Hi,

Rent a van with the old kind of odometer, five windows of digits, and drive it a hundred thousand and twenty-one miles. The dial reads twenty-one. Nothing is broken: the wheels turned past the last place and started again from zero, and the rental slip prints like any other.

Now build the guard that watches a payment network's money out of those same five windows. When the money overflowed, the guard overflowed with it, in step, and reported an ordinary fee.

It took a machine, after ten years of people reading the code, to see it. And the way the network shipped its fix, with no vote and the patch's source held back, tells you what that machine has changed: a published fix is a map of the flaw, and a machine reads the map faster than anyone can upgrade.

So what happens to an open network when its slow, public way of agreeing on anything is the exact gap a machine now works inside?

Listen:

Apple Podcasts: https://podcasts.apple.com/kg/podcast/plain-strata/id6783455764?i=1000797389049

YouTube: https://youtu.be/RNwsosBiZ8w

The full piece, no need to click through:

On the eighth of October a payment network paid out a quarter of a million dollars, the largest bounty it offers, to the people who had found the worst bug in its history. One of them was a program. It was pointed at the network's source code on the twenty-first of September, and by the next day it had a working exploit on a test network: one transaction that creates about eighteen and a half trillion units of a currency whose supply is fixed, publicly and by design, at one hundred billion. A hundred and eighty-four times everything that exists.

The flaw had been in the code since 2015. The same network runs a second piece of code whose only job is to make this impossible. It inspects every transaction for exactly this crime and throws it out. It inspected this one and reported that nothing had been created.

The watchman was not asleep and nobody lied to it. It added the numbers up on a machine with the same number of windows as the books it was checking. An auditor whose counter has as many digits as the books he checks will certify a theft too large to write down.

Rent a van with a mechanical odometer, five windows of digits, and drive it a hundred thousand and twenty-one miles. The dial reads twenty-one. Nothing broke. The wheels turned past the last place and carried on from zero, because that is what a row of wheels does, and twenty-one is not a wrong reading of a long journey. It is a correct reading of a wheel. The slip the rental desk prints looks completely ordinary.

Every number inside a computer sits in a container of a fixed size. The containers this network keeps money in hold sixty-four binary digits, which is room for about nine quintillion of its smallest unit. That unit is called a drop, one millionth of one XRP, and the whole supply counted in drops is one hundred thousand trillion. So the container holds roughly ninety-two times all the money there is, and for ten years that was a sensible choice, because nothing a real person could do came within a factor of ninety of the edge.

So what does a transaction look like that reaches a ceiling ninety-two times higher than all the money there is?

All of it sits on a ledger, which is a shared spreadsheet that nobody is allowed to lie to, kept in full by every machine that joins the network, and anyone may join. Built into that ledger is an exchange: a public order book where one person posts an offer to swap one asset for another and anyone can take it. A payment is allowed to walk through the book, so paying somebody in a currency you do not hold works by consuming other people's offers on the way.

The engine that walks the book totals up what the payer owes across every offer it consumes, and that total was summed with plain unchecked addition into one of those sixty-four digit containers.

So the exploit is two hundred and fifty-six orders, each asking for about seventy-two billion XRP in exchange for a token the attacker invented that morning, with the amounts chosen so the total lands one place past the edge. One payment consumes all of them. Every seller is credited its full seventy-two billion, because each offer is settled individually at its real amount. The buyer is charged the total, and the total has rolled over to two hundred and fifty-six drops, so he needed a fraction of a penny in his account. Everything else, about eighteen and a half trillion XRP, is new, and the engineers who reproduced it on an isolated server confirmed the new money could be spent.

Nothing about that transaction is subtle. It is the largest number the system can hold, assembled out of thin air in daylight, and the network has a program sitting directly in its path.

That program is an invariant, from the Latin in and variare, not to change: a statement of what must be true no matter what any transaction does. One of them is named XRPNotCreated, and it says the thing a fixed money supply means. Walk every account the transaction touched, add up the changes, and the sum must come out as exactly the negative of the fee, because a fee is destroyed and destruction is the only way the total is ever allowed to move. Any other answer and the transaction is rejected.

Its accumulator was also a sixty-four digit container. Eighteen and a half trillion XRP of credits, added together in the same arithmetic that had just mislaid them, rolled over in turn and landed on a small negative number matching the fee. The guard saw a routine fee burn and waved it through. It was not fooled. It was asked a question it could not hold the answer to, and it answered in the only vocabulary it had.

A second invariant was in the way too, and it caps any single account at the original supply. Spreading the new money over two hundred and fifty-six accounts kept every one of them under the cap. The fix, shipped on the twenty-fifth of September, does two things: the engine's addition now refuses to roll over and fails the payment instead, and the invariant's accumulator was widened to a hundred and twenty-eight binary digits, which no legal set of balance changes can reach. The finder adds a hard detail. The same source code, compiled with overflow trapping switched on, would have crashed the server rather than minted the money, so the behaviour of the ceiling was a build setting.

