XRPL Lending Protocol Under Formal Verification Using Lean 4

XRPL's new lending protocol is undergoing mathematical verification to confirm it complies with fund flow and accounting rules. However, this verification does not eliminate borrower defaults or credit risks. Protocol research firm Common Prefix announced on September 17 that it is formally verifying XRPL's lending protocol using the Lean 4 proof language.

The verification focuses on whether deposit, loan, repayment, and redemption processes adhere to defined accounting and security rules. Unlike standard testing, formal verification involves recreating core logic in a Lean 4 model, defining required properties, then comparing results between the model and actual implementation. The scope is limited to states included in the model and assumptions set by researchers.

Common Prefix has detailed its work on single-asset vaults and lending protocol formal verification in public materials. This does not mean XRPL's lending feature is fully activated on mainnet, as Ripple's open-source documentation describes LendingProtocolV1_1 as an amendment introducing closed vaults and cash-based accounting, requiring mainnet voting and consensus for implementation.

The XRPL Foundation's xrpld 3.4.0 release notes include LendingProtocolV1_1 functionality, but code inclusion does not equate to activation on the ledger. The protocol operates in three stages: subscription (allowing deposits/withdrawals), investment (funds locked for new loans), and redemption (holders cash out shares after loan repayments). This structure reflects when funds are deployed for lending and when redemptions are available.

Accounting methods have also changed. Previously, interest was recognized immediately upon loan execution; LendingProtocolV1_1 uses a cash-based accounting system that records interest only upon actual repayment, reducing the risk of uncollected interest affecting vault assets and share value. However, credit risks remain unchanged.

Prior verification uncovered issues including vault invariants violations, loan repayment validation errors, arithmetic rounding problems, and discrepancies between XLS specifications and implementation. RippleX noted fixes were applied in xrpld 3.1.3 and 3.2.0 releases. This shows formal verification can identify gaps beyond basic pre-release checks.

Verification does not cover states or assumptions outside the model. Credit risk for XRPL's lending protocol remains separate, with credit evaluations and underwriting conducted off-chain by loan brokers. While priority loss absorption capital provided by brokers can absorb some losses, it does not eliminate borrower defaults.

The verification confirms whether internal ledger processes—deposits, loans, repayments, redemptions—follow defined rules, not whether borrowers will repay. This formal verification is a step toward stabilizing accounting and state transitions before actual mainnet activation of the lending feature.