Web3 security firm Halborn announced Tuesday that it had concluded a re-audit of the XRPL Lending Protocol. All reported findings from earlier reviews have been addressed by the core engineering team.
The scope of the re-audit
Between mid-December and January, Halborn conducted a diff-based re-audit. The audit was focused explicitly on the significant codebase modifications introduced since the protocol's prior summer audit.
It was meant to ensure that the updated implementation against the XLS-0066d specification was secure and correct.
As part of the audit, transaction validation logic, state consistency, parameter checks, and access controls have been evaluated.
The approach chosen by the team included specification reviews, code-diff analysis, manual code inspection, and automated static analysis that was meant to evaluate the XRP Ledger's three-stage transaction processing model.
Resolution of findings
Notably, zero critical or high-severity vulnerabilities were found as a result of the audit.
The findings that Halborn has mentioned have been addressed or accepted by Ripple.
Notably, there was a missing validation check that could have allowed a vault's total assets to exceed its configured maximum limit.
Ripple confirmed this was solved, noting that the engineering team had coincidentally caught and fixed the issue internally.
The audit discovered that users could theoretically create a LoanBroker on a frozen vault, thus wasting reserve funds on an unusable setup. Ripple solved this by adding the appropriate freeze check to the transaction's preclaim stage.
Now that all of the reported findings have been formally addressed, acknowledged, or accepted, it is safe to say that a major technical hurdle for the XRPL Lending Protocol is already behind it.
U.Today Editorial Team
Dan Burgin
