Ripple, Immunefi Launch $200K Bug Hunt for XRPL’s New Institutional Lending Protocol
Ripple has teamed up with Immunefi to launch the XRPL Lending Protocol Attackathon, a specialized bug-hunting program focused on the XRP Ledger’s proposed institutional lending framework (XLS-66). The initiative aims to rigorously test the protocol’s design, which introduces uncollateralized, fixed-term lending supported by off-chain underwriting and on-ledger settlement mechanisms.
The program combines a two-week academy to educate participants on XRPL’s technical model with a multi-week competition challenging developers and security researchers to uncover potential vulnerabilities. By engaging the broader blockchain security community, Ripple seeks to enhance the reliability and resilience of XLS-66 before institutional deployment, ensuring that the framework meets the highest standards of trust and performance for on-chain lending.
What the program includes
Reward pool & rules
A flat $200,000 pool in RLUSD, unlocking in full if any valid bug is found; otherwise a $30,000 fallback for meaningful findings. “All Star” and “Podium” sub-pools are included. KYC and step-by-step PoCs are required.Timeline
Education (“Attackathon Academy”) from Oct. 13–27 with Q&A, walkthroughs, and Devnet access; the competition starts Oct. 27 (end date listed as Nov. 29 on Immunefi’s blog and Nov. 24 on the program page see Clarifications). Immunefi+1Scope
XLS-66 Lending Protocol plus related components: XLS-65 Single-Asset Vaults, XLS-33 Multi-Purpose Tokens, XLS-70 Credentials, XLS-80 Permissioned Domains (and Deepfreeze/XLS-77 per blog). Priority targets include liquidation, interest accrual, clawback/deepfreeze, administrative attacks, vault interactions, and permissioned access controls.
Why it matters for institutional DeFi
The XRPL lending design avoids smart contracts and on-chain collateral. Credit assessment occurs off-chain using institutional risk models, while funds and repayments are recorded natively on XRPL for auditability. Advocates say this bridges traditional credit markets with on-chain execution while preserving compliance workflows.
Program mechanics and security priorities
In-scope components (high impact)
Vault logic (XLS-65): share accounting, deposits/withdrawals, solvency protections.
Liquidation & interest: debt representation, accrual accuracy, and triggers under stress.
Permissioned access & credentials (XLS-70/XLS-80): preventing bypass of lender/borrower restrictions and domain-gated participation.
Off-chain underwriting, on-ledger settlement
Underwriting: institutions assess creditworthiness off-chain; XRPL records loan terms and repayments, aiming to separate risk modeling from settlement rails.
How the XRPL Lending Protocol Attackathon rewards are structured
Flat pool
$200,000; any valid bug unlocks the full pool.Fallback:
$30,000 if no bugs are found but valid insights are submitted.Distribution
Includes All-Stars/Podium recognition.
Submission rules for the XRPL Lending Protocol Attackathon
PoC
Working proof-of-concept required; step-by-step.Triage
Managed by Immunefi; KYC enforced; C/C++ target code (~35.5k lines).
Context & Analysis
Immunefi’s Attackathon format has become a common pre-deployment hardening step in crypto projects. For XRPL, the emphasis on off-chain underwriting plus ledger-native settlement differs from EVM-based lending markets, shifting the attack surface toward accounting correctness, permissioning, and edge-case state transitions rather than smart-contract logic. A successful program should tighten solvency guarantees and clarify operational guardrails for institutional participants. (Analysis)
Conclusion
The Attackathon serves as a focused effort to test and validate the XRPL lending layer before its institutional launch. By engaging developers and researchers, the program seeks to identify weaknesses within the proposed XLS-66 framework, which enables uncollateralized, fixed-term lending on the XRP Ledger.
Through a blend of structured education, clear testing scope, and a flat bounty model, Ripple and Immunefi aim to surface key security and design issues early. The insights gathered will help refine the standard, ensuring it can securely support real-world credit and lending applications across institutional and enterprise use cases.
FAQs
Q : What is the XRPL Lending Protocol Attackathon?
A : A time-boxed Immunefi competition to find vulnerabilities in XRPL’s proposed lending standard (XLS-66).
Q : When does it run?
A : Education: Oct. 13–27; competition starts Oct. 27. End date is listed as Nov. 29 (blog) vs. Nov. 24 (program page).
Q : How big is the reward pool?
A : $200,000 in RLUSD with All-Stars/Podium sub-pools.
Q : What if no critical bug is found?
A : A $30,000 fallback is distributed to contributors with valid insights.
Q : What are priority targets?
A : Vault solvency, liquidation, interest accrual, deepfreeze/clawback, admin and permissioned access controls.
Q: Does the protocol use smart contracts?
A : No. It’s ledger-native with off-chain underwriting; funds and repayments are recorded directly on XRPL.
Q : Where was this first reported?
A : CoinDesk reported the launch on Oct. 16, 2025.
Facts
Event
Ripple & Immunefi launch bug-hunting Attackathon for XRPL Lending ProtocolDate/Time
2025-10-16T10:20:00+05:00Entities
Ripple; Immunefi; XRP Ledger (XRPL); XLS-66; XLS-65; XLS-33; XLS-70; XLS-80Figures
$200,000 reward pool (RLUSD); 35,498 lines of C/C++ code (target)Quotes
“If even one valid bug is found during the program, the full $200,000 is unlocked and will be distributed.” Immunefi (program blog) ImmunefiSources
Immunefi program blog; Immunefi program page; CoinDesk launch report; RippleX Dev article. DEV Community+3Immunefi+3Immunefi+3