Blockchain investigator ZachXBT said on Monday that the $250,000 Ripple paid security firm Veria Labs for uncovering a flaw that could have minted trillions of XRP was far too small — a payout that has reignited his long-running criticism of how the company treats security researchers.

ZachXBT: Researchers Are Being Shortchanged

In a post on X on October 12, ZachXBT criticized the $250,000 awarded to Veria Labs, writing that the finding "should be a 7 fig pay day at minimum" for the firm and its co-founder Cayden Liao.

He described the payout as part of a trend of "well capitalized organizations" shortchanging white-hat security researchers. A quarter of a million dollars was too little, he argued, when the paying organization's "treasury has billions," and he warned that thin rewards could tempt the next person who finds such a flaw to exploit it rather than disclose it.

Liao offered a different perspective, saying that Ripple had paid Veria the bug bounty program's maximum $250,000 and calling it the largest amount ever awarded for a vulnerability found entirely by an AI agent.

A Bug That Could Have Created 18.45 Trillion XRP

Veria Labs discovered a critical integer overflow in the XRP Ledger's payment engine, the code that settles trades against the network's built-in order book. When a single payment filled many offers at once, the engine summed the amounts without checking for overflow. A large enough total wrapped around to a tiny number, meaning sellers were paid in full while the buyer was charged only the negligible remainder.

That difference amounted to newly created XRP that could be spent like any other. The ledger does have a safety check, "XRPNotCreated," designed to block any transaction that creates new coins, but that check contained a similar bug of its own and failed to catch the imbalance. The incident therefore involved both the payment calculation and the safeguard intended to prevent unauthorized issuance.

According to Veria, its AI agent chained the two bugs — introduced in November 2015 and February 2017, respectively — into a working proof of concept. In a single transaction, it credited 18.45 trillion XRP across 256 accounts, roughly 184 times XRP's fixed supply of 100 billion tokens. Veria estimated that the funds at risk were close to the token's entire $94 billion market value, based on a price of $1.59.

Developers found no sign the bug was ever exploited in the wild. Ripple's disclosure report explained that pulling off the attack would have required hundreds of offers priced in ways no real trader would use.

Veria reported the flaw on September 22 through the XRPL bug bounty program and received the $250,000 reward.

A $1.5 Million Precedent on Zcash

In arguing against Ripple's payment, ZachXBT pointed to the $1.5 million that Zcash awarded to researcher Taylor Hornby. Hornby disclosed a counterfeiting bug in Zcash's Orchard shielded pool, a flaw that put roughly $2.3 billion of ZEC at risk, and received a $750,000 bounty plus a matching $750,000 bonus grant approved by coinholders in a third-quarter retroactive funding round that distributed about $8.39 million overall.

Shielded Labs executive director Jason McGee, who filed the bonus nomination, argued the original bounty amounted to only about 0.033% of the funds at risk, against a lowest precedent of 0.24%. A higher reward, he wrote, was "cheap insurance" for the protocol. Like Veria's find, Hornby's discovery was AI-assisted.

Fix Shipped Outside the Amendment Process

RippleX, Ripple's engineering arm, confirmed the bug the same day Veria reported it and, after determining that the XRP created by the flaw could actually be spent, rated it critical. A fix was merged on September 23 and released in xrpld 3.4.1 on September 25.

Under normal circumstances, a change like this would go through the XRP Ledger's amendment process, which requires support from more than 80% of trusted validators for two consecutive weeks. This time, however, the patch took effect as each server upgraded. By the day of release, more than 80% of validators on the default Unique Node List were already running the fixed code.

Ripple's report stated that this was the first transaction-processing change in more than ten years to bypass the amendment system, a step taken because the vulnerability would otherwise have remained exposed for weeks before a fix went live. The response thus put both validator adoption and the amendment process under scrutiny in addition to the bounty itself.

The decision to delay the public release of the source code nonetheless drew criticism. Justin Bons, founder of Cyber Capital, said XRP had been "running closed-source code" until the full 3.4.1 code was published. RippleX engineer Mayukha Vadari responded that the old approach no longer works, explaining that a critical patch cannot be folded into a routine public release because attackers would spot it and reverse-engineer it immediately.