XRP Ledger Partial Payments: A Feature, Not a Bug
In brief
- Partial Payments succeed while delivering less than the Amount field specifies
- New projects must use delivered_amount metadata, not Amount field, to process payments correctly
- Incorrect implementations expose exchanges and merchants to fund theft
- Large exchanges understand the feature; smaller platforms remain vulnerable
How Partial Payments Work
Partial Payments are a legitimate XRP Ledger feature, not a bug or exploit. The sender can enable the Partial Payment flag and send a payment that delivers less than the Amount field indicates. This might sound counterintuitive, but it's by design—and it's been part of the protocol for years.
Transaction fees complicate this further. The XRP used for transaction costs is always deducted from the sender's account, irrespective of the transaction type. If a sender initiates a payment with the Partial Payment flag enabled and insufficient liquidity exists, the transaction can still succeed—just with less XRP reaching the recipient than the Amount field specified.
The Risk for Exchanges and Merchants
Bad actors can exploit incorrect Partial Payment implementation to steal funds from exchanges, gateways, or merchants. If a financial institution's integration with the XRP Ledger assumes that the amount field of a payment is always the full received amount, it can be tricked into crediting users with more funds than actually arrived.
Large exchanges understand Partial Payments well. But there is still a significant gap among new projects and platforms that haven't properly implemented the functionality.
The Fix: Use delivered_amount
The correct way to process incoming payment transactions is to use the delivered_amount metadata field, not the Amount field. According to XRPL documentation, the delivered_amount is the amount a payment actually delivered—ensuring an institution is never mistaken about how much it actually received.
Hussein Zangana (Vet) highlighted this little-known but longstanding XRP Ledger functionality to raise awareness among developers. New projects and platforms should always be pointed to the XRPL docs to check the correct fields for crediting funds.
Partial payments also serve a practical purpose beyond security: they're useful for returning payments without incurring additional costs, making them a feature worth understanding rather than avoiding.
