Ripple's Sherlock audit found 96 vulnerabilities before they reached any wallet

$550,000 community audit competition finds two key vulnerabilities in XRP ledgers that allow accounts to be cleared without private keys

A $550,000 community audit competition discovered two key vulnerabilities in XRP ledgers features that could have cleared user accounts without requiring a private key. The finding reveals significant differences between Ripple's "audit before release" model and the broader cryptocurrency industry's "vulnerability first and then fix" practice.

Summary

The Sherlock two-week audit competition launched on April 13, 2026 found 96 effective vulnerabilities in five proposed XRP ledger amendments, including 2 critical and 6 high-risk vulnerabilities, and none of these amendments were available on the main network. Ripple paid a $309,000 RLUSD reward from a $550,000 prize pool, marking the first collaboration between Sherlock and Ripple and one of the largest audit competitions in 2026.

The most serious discovery was a signature verification flaw in the Batch Amendment, which allowed attackers to perform transactions without having to hold any account's private key. The vulnerability was first discovered on February 19, 2026 by researcher Pranamya Keshkamat and Cantina's AI tool Apex. Another key vulnerability in Permission Delegation allows malicious actors to quietly exhaust the XRP balance by repeatedly charging fees for invalid delegation transactions because the code checks permissions before verifying the signature.

In the first five months of 2026 alone, there were more than 50 DeFi exploit incidents, with losses exceeding US$840 million, a year-on-year increase of 70%. Among them, 70% of the contracts utilized were audited but lacked post-deployment monitoring.

Version release and security challenges

XRP ledger version 3.3.0 was released on August 6, 2026 and includes five proposed amendments and a bundled cleanup patch. On the surface, this is a routine infrastructure update. In fact, the update marks the end of a six-month security challenge: During this period, the team captured two vulnerabilities that cleared accounts, rewritten two full feature implementations from scratch, and paid hundreds of thousands of dollars to external researchers who discovered issues that the internal team missed. This process raises a sharp question for the entire blockchain industry: If Ripple can discover key vulnerabilities before deployment, why do so many people in the cryptocurrency space still regard security audits as a check-off option after launch?

This article will analyze the actual principles of these two key vulnerabilities from a technical perspective, examine the comparison of the "audit-vote-activate" process to the competition chain security model, and assess whether these findings enhance or weaken the XRP ledger as a basis for enterprise-level infrastructure.

Practical findings from Sherlock's competition

The scope of the audit covers five upcoming functions of XRP ledger: bulk transactions, authorization authorization, multi-purpose token (MPT) DEX integration, confidential transfers of MPT, and sponsorship fees and reserves. Sherlock is a Web3 security company that ranks researchers by performance and designs collaborations as confrontational competitions. The audit was launched on April 13, 2026, with a prize pool of 550,000 RLUSD. The competition page on Sherlock's platform tags the cooperation as "XRP Ledger-April 2026 Competition-550,000 RLUSD", indicating that Ripple paid the reward in its own stablecoin.

Within two weeks, reports submitted by participants found a total of 96 valid questions: 2 critical issues, 6 high-risk issues, 29 intermediate-risk issues, and 59 low-risk issues. Ripple allocated 309,000 RLUSD to contributors. The remaining prize pool is used to cover Sherlock's operating costs and low-level discoveries that do not meet the payment threshold.

This competition marks the first formal collaboration between Sherlock and Ripple, and comes as the XRP ledger functional pipeline is expanding faster than ever before. The simultaneous release of five amendments means five different attack surfaces, each with its own transaction logic, authorization model, and encryption requirements. As background, Sherlock's audit competition model has previously been used by protocols such as Aave, Euler, and Olympus DAO, but a one-layer blockchain audit involving C++ protocol-level code is not common for platforms typically associated with Solidity smart contracts.

The severity distribution itself speaks for itself. The 29 medium-risk findings indicate a type of vulnerability that does not individually compromise accounts, but can trigger unexpected behavior in a specific sequence of transactions. The 59 low-risk issues may include code quality issues, documentation gaps, and boundary conditions that may be exploited in hostile conditions. The two critical and six high-risk vulnerabilities represent exploitable vulnerabilities that need to be repaired immediately.

