The $250,000 bounty Ripple awarded to Veria Labs for discovering a critical XRP Ledger vulnerability has drawn criticism from Daniel, CTO at HashLabs, who believes the payment fell far short of what the discovery deserved.
Although the security team fixed the flaw before finding any evidence of exploitation, Daniel questioned whether the reward adequately reflected the potential consequences of the vulnerability.
In a post on X, Daniel (@daniel_wwf) criticized Ripple’s decision to award the maximum amount available under its bug bounty program. He noted that the company should have offered at least ten times that amount, given the scale of the potential damage the vulnerability could have caused.
Daniel Questions Ripple’s $250,000 Bounty
Daniel expressed his dissatisfaction with the reward after Veria Labs co-founder SuperBeetleGamer disclosed details about the vulnerability and explained how the team discovered it using artificial intelligence.
Veria Labs said its AI agent spotted the flaw and confirmed that a single transaction could have generated an enormous amount of XRP. The team reproduced the exploit on a standalone server before submitting the issue through the XRP Ledger bug bounty program.
The researcher received $250,000 for the discovery. Commentator Daniel was not satisfied with that figure. He argued Ripple should have ‘added at least another zero’ to the payout, putting it at a minimum of $2.5 million. Daniel also questioned what a $250,000 reward communicates to security researchers who uncover critical flaws in major blockchain networks.
Vulnerability Could Have Threatened XRP’s Fixed Supply
Veria Labs said the vulnerability came from two separate bugs that, when combined, produced a far more serious exploit. An attacker could have created 18 trillion XRP in a single transaction, which is roughly 184 times XRP’s total supply of 100 billion tokens.
The bugs traced back to code written in 2015 and 2017, meaning the flaw sat inside the XRP Ledger for nearly a decade before Veria Labs’ AI agent caught it.
Veria Labs noted the network had gone through multiple security audits over the years, yet the flaw slipped through each time. The team believes that happened because the two bugs appeared far less serious when examined separately.
The discovery highlights what AI agents can bring to security work. By analyzing how different bugs interact, they can catch complex vulnerabilities that traditional reviews miss.
RippleX Responded With an Emergency Fix
Veria Labs reported the vulnerability on September 22, and the XRP Ledger team confirmed it on the same day. Developers merged a fix on September 23 and released it on September 25, when more than 80% of validators had upgraded, according to the disclosure.
The team said developers bypassed the network’s usual amendment process to address the critical issue. RippleX also found no evidence that anyone had exploited the vulnerability.
Although Veria Labs praised the team’s response, Daniel’s criticism focused on whether the financial reward reflected the potential severity of the discovery.
His comments raise a broader question about how blockchain companies should compensate researchers who uncover vulnerabilities capable of threatening the integrity of their networks, particularly as AI tools make sophisticated security testing more accessible.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
