Daniel, the CTO at HashLabs, has argued that the $250,000 maximum bug bounty Ripple paid to Veria Labs for identifying a critical XRP Ledger vulnerability was far too low for such a significant find.
Even though the security team patched the flaw before any exploitation took place, Daniel raised concerns about whether the payout truly measured up to the risks involved.
Writing on X under the handle @daniel_wwf, Daniel contended that the maximum reward under Ripple’s bug bounty program was insufficient. He suggested the company ought to have paid at least tenfold that amount, considering the sheer magnitude of the potential fallout.
Daniel Questions Ripple’s $250,000 Bounty
Daniel voiced his discontent after SuperBeetleGamer, co-founder of Veria Labs, shared particulars regarding the vulnerability and how their artificial intelligence tools uncovered it.
According to Veria Labs, their AI agent flagged the issue and verified that one single transaction could have minted an immense quantity of XRP. The researchers successfully replicated the exploit on a standalone server before reporting it through the official XRP Ledger bug bounty framework.
While the researchers walked away with $250,000, Daniel felt the sum fell drastically short, stating Ripple should have appended “at least another zero” to push the total to a minimum of $2.5 million. Furthermore, he questioned what a $250,000 payout signals to other security analysts who unearth major vulnerabilities in prominent blockchain ecosystems.
Vulnerability Could Have Threatened XRP’s Fixed Supply
Veria Labs explained that the exploit stemmed from two distinct bugs that merged to create a much graver threat. Combined, an attacker could have minted 18 trillion XRP in one transaction—roughly 184 times the total circulating supply of 100 billion tokens.
The underlying code dated back to 2015 and 2017, meaning the weakness had remained hidden within the XRP Ledger for almost ten years prior to detection by Veria Labs’ AI agent.
The firm pointed out that despite the network undergoing various security reviews over the years, the flaw continually evaded detection because the two isolated bugs appeared relatively minor on their own.
This finding underscores the value of AI agents in cybersecurity, as their ability to analyze how separate flaws intersect allows them to spot complex vulnerabilities that conventional audits overlook.
RippleX Responded With an Emergency Fix
After Veria Labs submitted their report on September 22, the XRP Ledger team acknowledged it that same day. Developers integrated a patch on September 23 and rolled it out by September 25, at which point over 80% of validators had updated their software, disclosure records show.
To tackle the emergency, developers bypassed the standard network amendment procedure. RippleX additionally confirmed there was zero evidence of malicious actors exploiting the flaw.
Veria Labs commended the speed of the remediation, but Daniel’s objections centered strictly on the adequacy of the financial compensation relative to the vulnerability’s threat level.
His remarks prompt a wider discussion on how blockchain enterprises should compensate researchers who prevent network-threatening exploits, especially as the rise of AI tools makes advanced security testing more widespread.