Bulk Trading Amendment Vulnerability: Empty accounts

The most dangerous vulnerability appeared two months before the Sherlock competition. On February 19, 2026, security researcher Pranamya Keshkamat and Cantina's autonomous AI audit tool Apex independently discovered a signature verification flaw in the original bulk transaction amendment, which was still in the validator voting stage at the time.

Technical flaws are very accurate. Bulk transactions allow up to eight operations to be performed atomically under a single external transaction. The signature verification code for external transactions contains an early exit condition that can be met without properly verifying who authorized the internal transaction. In effect, an attacker could construct a bulk transaction that contains internal payment operations against the target account and empty its balance to reserves without having to hold the account's private key. The same logical vulnerability also allows unauthorized AccountSet, TrustSet, or AccountDelete operations.

The vulnerability disclosure report posted on xrpl.org details the mechanism: Signer checks in external transactions can pass without confirming whether the entity submitting the batch actually controls the accounts referenced in internal transactions. This means that atomic features that were meant to improve the user experience could have been weaponized, clearing any account on the network with a single transaction.

RippleX responded with an emergency version. Version 3.1.1, released on February 23, 2026 (four days after discovery), marks the original bulk trading amendment and its accompanying fixBatchInnerSgs as unsupported, preventing the validator from voting on or activating it. Since the amendment has not yet reached the 80% validator threshold required for activation, there is no financial loss. The alternative BatchV1_1 was released with version 3.3.0, removing early exit conditions, adding additional authorization protection, and tightening the scope of signature checks to independently verify the correct signer for each internal transaction.

Silent fee exhaustion vulnerability for delegation of rights

The second key vulnerability operates through a more subtle mechanism. A September 2025 disclosure documented how the original rights delegation implementation allowed an attacker to quietly drain the XRP balance of a target account without having to access the key.

The vulnerability exploits a design feature in XRP ledger transaction processing that has existed since the birth of the network. In XRP ledgers, transactions that fail and return errors of the type "tec" are still charged, while errors that were caught early in the pipeline (before signature verification) are not. This difference exists because a tec class failure indicates that the transaction is correctly formed and signed, but failed for business logic reasons, and the fee is used to prevent spam. The original code for authorization first checks whether the authorization account has relevant permissions before verifying the transaction signature. An attacker can repeatedly submit invalid offline signature transactions with high fees against the entrusted account, and each failed transaction will still be deducted from the victim's balance.

The economic impact will accumulate quickly. Because attackers can set arbitrarily high fees on these transactions, sustained attacks can drain accounts much faster than normal transaction fees imply. Victims will see the balance drop but there are no corresponding outbound payments, making it difficult to diagnose attacks without checking the raw transaction metadata.

The fix reclassifies the related errors from tec class to ter class and reorders the checks so that no fees can be deducted until signature verification passes. The replacement amendment PermissionDelegationV1_1 is marked "No" by default in the 3.3.0 registry, which means that the validator must actively vote to enable it. This conservative default setting reflects the sensitivity of the original vulnerability: Even after the rewrite, Ripple chose to require the validator to explicitly opt-in the feature.

Why two rewritten versions were released in the same release

Packaging two safely rewritten amendments with three new features in one release was a thoughtful choice. Ripple X released version 3.3.0 of xrpld on August 6, 2026, which contains code for all six proposals (including a bundled cleanup amendment called fixCleanup3_3_0), but none of them were activated. According to the XRP ledger amendment process, each proposal must receive more than 80% validator support for two consecutive weeks before it can be launched.

This separation between code availability and feature activation is a structural advantage that most smart contract platforms lack. On Ethereum, deployed contracts take effect as soon as they are linked. On the XRP ledger, code can be released, subject to further review during the voting window, and may still be blocked if the validator loses confidence. A rewritten version of bulk transactions and delegation of rights has passed the Sherlock competition, a Halborn re-audit (no critical or high-risk risks were found), and months of internal testing. The voting period adds another layer of defense before the code touches real money.

