Ripple Cuts 10,000 Lines of Dead Code as AI Audits Test XRPL’s New Lending Protocol

Ripple is trimming code and stress-testing new territory on the XRP Ledger at the same time, a two-track cleanup effort that lands just as the network pushes deeper into on-chain lending — arguably the most financially complex feature XRPL has taken on since it launched.

10,000 lines gone

The first track is subtraction. Ripple is removing more than 10,000 lines of code tied to XChainBridge, a feature originally built to move assets between the XRP Ledger and sidechains. The bridge’s usefulness depended heavily on a partnership with Axelar that has since stalled, leaving the code sitting unused on the ledger — and unused code, in security terms, is still attack surface. Every function that exists is a function that can theoretically be exploited, whether or not anyone is actively using it. Stripping it out doesn’t add a feature; it just makes the ledger smaller and, in principle, harder to break.

94 issues, then a fresh AI-only pass

The second track is the Lending Protocol V1.1, XRPL’s new native system for underwritten, fixed-term credit built alongside Single Asset Vaults. Earlier human-led reviews of the lending code turned up 94 valid security issues, including 15 rated critical and 19 rated high-severity — a serious haul for a feature this early in its life. Rather than treat that as the end of the process, Ripple and the security firm Sherlock pushed the same codebase through a second, AI-only pass using Sherlock’s Audit Engine, which runs multiple AI auditors and frontier models tuned specifically for adversarial code review, adjusting depth and focus automatically based on what it’s examining. That review is still in progress, with no findings or completion date announced yet.

Why lending raises the stakes

Lending protocols are a different animal from most of what’s shipped on XRPL before. The Lending Protocol’s architecture combines loan lifecycle management, interest-rate calculations, multi-party fee routing, and credential-based permissions, all interacting with pooled asset vaults — a lot of moving parts where a single logic error can mean real money moving to the wrong place. That complexity is precisely why Ripple has leaned on adversarial testing well beyond a single audit pass. A separate $550,000 contest run by Sherlock earlier this year uncovered 96 vulnerabilities in XRP Ledger code before it ever reached a live wallet, including two critical bugs that could have let an attacker drain accounts without ever holding the victim’s private keys.

The pattern underneath it

None of this is a one-time event. It reflects a security posture Ripple has built around layering adversarial testing — human auditors, paid bug bounty contests, and now AI-driven review — across the entire development lifecycle rather than treating a single audit as sufficient sign-off before shipping. As XRPL takes on more institutional-grade financial functionality, that layered approach is becoming less of a nice-to-have and more of a prerequisite for anyone trusting real capital to the ledger’s newer features.

This article is for informational purposes only and does not constitute financial or investment advice. Smart contract and protocol audits reduce but do not eliminate security risk; always research a protocol’s audit history before committing funds.

Want to understand how blockchain security audits actually work? Explore more on the Bitcoin Academy.