Attackathon | XRPL Lending Protocol
The XRP Ledger (XRPL) is a decentralized layer 1 blockchain renowned for its decade-long reliability and stability in tokenizing and exchanging crypto-native and real-world assets.
The XLS-66 specification introduces the XRP Ledger-native Lending Protocol, which facilitates straightforward, on-chain, uncollateralised fixed-term loans with pre-set interest terms. Loan liquidity is sourced from pooled funds, while the design relies on off-chain underwriting and risk management to assess borrowers’ creditworthiness.
Live
Triaged by Immunefi
Step-by-step PoC Required
KYC required
Codebase
Documentation
Insight Reporting
Insight reports may be reported to this program and require a PoC. Insights are rewarded according to Immunefi’s Standardized Competition Reward Terms.
Dispute Resolution
If there is any dispute over bug reports between projects and security researchers, Immunefi has final say on validity and severity based on the terms of this program.
Asset Accuracy Assurance
- Bugs found on assets incorrectly listed in-scope will be considered valid and be rewarded.
Private Known Issues Reward Policy
- Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.
Primacy of Impact vs Primacy of Rules
- Ripple/ XRPL adheres to the Primacy of Rules, which means that the whole Attackathon program is run strictly under the terms and conditions stated within this page.
KYC Requirement
Ripple/ XRPL requires Immunefi, through its partner Onfido, to collect and assess SRs’s KYC information to pay for bug submissions. The following information will be required:
- Full name
- Date of birth
- Proof of address (either a redacted bank statement with address or a recent utility bill)
- Copy of Passport or other Government issued ID
Security researchers are required to submit KYC within 14 days of KYC being requested, else their rewards may be forfeited. Immunefi may make exceptions due to extenuating circumstances.
Responsible Publication
-
Whitehats may publish their bug reports after they have been fixed & paid, or closed as invalid, with the following exceptions:
- Bug reports in mediation may not be published until mediation has concluded and the bug report is resolved.
-
Immunefi may publish bug reports submitted to this Audit Competition and a leaderboard of the participants and their earnings.
Feasibility Limitations
- When there is uncertainty about how feasible an attack is Immunefi will use our feasibility limitation standards to determine the severity of the report.
Immunefi Standard Badge
- By adhering to Immunefi’s best practice recommendations, Ripple/ XRPL has satisfied the requirements for the Immunefi Standard Badge.