This release also eliminates five legacy amendments, including Clawback, fixDisallowIncomingV1, fixInnerObjTemplate, fixNFTokenReserve, and fixUniversal Number, removing dead code paths that may accumulate over time into potential attack surface dead spots.

3.3.0 The five functional amendments in the release represent the most extensive expansion of XRP's ledger capabilities to date. Confidential transfers bring EC-ElGamal encryption and zero-knowledge certificates to multi-purpose tokens, protecting personal balances and transferred amounts from public viewing while retaining compliance access for authorizers. Sponsorship fees allow applications to bear network costs on behalf of users, solving the hands-on friction that prevents consumer-facing applications from decentralizing the network. Dynamic MPT allows issuers to modify token attributes after creation, supporting changing regulatory and business needs. Coupled with rewritten versions of bulk transactions and delegation of rights, these features target a specific audience: regulated financial institutions that require privacy, atomic settlement and delegation operations without sacrificing auditability.

Audit before release vs. Vulnerability before patching

The contrast between Ripple's approach and the broader industry's security record is stark. In the first five months of 2026 alone, there were more than 50 DeFi exploit incidents, resulting in losses of more than US$840 million, a year-on-year increase of 70% compared to the same period in 2025. North Korea-related actors accounted for 76% of global cryptocurrency hacker losses in the first four months of this year. The most shocking statistic is that 70% of contracts used are audited but lack any form of post-deployment monitoring. Only 4% of tracking projects combine audits, active vulnerability bounties and third-party monitoring controls.

The Ethereum ecosystem, where the value of smart contracts is most concentrated, operates based on a fundamentally different security model. Contracts are deployed to the main network through immutable transactions. If a vulnerability is later discovered, options are limited: deploy a new contract and migrate users, implement a proxy upgrade model that introduces its own attack surface, or accept the risk. The 2022 Wormhole Bridge hack cost $320 million because a deprecated verification function still exists in production code. Ronin lost $12 million in exploit in August 2024 because a contract upgrade failed to properly initialize operator weights. In both cases, audits were performed; the failure occurred after deployment.

The KelpDAO hack on April 18, 2026, cost approximately US$293 million, and was the largest single DeFi exploit incident of the year. The Drift protocol exploit on Solana on April 1 resulted in approximately $286 million in losses, the largest ever recorded on the chain. These numbers are not marginal events. They represent the basic failure rate for an industry that has lost $16.69 billion to hacking, bridging vulnerabilities and security incidents, according to DeFiLlama.

The amendment voting process for the XRP ledger reverses this order. The code is released with the version, but the features remain dormant until approved by the validator. During the voting window, researchers, node operators and competitive auditors can check the real-time codebase in full context. If there is a problem, the validator simply refuses the vote. No emergency patches, no migrations, no agency contracts. The bulk trading vulnerability in February 2026 followed this path: the amendment was in the voting stage, the vulnerability was identified, and emergency release prevented activation. Zero financial risk, zero user impact.

This is not to say that the XRP ledger model is perfect. The amendment process applies to protocol-level functions, but does not extend to applications built based on ledgers. Inappropriately coded trust lines or MPT integrations can still lead to financial losses. An 80% validator threshold also carries its own risk: if too few validators are upgraded to new versions, legal security patches may stall. But for core protocol changes, the "audit-vote-activate" process represents a very different security posture than the "deploy and pray" process.

What does this mean for institutional promotion of XRP ledgers

Ripple is building its institutional infrastructure stack at a radical pace in 2026. The $1.25 billion acquisition of multi-asset prime broker Hidden Road (renamed Ripple Prime) provides the company with regulated access to traditional finance. RLUSD reached a market value of US$1.72 billion in less than a year, with trading volume exceeding US$18 billion in the first quarter alone. Goldman Sachs disclosed US$153.8 million in four XRP ETFs. Ripple obtained the Luxembourg Full Electronic Money Institution Licence in February, the UK Financial Conduct Authority in January, and the MiCA Cryptographic Asset Service Provider Licence on July 6.

