Ripple's XRP Ledger Audit Unveils 96 Vulnerabilities Ahead of Release

Ripple's XRP Ledger recently underwent a $550,000 adversarial audit contest run by Web3 security firm Sherlock. The two-week contest uncovered 96 vulnerabilities in the code, including two critical flaws that could have allowed attackers to drain accounts without holding private keys.

The most severe flaw was identified on February 19, 2026, and stemmed from a signature-validation vulnerability in the original Batch amendment. An attacker could construct a transaction containing inner Payment operations targeting a victim account, draining it down to its reserve balance.

Ripple responded with an emergency release of version 3.1.1, which removed support for the original Batch amendment. The replacement, BatchV1_1, shipped in version 3.3.0 with additional authorization guards added.

The second critical vulnerability operated through a subtler mechanism tied to Permission Delegation. A design feature of XRPL transaction processing allowed an attacker to silently bleed a victim account's XRP balance without accessing its keys.