Blockchain investigator ZachXBT has criticized the $250,000 reward paid to researchers who uncovered a critical XRP Ledger vulnerability, arguing that the payout was disproportionately small
Blockchain investigator ZachXBT has criticized the $250,000 reward paid to researchers who uncovered a critical XRP Ledger vulnerability, arguing that the payout was disproportionately small compared with the potential damage the flaw could have caused.
In an October 12 post on X, ZachXBT questioned why a researcher who responsibly disclosed a vulnerability capable of creating XRP beyond its intended supply received only a quarter-million-dollar reward.
“Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?” he wrote.
He warned that inadequate compensation could discourage future disclosures, potentially encouraging malicious actors to exploit vulnerabilities rather than report them. ZachXBT also questioned the credibility of Ripple and the XRP Ledger ecosystem over their approach to security incentives.
The criticism followed an XRP Ledger Foundation response addressing the vulnerability and its emergency remediation.
Security researchers Cayden Liao and Veria AI discovered the flaw on September 21 and submitted it through the XRPL Bug Bounty program the following day.
Veria Labs confirmed receiving $250,000, the maximum available under the program, on October 8. The company said an AI security agent identified the vulnerability and generated a working proof of concept.
The firm estimated that a single malicious transaction could have created approximately 18 trillion XRP, more than 180 times the cryptocurrency’s original 100 billion supply.
Veria Labs also described the payment as the largest bounty it knew of for a vulnerability discovered entirely by an AI agent.
ZachXBT’s criticism focuses on the gap between the reward ceiling and the potential economic consequences of an attack. His warning concerns the incentives facing future researchers, rather than any allegation that the team responsible for this disclosure acted improperly.
The disputed payout relates to a critical payment-engine vulnerability that had remained undetected for more than a decade.
The flaw involved an integer overflow that could occur when a specially constructed payment consumed hundreds of offers from the XRP Ledger’s decentralized exchange.
An attacker could manipulate the calculation so that offer owners received their full XRP amounts while the paying account was charged only a small fraction of the total. An existing safeguard designed to prevent unauthorized XRP creation suffered from the same overflow problem.
The official vulnerability disclosure confirmed that RippleX engineers reproduced the exploit in a standalone testing environment and verified that the newly created XRP could subsequently be spent.
No evidence of exploitation on a public XRP Ledger network was found.
RippleX released the corrective update in xrpld version 3.4.1 on September 25, three days after receiving the report.
The emergency response bypassed the usual amendment voting process because developers considered leaving the vulnerability exposed substantially more dangerous than deploying an immediate consensus-sensitive fix.
More than 80% of validators on the default Unique Node List had upgraded by the release date, protecting the network against the supply-creation vulnerability.
The researchers received their reward nearly two weeks later, and the full technical disclosure became public on October 9.
The $250,000 payment remains the confirmed maximum bounty awarded under the program for the discovery.
The post ZachXBT Slams Ripple Over $250K Reward for Critical XRP Supply Bug appeared first on Crypto Adventure.
