XRP Ledger Partial Payments Are Not a Bug: What New Users Need to Know

In a recent post, Hussein Zangana (Vet) highlighted a little-known but longstanding XRP Ledger functionality that might be exploited by bad actors if not implemented correctly.

Vet shared his observation along these lines, noting that now and then, people try to trick exchanges and projects into crediting them more funds than they are sending.

This relates to XRP Ledger Partial Payment, a payment that can succeed while delivering less than the stated amount.

The good news is that this functionality is nowadays very well understood by all large exchanges, Vet noted, but there is a need for new projects to understand it well, as Partial Payments can be used to exploit native integrations with the XRP Ledger to steal money from exchanges and gateways.

“New projects and platforms should always be pointed to the XRPL docs to check the correct fields for crediting funds,” Vet advised, in order to prevent mistakes that might arise from incorrect implementation of the partial payments functionality.

XRP Ledger Partial Payments: What new users should know

The Partial Payment flag on the XRP Ledger allows a payment to succeed by reducing the amount received instead of increasing the amount sent. Partial payments are useful for returning payments without incurring additional costs.

The sender of any payment transaction can enable the “Partial Payment” flag and send a payment that delivers less than the “Amount” field indicates.

The XRP used for transaction costs is always deducted from the sender’s account, irrespective of the transaction type. This transaction fee is not included in the amount; however, this functionality might be exploited.

If a financial institution’s integration with the XRP Ledger assumes that the amount field of a payment is always the full amount delivered, bad actors may exploit this assumption to steal funds from the institution. This exploit can be used against gateways, exchanges, or merchants as long as those institutions’ software does not process partial payments correctly.

According to XRPL docs, the correct way to process incoming payment transactions is to use the “delivered_amount” metadata field, not the “Amount” field. The “delivered_amount” is the amount a payment actually delivered. This way, an institution is never mistaken about how much it actually received.