Every invariant in the system was therefore blind to this by construction. The people reading the code were not.

This is open-source code, read by a paid bug bounty programme and by an organised hacking contest, and the flaw sat there through all of it. Then a company called Veria Labs pointed an automated code auditor at the server software and had a result in about twenty-four hours: both overflows found, the chain between them worked out, an exploit running on a local network. A human checked it the following day, mostly because the claimed impact seemed implausible. The company reports that general purpose coding assistants, pointed at the same vulnerable file after the fact, did not find it.

That claim is the company's own, no method has been published, and the technique is not checkable. What is checkable is everything around it. The network's own disclosure report credits the find, the fix is in the public release history, and the programme paid its maximum critical bounty, which is a third party putting a quarter of a million dollars behind the result rather than behind the story.

A machine that reads a whole codebase for one class of mistake is a new kind of reader in a system that assumed its readers were people. The network worked that out within days, because it then had to decide how to ship the fix.

Changes to how this network processes transactions are normally made by an amendment, from the Latin emendare, to free from fault. The process is deliberately slow. Validators vote by running the new code, and the change takes effect only after more than eighty percent of them have supported it continuously for about two weeks. That is the mechanism stopping any single party, including the company that writes the software, from altering the rules of the money alone.

For this fix it was not used, which the disclosure report says is a first for a transaction processing change in the network's history. The fix took effect on each server the moment that server upgraded. The reason is the shape of the alternative: an amendment vote is conducted in the open on published code, so two weeks of waiting would have been two weeks of a publicly known, cheap, unprivileged way to mint money.

The report writes down the risk it accepted rather than burying it. During the upgrade window, servers on different versions could disagree about the contents of the ledger, validation could stall, and the network could halt. A halt was judged far safer than processing one exploit transaction and producing a ledger nobody could roll back. Validators moved anyway, and more than eighty percent of the default list was running the new version on the day it was released.

They were running code whose fix had not been published. That part was deliberate too.

The binaries shipped while the source of the security changes was held back, and some of the community said what you would expect about an open network shipping software nobody could read. An engineer at RippleX, Mayukha Vadari, gave the reason in a sentence: things have changed with AI, and you cannot slip a critical bug patch into a regular public release any more, because it will be caught and reverse engineered right away.

That is an operational fact rather than a warning. A patch is a published difference between two versions, which is a description of the flaw written by the people who understand it best. The protection was never secrecy. It was the gap between an attacker reading that description and operators finishing their upgrades, and machine assisted analysis closes the gap from the attacker's side without closing it from the operator's, because upgrading is still people and schedules and change windows.

Two concessions came out of one week, then. A vote was set aside and openness was postponed, both to buy time against a reader.

One mistake sits under both of those decisions, and it has a plain name: the auditor's own ceiling. A check built out of the same material as the thing it checks inherits every limit of that material, including the limit being exploited. The invariant here did not merely fail. It failed in the precise manner of the thing it was watching, which is why its answer looked normal.

That is not a chain problem. A weighbridge whose highest reading is the legal load limit cannot detect the overload it was bought to catch. A monitoring program running on the machine it monitors cannot tell I found no violation from I was not running, which is why the hardware industry has started moving that watchdog onto a separate processor. The question in each case is not how clever the check is. It is whether the check can fail in the same way, at the same moment, as its subject.

Nothing was minted on the live network. The engineers found no evidence of exploitation, the flaw is closed, and the invariant did its job every day for ten years.

Most of that is true and the last part is not. The invariant was never tested by the only transaction capable of defeating it, so it was not doing its job for ten years, it was lucky in a range nobody had a reason to leave. The absence of an exploit is a fact about who read the code first, which is exactly what changed this year. And on the one claim everything else depends on, the engineers agree: the created money was spendable.

What the week leaves open is the governance question, and it is not rhetorical. The two week vote exists so that no single party can change the rules of the money. The flaw lasted ten years and fell in a day. If the interval between publishing a change and holding a working exploit is now shorter than the interval it takes a network to agree to anything, the slowness that makes a rule credible is also the window an attacker works in. Faster voting is a smaller majority. Secret patches are not an open network.

The first thing to watch is a search anybody can run today, on any chain, with nobody's permission: find the aggregate checks, the ones that sum across many entries, and ask whether their arithmetic can reach further than the state they audit. The invariant here was not exotic and neither is the question.

The second is whether a different protocol points an automated auditor at its own invariants and publishes what the machine found that its people had not. One result is an anecdote, and the company holding it sells the tool. Two results from two networks would say something about the state of the code this field runs on, and about who is going to be reading it from now on.

The two voices are AI. The research and writing are mine.

Decentralized AI, layer by layer.

Dastan,