XRPL consensus freezes after removing just 12% of central nodes – but a simple tweak triples XRP defense

A new XRP Ledger study says two or three extra peer connections per participating node can sharply raise the number of nodes a targeted attack must remove to disrupt modeled consensus.

XRPL consensus depends on enough trusted validators receiving one another’s messages. A separate peer-to-peer network carries those messages between servers, so extra routes could keep validator traffic moving if an attack removes the network’s busiest hubs.

The Aug. 26 arXiv paper tests random K-out augmentation. K is the number of new undirected edges each participating node creates to peers chosen uniformly at random.

At 60% participation and K=2, the model’s quorum critical attack size rose from 11% to 38% when removals targeted the highest-degree nodes. Under an attack ordered by betweenness centrality, which prioritizes nodes that sit on many shortest paths, the threshold rose from 12% to 33%.

The second change is 2.75 times the baseline. The metric measures the simulated share of nodes removed before fewer than 80% of the model’s validators remain together in one connected component. Observed attack cost remains unknown.

At 80% and 100% participation, K=3 matched or exceeded the modeled robustness produced by roughly 20 to 25 iterations of a more invasive rewiring strategy across the paper’s network and quorum tests. K-out augmentation retained about 0.85 Jaccard similarity with the original edge set, while rewiring fell well below 0.5.

The comparison establishes a graph-level result: a small number of uniformly distributed links can create alternate paths while preserving more of the original network than repeated edge replacement. The authors also released their simulation code and snapshot files for the chosen inputs.

The 2022 XRP Ledger study map behind the gains

The study reuses 1,290 hourly snapshots collected over two months in 2022. It selects the graph closest to the dataset’s average characteristics, producing a representative snapshot with 952 nodes, 15,070 edges and average degree 31.7.

That historical map also anchors the starting thresholds. The Aug. 2026 paper says prior robustness work found that targeted removal of about 20% of nodes compromised network robustness, while about 9% compromised quorum robustness. Random failures required far larger removals. Every percentage describes an attack simulation on the old graph.

Validator placement introduces a second abstraction. The dataset did not identify validators, so each main simulation selected 34 validator nodes uniformly at random and excluded them from direct targeting. Sensitivity tests that favored either high-degree or low-degree nodes for validator assignment preserved the qualitative advantage of random augmentation, although the baseline and incremental gains changed.

The current network supplies different visible inputs. On Aug. 30, Bithomp’s live node explorer displayed 786 discoverable nodes, while its validator view showed 35 members on the displayed XRP Ledger Foundation UNL. The live count changes over time and comes from a third-party measurement rather than the paper’s crawl method. The comparison establishes that the inputs have changed; the direction of present-day resilience remains unresolved.

Public measurement also has documented blind spots. XRPL’s peer crawler can omit the IP address and port when a connected peer is a validator or private peer. Official validator guidance favors private or protected peer paths instead of public access. Those protections impede recursive endpoint discovery while still allowing some validator-adjacent connections to appear.

A fresh study would therefore need more than an updated node count. It would need a topology measurement with explicit coverage limits, a defensible current validator-placement model and the same Monte Carlo tests rerun against that graph.

Connectivity, trust and the operator test

Peer augmentation affects message routes, while XRPL’s trust lists determine whose validation votes count.

An XRPL server’s Unique Node List identifies validators that the operator trusts not to collude. The peer protocol carries transactions, ledger data, proposals and validations across server connections. A validator on a UNL can be reached through the overlay without being one of that server’s direct peers.

Adding two random peers therefore leaves UNL membership, the 80% consensus threshold and trusted-list overlap unchanged. The modeled benefit comes from keeping enough validators connected through alternate routes after central nodes disappear. Validator honesty and trust concentration sit outside that mechanism.

Current software provides several ways to create more links, but deployment has constraints that a graph operation does not capture. Official guidance sets xrpld’s default soft maximum at 21 peers and maintains at least 10 outgoing connections. Raising the soft maximum to a number below 68 does not increase outbound connections by itself because of the software’s incoming-to-outgoing allocation. Fixed peers, peer reservations and manual connections can exceed the soft maximum, according to the project’s reference configuration.

Durable connections across organizations add coordination. A guaranteed peer reservation requires the administrators on both sides to cooperate. Private validators may deliberately route through selected proxies or hubs to reduce public exposure. More peers also consume more bandwidth, an expense highlighted in the official configuration guidance.

The paper models participation subsets from 20% to 100%, showing how the graph responds when only part of the network adds links. Those scenarios supply no empirical adoption rate. Operator willingness, durable peer acceptance, peer-slot contention, bandwidth, privacy, malicious-peer exposure and denial-of-service effects remain unmeasured.

The XRP Ledger study’s contribution is a focused design result: on one representative 2022 XRPL graph, a few uniformly random edges reduced dependence on central nodes and raised modeled attack thresholds with less topology change than extensive rewiring.

Testing that result on mainnet now requires current topology inputs and an operational trial of how random links are selected, accepted and maintained. Until then, 9%, 20%, 33% and 38% remain model outputs. The practical question is whether marginal peer diversity can deliver the same resilience gain on the network XRPL operators run today.