Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
In a recent post, Hussein Zangana (Vet) highlighted a little-known but longstanding XRP Ledger functionality that might be exploited by bad actors if not implemented correctly.
Vet shared his observation along these lines, noting that now and then, people try to trick exchanges and projects into crediting them more funds than they are sending.
This relates to XRP Ledger Partial Payment, a payment that can succeed while delivering less than the stated amount.
The good news is that this functionality is nowadays very well understood by all large exchanges, Vet noted, but there is a need for new projects to understand it well, as Partial Payments can be used to exploit native integrations with the XRP Ledger to steal money from exchanges and gateways.
"New projects and platforms should always be pointed to the XRPL docs to check the correct fields for crediting funds," Vet advised, in order to prevent mistakes that might arise from incorrect implementation of the partial payments functionality.
XRP Ledger Partial Payments: What new users should know
The Partial Payment flag on the XRP Ledger allows a payment to succeed by reducing the amount received instead of increasing the amount sent. Partial payments are useful for returning payments without incurring additional costs.
The sender of any payment transaction can enable the "Partial Payment" flag and send a payment that delivers less than the "Amount" field indicates.
The XRP used for transaction costs is always deducted from the sender's account, irrespective of the transaction type. This transaction fee is not included in the amount; however, this functionality might be exploited.
If a financial institution's integration with the XRP Ledger assumes that the amount field of a payment is always the full amount delivered, bad actors may exploit this assumption to steal funds from the institution. This exploit can be used against gateways, exchanges, or merchants as long as those institutions' software does not process partial payments correctly.
According to XRPL docs, the correct way to process incoming payment transactions is to use the "delivered_amount" metadata field, not the "Amount" field. The "delivered_amount" is the amount a payment actually delivered. This way, an institution is never mistaken about how much it actually received.
U.Today Editorial Team
Dan Burgin
