XRPL's new lending protocol is undergoing formal mathematical verification as developers attempt to prove its accounting cannot be drained or rendered insolvent before institutional capital enters the market
Developers are putting XRPL's upcoming native lending protocol through formal mathematical verification, aiming to prove it can't be drained or made insolvent. This extra scrutiny comes as institutional investors consider the network, and as the LendingProtocolV1_1 amendment is included in the latest xrpld server release. Before the protocol goes live, the team is working to ensure its accounting logic holds up in every scenario.
Mathematical proofs and protocol safety
As of September 2026, both LendingProtocol and LendingProtocolV1_1 remain in development and are not yet active on XRPL mainnet, despite their inclusion in the latest server release.
The need for caution is clear. LendingProtocolV1_1 introduces closed-ended lending vaults and cash-basis accounting, both of which raise the stakes if something goes wrong. Depositor assets can be locked for a set investment period, and mistakes in vault balances or loan payments could affect pooled funds across the protocol. The amendment is present in the latest server software, but it still needs approval through XRPL's amendment process before it can be activated.
How the lending protocol works
XRPL's lending protocol lets depositors pool assets, which loan brokers can then use for fixed-term, uncollateralized loans. Credit checks and borrower vetting happen off-chain, while the ledger records origination, repayments, and accounting. The protocol's closed-ended vaults move through three phases: subscription, investment, and redemption. Depositors can add or withdraw assets only during the subscription phase. Once the vault enters investment, funds are locked until redemption. The vault's timeline is set at creation and can't be changed, so participants know exactly how long their funds will be tied up.
For any amendment to become active on XRPL, it must receive over 80% support from trusted validators for two consecutive weeks. This consensus-driven process ensures that even after code is included in a server release, features like LendingProtocolV1_1 are not enabled until the network collectively approves them.
Formal verification uncovers hidden risks
Formal verification isn't a cure-all, but it has already revealed issues that standard testing missed. Earlier, Common Prefix found vault invariant violations, loan-payment assertion failures, rounding errors, and mismatches between written specs and the actual implementation. These discoveries led to fixes in previous xrpld versions, showing the value of mathematical modeling before large amounts of capital are involved.
Still, formal verification has its limits. It can only prove that the modeled properties hold under the assumptions defined. It can't guarantee that every external integration, operational process, or off-chain underwriting decision will be safe. Because the protocol relies on off-chain credit assessment, borrower defaults remain a risk, even if the on-chain accounting is solid. Loan brokers can provide first-loss capital to absorb some defaults, but this doesn't remove credit risk for depositors.
Institutional pressure and market stakes
The commercial pressure is growing. RippleX has named Evernorth, which is preparing to become a Nasdaq-listed XRP treasury company, and VS1.Finance as firms planning to use or build around Single Asset Vaults and the Lending Protocol. This puts more focus on the protocol's accounting rules working as intended before institutional capital is committed. As reported earlier, the XRP Ledger has already faced questions about liquidity and value capture as stablecoin supply and decentralized exchange activity have increased.
Even if LendingProtocolV1_1 passes the validator vote, the protocol's safety will depend on both the strength of its mathematical guarantees and the real-world actions of loan brokers and borrowers. For now, developers are focused on making sure the protocol's internal accounting works as specified, aiming to provide stronger evidence of safety before institutional and retail capital enters the system.
According to protocol documentation, the LendingProtocolV1_1 amendment is included in xrpld version 3.4.0, but activation depends on approval through XRPL's amendment process. The protocol does not require on-chain collateral or automated liquidation, instead relying on off-chain underwriting and broker-supplied first-loss capital. This approach sets XRPL apart from many DeFi lending markets that use overcollateralization and on-chain liquidations to manage risk.
Formal verification in DeFi uses mathematical models to prove that a protocol's logic can't break specified safety or accounting rules, no matter how users interact with it. Unlike traditional software testing, which checks for bugs in expected scenarios, formal verification tries to cover every possible state the system can reach. While this can catch subtle vulnerabilities before launch, it can't account for risks outside the model, such as off-chain credit decisions or operational failures. For users and institutions, it's important to understand these limits: formal verification can strengthen trust in a protocol's internal logic, but it doesn't remove all risk from lending, borrowing, or depositing assets in decentralized systems.
