$200K XRPL Attackathon Launches with Immunefi to Boost Security

In Brief

• $200K Attackathon invites global researchers to test XRPL Lending Protocol for vulnerabilities.
• Program runs Oct 27–Nov 29 with 35K+ lines of C++ code open for review and rewards.
• Initiative supports Ripple’s institutional DeFi roadmap with Immunefi-led security testing.

Ripple and Immunefi have launched a $200,000 Attackathon to secure the proposed XRPL Lending Protocol ahead of its mainnet deployment. The program combines adversarial testing and developer education to identify critical vulnerabilities before launch.

The Attackathon runs from October 27 to November 29, following an education phase that started on October 13 via the XRPL Attackathon Academy. Researchers will review over 35,000 lines of C++ code and compete for rewards paid in RLUSD.

The XRPL Lending Protocol supports uncollateralized lending with off-chain credit assessments and on-chain fund management via new standards like XLS-66. The system excludes smart contracts and wrapped assets, instead relying on native XRPL features and institutional-grade design.

Rewards will be unlocked if at least one valid bug is submitted, with a fallback pool of $30,000 available for valid insights. Flat payouts apply, and top contributors can receive additional bonuses through Immunefi’s All Star and Podium programs.

Institutional DeFi Expansion and Transparent Risk Mitigation Lead Initiative

Ripple positions the protocol as a core piece of its institutional DeFi strategy, focused on regulated lending infrastructure and transparent risk management. The protocol will undergo a validator vote by year-end to determine its full launch.

Immunefi brings proven security expertise to the collaboration, with over $180 billion in user funds protected and $25 billion in exploits prevented. Its global community of more than 60,000 researchers is expected to ensure a thorough review.

According to Immunefi, priority targets include liquidation logic, interest accrual, and vault interactions that directly impact solvency. Only bugs submitted with proof-of-concepts in in-scope code will be eligible for rewards.

RippleX confirmed that the academy will remain live after the competition, providing continued access to XRPL resources. The Attackathon reflects Ripple’s proactive approach to securing XRPL’s lending capabilities before public rollout.