NFT Bounty

myXRP

Review closed 1 October 2026, 13:50 UTC

NFT Bounty reviewed the live myXRP bridge on Flare and the public desk at myxrp.fi as one surface: 1:1 receipt math, FXRP cash, the immutable ceiling, and the website a stranger actually clicks. Two findings were recorded. Neither was high or critical. Both are closed. The letter reviews the code and stays with the published bridge.

Live bounty desk

The desk is open on the published bridge. The first report the desk can reproduce is the one that is paid. BM-MYX-01 and BM-MYX-02 are closed and pay nothing.

Scope

In scope: MyXRPBridge 0x14b9DD90edaAff6527c1b168550B3FAA15b9F6AF on Flare, the immutable FXRP it names (0xAd552A648C74D49E10027AB8a618A3ad4901c5bE), and the public desk at myxrp.fi — the deposit panel, add-to-wallet, explorer-verify, and token.json. Out of scope: cabinet snapshot credits, the XRP tick, and FAssets agent economics.
Reward

Paid once, in USDC, after the desk reproduces the issue on that bridge. Critical, a stranger can mint, drain, or retarget the locked FXRP: up to 25,000 USDC. High: up to 8,000 USDC. Medium: up to 2,000 USDC. Low: up to 400 USDC. Informational notes are not paid.
Where to send a finding

Email [email protected]. Subject: bounty, and the name of the project published on this site. Include the severity you claim, the steps or a transaction, and what a stranger can take. The desk replies with the USDC payment details only after it accepts the report.

How we read it

NFT Bounty treated myXRP as a live Flare desk: one receipt ledger, one immutable FXRP pipe, one public website. On 1 October 2026 at 13:50 UTC we pulled the runtime at 0x14b9DD90edaAff6527c1b168550B3FAA15b9F6AF, matched selectors and custom errors to MyXRPBridge.sol (Solidity ^0.8.20, overflow checks on), then executed every state-changing path on paper — deposit, withdraw, transfer, transferFrom, approve.

The bridge stores balances directly. deposit(amount) locks that many FXRP and mints the same myXRP. withdraw(amount) burns and returns the same FXRP, or reverts InsufficientLiquidity. maxAssets and underlying are immutable. There is no owner, no operator sweep, no accrual, no proxy, no delegatecall, no selfdestruct, and no hidden minter. deposit and withdraw are nonReentrant.

We then walked the public site. Addresses, naming, and the room figure on myxrp.fi were reviewed as attack surface, not marketing.

Surfaces in this review

MyXRPBridge · Flare C-Chain (14)

0x14b9DD90edaAff6527c1b168550B3FAA15b9F6AF — 1:1 receipt, deposit / withdraw, immutable maxAssets 10,000,000.000000 FXRP, source published, no admin key.
Underlying FXRP

0xAd552A648C74D49E10027AB8a618A3ad4901c5bE — official Flare FAsset, 6 decimals, bound immutable in the constructor.
room()

maxAssets minus totalSupply. On 1 October 2026 at 13:50 UTC the ceiling read from maxAssets() is 10,000,000.000000 FXRP. room() is that ceiling minus totalSupply.
myxrp.fi

Public desk, deposit panel, add-to-wallet, explorer-verify, token.json. In scope for naming and address binding.

What held

Mint on deposit equals the FXRP amount pulled. A zero amount reverts ZeroAmount. Withdraw burns the same amount, then pushes FXRP. If the contract’s FXRP balance is short, the call reverts InsufficientLiquidity and the burn does not stick.

maxAssets is the deposit ceiling and it is immutable. There is no setter and no second minter. deposit and withdraw carry nonReentrant.

The receipt is myXRP on Flare, 1:1 with FXRP locked in this contract. It is not native XRP and not an XRPL IOU. The public record names this bridge.

By the numbers

Total findings: 2
High + critical: 0
Still open: 0
Recommended: Yes

Recorded findings

Two items. Neither could mint a silent receipt or retarget the underlying. Both are closed and re-checked against the bridge at 0x14b9DD90edaAff6527c1b168550B3FAA15b9F6AF.

BM-MYX-01 — Panel painted a desk leftover over bridge room()

Low · remediated

MyXRPBridge.room() returns maxAssets - totalSupply. At review on 1 October 2026 at 13:50 UTC that ceiling is 10,000,000.000000 FXRP, read from maxAssets() on this address. The public deposit panel had been showing a smaller figure taken from the custody pool’s remaining USDT, and labelling it as the contract’s issuance cap. A reader could think the bytecode itself refused deposits that room() still allowed.

Impact was display-only. deposit still reverts CapExceeded only against immutable maxAssets. withdraw still pays 1:1 or reverts InsufficientLiquidity. No extra receipt could be minted from the misread.

Fix (live). The public panel now shows bridge room() and says the 20M USDT line is the custody pool. Re-tested on the production desk: the contract ceiling and the pool ceiling are no longer the same sentence.

BM-MYX-02 — published source a stranger can reopen

Informational · closed

On 1 October 2026 at 13:50 UTC this address is the live bridge. A reader can open it on the Flare explorer and read maxAssets(). The runtime did not exist before 30 September 2026, 15:00 UTC.

name() and symbol() are the constant myXRP, 6 decimals. underlying is immutable FXRP at 0xAd552A648C74D49E10027AB8a618A3ad4901c5bE. There is no admin key and no path that retargets the asset.

Disposition. No bytecode patch. The public record (/explorer-verify/, /token.json, the deposit panel) names this bridge. The ceiling in this letter is maxAssets() on this address, 10,000,000.000000 FXRP.

Public site — myxrp.fi

The website was in scope. We walked the desk as a stranger would: connect wallet, read the deposit panel, add the receipt to a wallet, open explorer-verify, and fetch https://myxrp.fi/token.json. The UI binds this bridge. The official name is myXRP. The room line is room().

What we required of the public surface: explorer-verify and token.json name 0x14b9DD90edaAff6527c1b168550B3FAA15b9F6AF; the panel does not paint the custody-pool leftover as room(); the receipt is myXRP, a 1:1 claim on FXRP locked in this contract. Those checks passed after BM-MYX-01.

Out of scope for this write-up: cabinet snapshot credits and FAssets agent economics. Those do not change the on-chain 1:1 math.

Scope we covered

Receipt vs FXRP cash

deposit mints the same amount, withdraw burns and returns it, or reverts InsufficientLiquidity. Bytecode matched to source.
Immutable ceiling

maxAssets fixed at deploy: 10,000,000.000000 FXRP on this address. room() is the remainder.
No admin surface

No owner, no operator sweep, no accrue, no pause, no proxy. nonReentrant on both cash paths.
Public website

myxrp.fi desk, deposit panel, wallet-add, explorer-verify, token.json, name myXRP.

Verdict

No open high or critical finding. NFT Bounty did not find a hidden mint, an admin drain, or a retargetable underlying. Withdraw can pay only the FXRP this contract still holds. There is no operator key on the bytecode.

Both recorded items are closed. Residual severity is none. Counterparties who need a sealed Flare FXRP receipt can treat the live deployment and myxrp.fi as the deployment that was read.

Related services

Related notes

Looking for a security audit?

Book a scoping talk

Work

Build

Library

Desk

[email protected]