Blockchain investigator ZachXBT (@zachxbt) has criticized Ripple (@Ripple) for paying $250,000 to a researcher who uncovered a critical vulnerability in the XRP Ledger ($XRP). The bug could h
Blockchain investigator ZachXBT (@zachxbt) has criticized Ripple (@Ripple) for paying $250,000 to a researcher who uncovered a critical vulnerability in the XRP Ledger ($XRP). The bug could have allowed an attacker to create 18 trillion XRP in a single transaction, a figure about 184 times the token's fixed 100 billion supply.
Veria Labs co-founder Cayden Liao (@Cayden_Liao) received the maximum reward available under the bounty program.
The flaw was an integer overflow in the payment engine that had existed since 2015. According to Cryptopolitan, the affected code settles trades against the network's built-in order book. An attacker could have created hundreds of fake accounts, each offering a tiny amount of a token for a large amount of XRP, and combining those trades into one payment could have caused the system's calculations to read a massive number as a tiny one.
The 18 trillion figure comes from a test, not from actual losses. The 18.45 trillion XRP figure came from a controlled exploit demonstration rather than tokens shown to have entered circulation, according to TokenPost. The XRP Ledger Foundation said XRP's original supply remained intact, apart from destroyed transaction fees, and that its monitoring had found no unauthorized issuance.
On the timeline, Veria Labs reported the vulnerability on Sept. 22 after discovering it on Sept. 21, and an emergency update followed on Sept. 25, when more than 80% of validators on the default UNL were running the patched software or a newer version.XRP Ledger changes normally go through a two-week voting process among validators, but RippleX delivered the fix directly to validators on Sept. 25.
ZachXBT criticized the payment in a post on Oct. 12, asking why Ripple was cheaply paying the whitehat $250K when its treasury has billions.He wrote that the finding should be a seven-figure payday at minimum. He also warned that thin rewards could tempt the next person who finds such a flaw to exploit it instead of disclosing it.
He pointed to other bounties as benchmarks. ZachXBT held up Zcash's $1.5 million award to Taylor Hornby as the fairer benchmark, while an Ethereum hacker received a $2 million bug bounty in 2022 for disclosing a potential exploit that could create an unlimited supply of ETH.
Defenders of the payout note that the $250,000 award was the top tier of the XRPL program, the flaw was disclosed responsibly, the fix was deployed before public disclosure, and no losses occurred. Veria noted that the XRPL has paid more than $1 million in bug bounties and undergone more than a dozen audits and audit contests since 2024.As of The Crypto Times' publication, neither the XRP Ledger Foundation nor Ripple had publicly responded to the criticism.
The debate centers on whether a capped bounty reflects the scale of risk to an asset worth tens of billions of dollars. Liao said the payment was the largest ever for a vulnerability found entirely by an AI agent.
TokenPost: XRP Ledger Pays $250,000 Bounty for Infinite Supply Vulnerability
Cryptopolitan: ZachXBT renews his "cheap Ripple" criticism over a $250K bounty
The Crypto Times: ZachXBT Slams $250K Bounty for XRP Ledger Bug
