POPA ReconXRPL payment-engine overflow
A bug dating to the payment engine’s 2015 design could have let an attacker create spendable XRP for only a few hundred XRP plus a transaction fee. RippleX said it reproduced the attack but found no evidence it had been used on public networks. DefiPrime report
How it worked
A payment could consume hundreds of specially crafted order-book offers. The engine added the XRP amounts owed using unchecked 64-bit integer arithmetic; the total could wrap to a small value, so the buyer was charged far less than the XRP credited. The attack required deliberate offers and a purpose-built payment, so it could not happen accidentally. DefiPrime report
How it was fixed
Ripple released xrpld 3.4.1 on September 25, 2026. Operators applied the new payment rule by upgrading their servers, without waiting for a network amendment and its usual validator voting period. RippleX said this avoided leaving the flaw exploitable while an amendment was voted on. During the mixed-version rollout, patched servers could reject an exploit that older servers accepted, with a risk of servers falling out of sync or a ledger halt; the team judged a halt preferable to accepting an invalid ledger state. DefiPrime report
Separate issue
The same release also fixed a Batch transaction vulnerability, but that fix depended on the fixBatchV1_2 amendment, which activated on Mainnet on October 9. The payment-overflow fix took effect through the software upgrade itself. DefiPrime report