Web3 · Codebase Audit
Ripple
softstack completed a security assessment of Ripple's Multi-Purpose Token (MPT) in October 2024, reporting 4 findings (2 low and 2 informational), of which 3 were resolved or mitigated before the final report. The full report is published in the softstack public audit archive.
Key facts
- Client
- Ripple
- Completed
- Type
- Codebase Audit
- Chains
- XRP Ledger
- Languages
- C++
- Commit
6a7a8c27b9d9- Market cap
- $94.8B as of 2026-10-27
About the project
Ripple builds financial infrastructure for institutions working with both traditional and digital assets. Its products span cross-border payments, custody, prime brokerage, treasury management and tokenisation, alongside RLUSD, a stablecoin aimed at regulated firms. Ripple created the XRP Ledger, an open-source blockchain whose native asset XRP settles payments in seconds.
Scope
Source repositorygithub.com/XRPLF/rippledComponents reviewed
14 modules · 70 files- include/xrpl/basics/MPTAmount.h
- include/xrpl/basics/Number.h
- include/xrpl/basics/XRPAmount.h
- include/xrpl/basics/base_uint.h
- include/xrpl/protocol/AmountConversions.h
- include/xrpl/protocol/Asset.h
- include/xrpl/protocol/Feature.h
- include/xrpl/protocol/Indexes.h
- include/xrpl/protocol/Issue.h
- include/xrpl/protocol/LedgerFormats.h
- include/xrpl/protocol/MPTIssue.h
- include/xrpl/protocol/Protocol.h
- include/xrpl/protocol/SField.h
- include/xrpl/protocol/SOTemplate.h
Findings
3 of 4 findings resolved before the final report.
| ID | Title | Severity | Status |
|---|---|---|---|
6.2.1 | Potential Memory Safety Vulnerability in MPTIssue::getIssuer() Method The MPTIssue::getIssuer() method in the provided code uses memcpy() to extract the AccountID from the MPTID. This implementation assumes a specific memory layout and offset for the AccountID within the MPTID structure. | Low | fixed |
6.2.2 | Potential Race Condition in MPToken Locking/Unlocking Operations The current implementation of the MPTokenIssuanceSet transaction, which handles locking and unlocking of MPTokens, lacks a mechanism to check for conflicts with other ongoing operations on the MPToken or MPTokenIssuance objects. | Low | acknowledged |
6.2.3 | Lack of Explanation for isXRP() Function Behavior The isXRP() function always returns false for MPTID instances, but there is no explanation provided for this behavior. | Informational | fixed |
6.2.4 | Inconsistent Use of Commented-Out Code in requireAuth Function The presence of commented-out code in the requireAuth function reduces the readability and maintainability of the codebase. | Informational | fixed |
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
FAQ
The review reported 4 findings: 2 low and 2 informational. 3 of 4 were resolved or mitigated before the final report.
70 source files were reviewed in github.com/XRPLF/rippled at commit 6a7a8c2. The published report lists every file covered.
This report covers the code as reviewed in October 2024 at commit 6a7a8c2. Any code changed after that point is outside the reviewed scope.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.