⏱ 2 min read
Patch landed before the Sept 30 vote; the official description arrived Oct 9, after investors’ redemption decisions, the report says.
The XRPN shareholder vote went ahead before an official description of a critical XRP Ledger inflation bug was released, according to the report. A closed-source patch landed days before investors’ Sept 28 redemption deadline, but the detailed bug disclosure arrived on Oct 9, after those decisions and the Sept 30 vote to proceed to Nasdaq.
Fix shipped before the vote, disclosure after
The report says an ethical researcher privately notified Ripple’s developer arm about the flaw on Sept 22. Ripple then shipped an emergency patch on Sept 25, described in release notes with language about integer arithmetic hardening. XRPN shareholders faced a Sept 28 deadline to redeem shares for cash or back out of the plan to merge Evernorth onto public markets, the report says.
The vote to proceed passed on Sept 30, and the merger closed on Oct 9, per the report. Only on Oct 9 did an official report identify what the Sept 25 patch addressed: a payment‑engine overflow vulnerability. The report adds that validators have patched the issue and that no one exploited it while it was active.
▲ 1.63%
Prices as of 2026-10-13 23:02 UTC. Source: CoinGecko.
Why an overflow bug matters for a capped token
The bug report stated that a single validated transaction using the exploit “could have created spendable XRP far beyond the total supply.” The report says the flaw likely dated back to 2015. In general, overflow errors in payment logic can let arithmetic on token amounts exceed intended bounds, enabling creation of balances the protocol does not cap.
The timing matters because XRPN’s pitch leaned on XRP’s fixed issuance. Evernorth’s proxy filing said, “All 100 billion XRP tokens were created at the time of the XRP Ledger’s launch in 2012.” XRPN chief executive Asheesh Birla also said, “XRP is a pre-mined digital asset. One hundred billion XRP were created at inception, and that number will never change.” The report argues that, while the ledger’s recorded total never changed, the overflow meant that, until patched, the cap was unenforceable on the network itself.
The report says RippleX and the XRP Ledger Foundation reproduced the exploit, escalated severity to critical and paid the bug bounty to researcher Cayden Liao and Veria AI, before shipping the fix in xrpld 3.4.1 without an amendment vote. It also notes that Ripple Labs is an investor in, and a named counterparty to, the agreement that took Evernorth public, and that Evernorth’s registration statement contained only generic language that underlying cryptography could be flawed.
The report does not say who at XRPN or Evernorth, if anyone, knew about the bug before the vote. A dated company statement on when management learned of the issue would clarify what was possible to disclose to shareholders during the redemption period.
Source: Protos.
This article was written with AI assistance and reviewed by an editor.
This content is for informational purposes only and does not constitute financial advice.
🧠 HafidWatch Take
There were 14 days between the patch and the official report that identified the flaw as an inflation bug. That span covered both the redemption deadline and the shareholder vote. The timing data does not show who at XRPN or Evernorth knew when, or what, if any, disclosure obligations applied.
🔗 Tools mentioned in this article
Affiliate disclosure: Links above may earn HafidWatch a commission at no cost to you.
Daily crypto intelligence. Before the market opens.
Including the Divergence Index — the sentiment gap no other newsletter tracks. Free, every morning at 7:30am ET.
✓ Free forever · ✓ No spam · ✓ 50+ sources monitored
