XRP Ledger proposal blocks flash loan attacks, enhancing DeFi security

Flash loans have cost DeFi protocols hundreds of millions of dollars. The XRP Ledger’s answer to this problem is elegant in its simplicity: make them impossible in the first place.

A new draft amendment called AMM Swappable Curves, filed on May 26, 2026, by developers Denis Angell and Roman Thpt, expands the ledger’s automated market maker capabilities while reinforcing a design philosophy that sets XRPL apart from Ethereum-based DeFi.

Why XRPL can’t have flash loans

Here’s the thing about flash loans on Ethereum: they work because the Ethereum Virtual Machine allows composable smart contracts to chain together multiple actions within a single transaction. Borrow millions, manipulate a price oracle, drain a liquidity pool, repay the loan, all in one atomic block.

XRPL doesn’t allow this. Its transactions are atomic in a different sense: each one is a single, self-contained operation. There are no composable intra-transaction calls. You can’t string together a sequence of complex DeFi interactions within one transaction the way you can on Ethereum. The attack vector simply doesn’t exist on XRPL — they’re structurally impossible.

Building DeFi infrastructure without the usual risks

The AMM Swappable Curves amendment is just one piece of a broader DeFi buildout happening on XRPL. The network is simultaneously developing the XLS-66 Lending Protocol and Single Asset Vaults (XLS-65), both of which represent significant steps toward a full-featured decentralized finance stack.

XLS-66 is designed to enable both fixed-term and uncollateralized loans, with credit assessments handled off-chain while liquidity pools operate on-chain. Single Asset Vaults allow users to provide pooled liquidity without the complexity of dual-token deposits that characterize most AMM designs.

A $200,000 bug bounty program ran from October to November 2025, specifically targeting potential vulnerabilities around oracle manipulation and flash loan risks. No significant exploits were found.

The fixCleanup3_1_3 amendment, activated on May 27, 2026, addressed various accounting bugs within the lending protocol and other DeFi functions, including issues related to NFT offers.

The institutional angle

With more than $3 billion in tokenized assets already on the ledger, XRPL has established meaningful traction in the real-world asset tokenization space. The combination of structural flash loan resistance, institutional-grade lending protocols, and a growing tokenized asset base creates a direct pitch to risk-conscious allocators.

The uncollateralized lending component of XLS-66 is particularly relevant here. A DeFi lending protocol that incorporates off-chain credit assessment while maintaining on-chain transparency and settlement bridges a gap that most DeFi platforms haven’t attempted to address. That said, uncollateralized lending introduces its own risks — off-chain credit assessment shifts the risk profile from smart contract exploits to counterparty and credit risk.

Ethereum’s DeFi ecosystem’s composability — the same feature that enables flash loans — is also what makes it powerful for legitimate use cases. XRPL is essentially trading composability for safety. The Lending Protocol’s uptake, the volume flowing through AMM Swappable Curves, and the growth rate of tokenized assets on the ledger will indicate whether XRPL’s security-first approach is converting institutional interest into on-chain activity.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.