuka Badari (마유카 바다리) countered that it was no longer feasible to respond using the existing disclosure method. Including code that fixes a critical vulnerability in a normal public release could allow attackers to analyse changes and trace the flaw back, she said.

The dispute is expanding beyond the appropriate level of bug bounties to include how major blockchain networks respond to security vulnerabilities and their principles for disclosure. As a comparison, ZachXBT cited a case in which Zcash paid a total of $1.5 million to researcher Taylor Hornby (테일러 혼비) for reporting a forgery vulnerability that could have put assets worth about $2.3 billion at risk. That vulnerability was also found with the help of AI.

Providing appropriate rewards to researchers who find critical vulnerabilities, as well as fixing them quickly, is emerging as an important task for maintaining the security level of the blockchain ecosystem.

@zachxbt @XRPLF zachxbt hates xrp