Stellar's 2017 Inflation Exploit
Earlier this year Messari published an analysis regarding Ripple’s XRP supply, and the apparent overstatement of XRP market cap by some $6 billion. At the time, we received feedback that we should rigorously apply the same standards to other assets as well. During our subsequent research, we found a number of discrepancies with reported supplies of the top crypto assets. One of our most interesting findings came from an analysis of Stellar Lumens ($XLM), which appears to have suffered from a serious inflation bug in 2017. The bug was exploited, significantly inflationary, and patched with little publicity in April 2017. It appears the bug may have led to the leak of over 2.2 billion Lumens worth nearly $10 million at the time.
Other high-profile inflation bugs have been discovered in crypto over the years.
- Bitcoin suffered from a serious one in its early days that was promptly rolled back, and a separate bug was discovered and patched without incident last year.
- Zcash’s creator, the Electronic Coin Company, recently released a public analysis of a bug they found in their protocol that could have, in theory, allowed for infinite inflation. The company was thorough in its analysis and alerted other affected projects, Komodo and Horizen, well before they revealed the security vulnerability publicly.
- In December 2018, Coinmetrics discovered a bug that allowed a bad actor to surreptitiously pre-mine inflation during the Bitcoin Private protocol’s hard fork. In BTP’s case, the core development team subsequently attempted to remedy the issue by burning coins.
What’s interesting about the Stellar Lumens discovery, though, is the magnitude of the bug (2.2% of total supply and nearly 25% of the circulating supply at the time), and the relatively muted public disclosures at the Stellar Development Foundation (“SDF”) regarding the event. In fact, no media or analysts seem to have previously reported on the bug and the SDF’s allocation/burn of community XLM to offset the inflation event.
