Ripple and Immunefi Launch $200K Attackathon to Test XRPL Lending Protocol

Fintech firm Ripple is teaming up with security platform Immunefi to host an “Attackathon”, aimed at rigorously testing its new decentralized finance system on the XRP Ledger (XRPL). The event will offer $200,000 in rewards to participants who identify vulnerabilities in the XRPL Lending Protocol, a platform designed to provide fixed-term, uncollateralized loans.

Running from October 27 to November 29, the Attackathon invites white-hat hackers and security researchers to probe the protocol’s codebase and report vulnerabilities before its official launch. Prior to the bug hunt, Ripple will provide an “Attackathon Academy” from October 13 to October 27, offering educational support, walkthroughs, and Devnet environments to familiarize researchers with XRPL’s architecture.

If a valid exploit is discovered, the full $200,000 reward pool will be unlocked. If no critical vulnerabilities are found, $30,000 will be distributed to participants who submit meaningful findings.

The XRPL Lending Protocol, governed under XLS-66, differs from typical DeFi models. It does not rely on smart contracts, wrapped assets, or on-chain collateral. Instead, creditworthiness is evaluated off-chain, allowing financial institutions to apply their own risk models, while funds and repayments are recorded directly on the ledger. Ripple positions this approach as a bridge between traditional credit markets and on-chain finance, combining transparency with regulatory safeguards. Institutions requiring collateralized structures can still manage those through licensed custodians or tri-party agreements, with the protocol serving as the execution layer.

Researchers will focus on vulnerabilities that could threaten fund safety or protocol solvency, including vault logic, liquidation and interest calculations, and permissioned access controls. Bugs must be reproducible with working proof-of-concepts to qualify for rewards.

The Attackathon will also cover related standards, including XLS-65 (single-asset vaults), XLS-33 (multi-purpose tokens), XLS-70 (credentials), and XLS-80 (permissioned domains), providing a comprehensive review of the protocol’s security landscape.