XRP Ledger amendment blocks flash loans, bolstering DeFi security

The XRP Ledger (XRPL) is set to formalize a draft amendment that eliminates flash‑loan attacks, a vulnerability that has cost other blockchains hundreds of millions of dollars. The proposal, called AMM Swappable Curves, was filed on May 26, 2026 and expands the ledger’s automated market maker (AMM) capabilities while reinforcing a design that makes flash loans structurally impossible on XRPL [1].

Key takeaways

• XRPL’s transaction model is atomic but non‑composable, preventing the multi‑step flash‑loan exploits common on Ethereum [2].
• The AMM Swappable Curves amendment is part of a broader DeFi build‑out that includes the XLS‑66 Lending Protocol and Single Asset Vaults (XLS‑65) [1].
• A $200,000 bug bounty in late 2025 found no significant flash‑loan or oracle manipulation vulnerabilities, underscoring the network’s inherent resistance [1].
• Over $3 billion of tokenized assets already reside on XRPL, positioning the ledger for institutional‑grade lending despite the shift of risk to credit assessment [2].
• The fixCleanup3_1_3 amendment, activated May 27, 2026, addressed accounting bugs in the lending protocol and related DeFi functions [1].

Architectural immunity to flash loans

Flash loans thrive on Ethereum because the Ethereum Virtual Machine allows composable smart contracts to chain multiple actions within a single transaction. An attacker can borrow large sums, manipulate price oracles, drain liquidity pools, and repay the loan—all in one atomic block. XRPL’s architecture, by contrast, treats each transaction as a single, self‑contained operation with no intra‑transaction calls. This design means the attack vector simply does not exist on XRPL, making flash loans “structurally impossible” according to the amendment’s authors [2]. The draft amendment, AMM Swappable Curves, builds on this foundation by adding flexible curve options for AMMs while preserving the ledger’s safety‑first stance.

Building a safer DeFi stack

The amendment is one component of a larger effort to deliver a full‑featured DeFi suite on XRPL. The XLS‑66 Lending Protocol aims to support both fixed‑term and uncollateralized loans, relying on off‑chain credit assessments while keeping liquidity pools on‑chain. Single Asset Vaults (XLS‑65) will let users provide liquidity without the complexity of dual‑token deposits typical of many AMM designs. A $200,000 bug bounty run from October to November 2025 specifically targeted oracle manipulation and flash‑loan risks, but reported no major exploits, reinforcing the network’s resilience [1]. Additionally, the fixCleanup3_1_3 amendment, activated on May 27, 2026, patched accounting bugs across the lending protocol and other DeFi functions, including NFT offer handling [1].