rippled reverts reserve defaults that could have voted for a tenfold increase
Serguey Asael Shinder1 min readThe rippled developers merged pull request #8430 on 30 September, restoring the default account and owner reserve settings in the server's fee-voting configuration. The pull request links the change to an audit finding, numbered 3.6 in the report, titled "Default fee-voting configuration can raise account reserves tenfold".
On the XRP Ledger, reserves are set by validator voting. Each validator's configuration carries the values it votes for, and a validator that does not set them explicitly votes for the defaults compiled into the software. The diff shows those defaults in the development branch had become 10 XRP for the base account reserve and 2 XRP for each owned object.
The fix sets them back to 1,000,000 drops and 200,000 drops, that is 1 XRP and 0.2 XRP, the values the change describes as the prior settings. It also adds compile-time checks, static_assert statements, for the default reference fee of 10 drops and for both reserves. If anyone changes one of these defaults again, the build fails with a message asking them to verify that the change is intended.
The pull request does not say whether the higher defaults ever shipped in a release; the change was made in the development branch. It was authored by Timothy Banks and touches two files.
Why it matters
Reserves decide how much XRP an account must lock up to exist and to own objects such as trust lines and offers. A default that quietly votes for a tenfold increase is a governance risk, because a validator that leaves the setting alone votes for whatever the software ships. The new compile-time guard turns an easy-to-miss edit into a build error.