Sherlock Audit Found 96 Bugs in XRP Ledger Before Release

A Sherlock security audit identified 96 bugs in XRP Ledger code before the release reached users, marking one of the more substantial pre-deployment reviews reported for the network's software.

What the Sherlock audit found in XRP Ledger code

The audit was run through Sherlock's competitive review platform, which hosted the contest covering the XRP Ledger codebase. The review targeted the ledger's core software rather than a single application. For related coverage, see World Liberty Financial Gets Preliminary OCC Approval for USD1-Linked National Bank.

According to reporting, the process surfaced 96 bugs before the code shipped to a single wallet. The figure refers to issues flagged during the review window, not confirmed exploits in production. For related coverage, see CIMG Bitcoin Holdings Hit $67.2M as Cash Falls to $5,397.

The release tied to this cycle is documented in the network's own changelog for the rippled 3.3.0 update, which sits at the center of the audited work. For related coverage, see SEC Withdraws Planned Vote on Crypto Custody Rule.

Why finding the bugs before release matters

Catching flaws before deployment means they can be addressed while the code is still in review, rather than after it is running live on validators and in user wallets. That timing is the core value of a pre-release audit.

For a settlement-focused ledger, pre-release discovery lowers the risk that a defect reaches production where funds, transaction processing, or consensus behavior could be affected. The audit functions as a filter between development and live use.

The XRP Ledger operations team pointed to the review through its official channel on X, underscoring that the audit was part of the release process rather than a response to an incident.

What this means for XRP Ledger oversight going forward

Bringing in an external, third-party review adds a layer of scrutiny beyond internal testing, and the reported bug count shows such reviews still surface a meaningful volume of issues even on established infrastructure.

External audits have become a routine trust signal across crypto, similar to how reserve attestations shaped the debate around stablecoin backing when Tether's Big Four audit reported reserves exceeding liabilities. Code review and financial attestation both aim at the same goal: verifiable assurance for users.

That assurance question extends to wallet-level safeguards too, an area highlighted recently when CyberWallet and Passkey users faced a withdrawal cutoff. Release readiness at the protocol layer and reliability at the wallet layer together determine how much users can depend on a network.

The details of severity tiers and how each issue was resolved were not established in the available reporting, so the significance here rests on the scale of the review and its pre-release timing rather than the specific nature of individual bugs.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.