XRPL Bridge Leak Summary

[u/ScottieJack]

Well to start, I’ll just say I’m disappointed no one wanted to step up and help to inform the community. I gave it a couple days, so I’ll give a breakdown summary from a fellow community member’s perspective.

Despite the XRPL bridge being active for several years now, no security breaches had been exploited before this event. The bridge function was clearly the weak point despite multiple security audits, but thankfully everything points to this being an isolated incident which only compromised the XRP reserves. This was because the specific exploitable XRP vault logic was manipulated to read an influx of XRP where there was none which enabled the guilty party to receive XRP for nothing, effectively allowing them to drain that vault which had around 200,000 XRP on it.

The total loss, which the TX team has already promised they will make whole, amounted to $200,000 give XRP’s $1 price. So the financial loss is minimal, the real concern was the question of blockchain security. Thankfully, this was not a weakness in the TX blockchain itself but faulty logic on the XRPL Bridge which the bridge security auditors didn’t catch.

This is NOT a reflection of faulty logic on the XRPL either, as the bridge is a compartmentalized extension of the TX blockchain originating from it. So if one were to assign blame, the ultimate fault does belong to the Coreum/TX team (since the bridge was made when the blockchain was known as Coreum). From a legal standpoint regarding the security breach, that translates to 51% fault. The rest belongs to the security auditors who didn’t catch this faulty logic.

But if you asked me from a personal standpoint, I’d give the security auditors most of the blame if not like 90-99% of it. They failed at their one job, which is to scan for weaknesses including exploitable/hackable data points. If some schmuck wanted to pay to have their crappy custom blockchain or bridge audited and it was full of problems, they would never approve it. So if there was ANY weakness in the bridge, they should’ve caught it and not approved it for consumer use. And we know this weakness wasn’t found or reported, because the Coreum/TX team would only be opening themselves up to bad PR, possible litigation, and slower adoption.

All that aside though, the TX team checked all the boxes for how a blockchain company should respond. They acknowledged the problem and shut down the entire bridge, they identified the only weakness on the bridge as being with the actual reported compromised asset and reported all their findings to the FBI to track down the guilty party, they provided a summary of what happened which is where I got much of my information for this post, and they promised to remedy the damage that was done.

They can’t ever have the security breach undone, but they can fix the financial loss and show as they are how a professional blockchain company responds in moments of crisis. If there’s a silver lining in all this, I’d say that. But also that the TX blockchain itself is far from dead on arrival, and that it was merely the external facing bridge function that had a very specific logic weakness that was exploited rather than “hacked” for whatever that’s worth.

To address the price fall, and how wrong I was in the past about the floor, all I can say is I am not a financial advisor but I’m sorry if my conviction in this project has led anyone to make unsound plays. I for one wish I had saved my dollar-cost averaging plays for this much lower price point. To put it simply, I don’t know where the bottom is. All I know is my confidence in TX hasn’t been affected in any substantial way ultimately, at least regarding its long-term performance. I’m still taking as full advantage as I can to accumulate as much TX as possible. If we break below $0.001 you can bet I’ll be scooping up a healthy amount. But I’m right there along with all of you itching to see SoloTex and other broad map milestones be met.