The organization-level DeFi feature introduced in version 3.3.0 is the technical counterpart of this business development drive. Confidential transfers address the privacy need of banks that cannot disclose transaction details on public books. Sponsorship fees solve the hands-on friction that prevents retail banks from applying decentralized networks. Delegation of rights, once its rewritten version passes the voting process, will implement the controlled access model required by compliance departments.

But institutional adoption depends on trust, and trust in blockchain infrastructure ultimately boils down to a security record. Ripple captured two critical vulnerabilities, rewritten two full feature implementations, paid external researchers $309,000 to discover the vulnerabilities, and still delivered all five features on time-a fact that is more powerful than any single feature. It demonstrates a security culture in which vulnerabilities are rewarded for discovery and release is subject to verification.

Currently, more than 300 financial institutions in 55 countries use RippleNet, with active on-demand liquidity channels covering more than 70 markets. For these institutions, Sherlock's audit results are not abstract concepts. They proved that the code running their cross-border payments had been stress tested by adversarial researchers and that those researchers had financial incentives to undermine it. Ripple's four-phase quantum resistance roadmap, targeted for completion by 2028, further suggests that the company is engineering over an institutional time span measured by ten years rather than deployment cycles.

Objections: Why skeptics are not convinced

The most powerful rebuttal of Sherlock's overinterpretation of the audit goes in two directions.

First, the discovery of 96 vulnerabilities before release can be seen as evidence of both thorough testing and careless development. Both bulk transactions and authority delegation vulnerabilities exist in the original implementation, which means that they passed internal review before being discovered by external researchers. The bulk trading vulnerability in February 2026 was not identified by Ripple's own team, but was discovered by an independent researcher and an AI tool. If external auditors are the main safety net, there may be a quality gap in the internal development process that will ultimately create a vulnerability that is not captured by external reviewers in a timely manner.

Second, the advantage of the XRP ledger amendment model-the ability to block activations during the voting window-is also a speed limit. Ethereum is willing to deploy and iterate, allowing it to achieve innovation speeds unmatched by XRP ledgers. 3.3.0 The five amendments in the version have gone through several months of development and review cycles. The original bulk trading amendment was proposed in 2025. For agreements competing for developer attention in a rapidly changing market, a six-month security pipeline may be too slow to attract the ecosystem of builders that drives network effects.

There are also risks in the centralization of validators. An activation threshold of 80% means relatively few validators, many of which are operated by entities close to Ripple, control whether amendments are online. Critics argue that this is not truly decentralized governance, but rather a carefully planned approval process wrapped in consensus language. When Ripple's own validator voted "yes" on the loan amendment in recent weeks, it highlighted how much influence the company still retains over its nominally decentralized network.

Finally, paying out $309,000 from the $550,000 prize pool raises a practical question about incentive alignment. Rates demanded by top security researchers often exceed the hourly standard paid for competition models. If the most skilled auditors skip the XRP ledger race because the expected remuneration per discovery is lower than that of private collaborations, then the adversarial review may be broad in scope but not deep enough to capture the most complex attack vectors.

These objections carry weight. XRP traded close to $1.03 in late July 2026, approximately 71% below the cyclical high of $3.65 set on July 17, 2025, indicating that the market has not yet fully absorbed the institutional narrative. Whether a security record translates into adoption depends on factors beyond code quality: regulatory clarity, competitive positioning relative to Ethereum's Tier 2 solution, and whether organizations are more concerned about pre-deployment audits or ecosystem size.

Points of concern

Verifier voting thresholds for the five amendments in version 3.3.0: If BatchV1_1 and PermissionDelegationV1_1 receive more than 80% support in the first voting cycle, it means that the verifier is confident in rewriting the code. Stagnation suggests there are still concerns about rewriting code.

Post-activation vulnerability report: The real test of the thoroughness of Sherlock's audit comes after the feature is launched. Zero critical discoveries in the first 90 days will validate the pre-release model; any vulnerabilities after activation will weaken the entire argument.

Adoption of RLUSD on confidential transfers: The use of institutional stablecoins on protected tracks will confirm the need for privacy-compliant settlements. The transaction volume indicator for the first quarter after activation will be the clearest signal of whether banks are ready to use public ledgers with privacy guarantees for transactions.

