XRPL Uses Formal Verification to Secure New Lending Protocol

Developers of the XRP Ledger (XRPL) are applying formal verification techniques to ensure the safety of the upcoming lending market. The effort, led by research firm Common Prefix, uses the Lean 4 theorem‑proving language to model the protocol’s accounting rules and verify that prohibited states cannot be reached.

Why Formal Verification Matters

The latest server release, xrpld 3.4.0, includes the LendingProtocolV1_1 amendment, which introduces closed‑ended lending vaults and cash‑basis accounting. These changes increase the complexity of the protocol’s state space, making traditional testing less reliable. Formal verification recreates the relevant protocol logic in a mathematical model, defines invariants, and checks that the production implementation conforms to those invariants.

Key Features of LendingProtocolV1_1

• Closed‑ended vaults progress through subscription, investment, and redemption phases.
• Deposits are locked during the investment phase, providing a fixed term for loan deployment.
• Cash‑basis accounting records interest only when payments are received, reducing premature income recognition.

Previous Findings and Ongoing Work

During an exploratory verification phase (February–April), Common Prefix identified several issues, including vault invariant violations, loan‑payment assertion failures, rounding errors, and mismatches between the XLS specifications and the code. Those defects were addressed in xrpld versions 3.1.3 and 3.2.0.

The current verification effort focuses on the new amendment before significant depositor capital is committed. An oracle will compare inputs to both the Lean 4 model and the live implementation, highlighting any divergence.

Limitations of the Approach

Formal verification can only guarantee properties that are explicitly modeled. It does not address credit risk, which depends on off‑chain underwriting and borrower repayment behavior. The protocol relies on loan brokers to provide first‑loss capital, but this does not eliminate the risk of borrower defaults.

Next Steps

Validators will decide whether to activate the amendment after the verification work is complete. Successful proofs would strengthen confidence in the ledger’s accounting mechanisms, while the broader credit risk remains a separate concern for participants.