Sherlock's next XRP ledger collaboration: Whether Ripple continues to adopt adversarial audit competitions for future amendments or returns to traditional private auditing will demonstrate how deeply the pre-release model is embedded in the development culture.

Chain of competition security incident: Every major exploit on Ethereum or Solana that can be traced to a post-deployment vulnerability strengthens the argument of the XRP ledger "audit-vote-activate" process. Such comparisons will only be effective if the industry continues to fail to adopt similar processes.

FAQs

What did Sherlock's audit of the XRP ledger find?

The two-week audit competition was launched on April 13, 2026 and found 96 effective vulnerabilities in five proposed XRP ledger amendments: 2 critical, 6 high-risk, 29 medium-risk and 59 low-risk issues. Ripple paid a $309,000 RLUSD reward from a $550,000 prize pool. All findings are processed before the affected functions are launched on the main network.

What are the key bulk trading amendment vulnerabilities?

The original bulk transaction amendment includes a signature verification flaw that allows an attacker to perform internal transactions from any account without having to hold a private key. This vulnerability is an early exit condition in external transaction signature checks that can be met without proper authorization verification. Researchers Pranamya Keshkamat and Cantina's AI tool Apex was discovered on February 19, 2026. Ripple X was fixed four days later in emergency version 3.1.1.

How does the privilege delegation vulnerability work?

The original implementation first checks the delegation authority and then verifies the transaction signature. On the XRP ledger, fees will still be deducted for transactions that return a "tec" error. An attacker can repeatedly submit invalid transactions with high fees against the delegated account, draining the XRP balance without holding the key. The fix reclassifies error types and reorders verification checks.

Do these vulnerabilities cause financial losses?

No financial losses. Both key vulnerabilities were identified before the respective amendments activated the mainnet. The bulk transaction vulnerability was caught during the voting phase of the validator, and the authority delegation vulnerability was disclosed and fixed before activation. The amendment process for XRP ledgers requires 80% validator support for two consecutive weeks, which provides a structural buffer against exploitation.

What is Sherlock and how does its audit model work?

Sherlock, a Web3 security company, organizes audits as adversarial competitions that rank researchers by performance and provide financial incentives in the prize pool. The XRP ledger cooperation is the first cooperation between Sherlock and Ripple, and it is also one of the largest audit competitions in 2026. Unlike traditional private audits, this model covers a wider range of attack vectors than small internal teams by inviting a wide range of independent security researchers to compete for bounties.

How is the security model of XRP ledgers different from Ethereum?

The amendment process for XRP ledgers separates code deployment from functional activation. The new feature is released with software versions but remains dormant until the validator votes to activate, creating a review window that can capture vulnerabilities without an emergency patch. Ethereum's smart contracts take effect immediately after deployment, and fixing the vulnerability requires deploying new contracts, migrating users, or implementing agent upgrades. In the first five months of 2026, DeFi exploit losses exceeded US$840 million, and 70% of the exploited contracts were audited but lacked post-deployment monitoring.

What features does XRP ledger version 3.3.0 include?

Version 3.3.0 released on August 6, 2026 contains five functional fixes and code for a cleanup patch. Features include: confidential transfers of multi-purpose tokens using zero-knowledge certificates, rewritten atomic multi-operation settlement bulk transactions, rewritten delegated access rights to controlled accounts, rumor fees that allow applications to cover user costs, and dynamic MPT that allows issuers to modify token attributes after creation.

Does this audit mean that XRP ledgers are safe investments?

The Sherlock audit reflects a strict pre-release security process, but code quality is only one of many factors that affect investment results. XRP traded close to US$1.03 in late July 2026, about 71% below the cyclical high, and market performance depends on regulatory developments, institutional adoption rates, competitive dynamics and macroeconomic conditions. This article is an educational analysis and does not constitute investment advice.

Disclaimer: This article was published on August 14, 2026. It is for educational and informational reference only and should not be regarded as financial, investment or legal advice. The cryptocurrency market is highly volatile and extremely risky. Readers should conduct their own research and consult qualified professionals before making any investment decisions.