SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsxrpl-go

xrpl-go

Security & auditing

View repository

Updated 10-16 03:17

About this skill

xrpl-go

Each rule under rules/ is self-contained: a short prose summary of the failure mode and the idiomatic fix, with links to the relevant package source under Peersyst/xrpl-go and a runnable example under examples/. Use the index below to jump to the rule that fits the task.

This skill is not an API reference. For exhaustive type signatures, see pkg.go.dev/github.com/Peersyst/xrpl-go. For XLS protocol specs, use the companion xrpl-standards skill — when work touches AMM, MPT, NFToken, Credentials, Batch, etc., load both skills.

Read first: Security

These four rules are non-negotiable. Funds have been lost over every one of them.

  • security-partial-payment — always credit meta.DeliveredAmount, never the transaction Amount on incoming payments. Partial-payment inflation is the canonical XRPL exchange exploit.
  • security-validate-meta — a preliminary tesSUCCESS from SubmitTxBlob does not mean the tx was applied. Wait for Validated == true on the TxResponse.
  • security-lastledgersequence — never skip client.Autofill(&flatTx) before signing. Autofill is what sets LastLedgerSequence, Sequence, Fee, and NetworkID.
  • security-validate-destination-tag — check the destination's LsfRequireDestTag flag before sending; xrpl-go does not.

What to read when

Map the user's task to the rules to consult before writing code.

User's task or phrase Read these rules
"Credit an incoming payment", "watch for payments", "deposit handler" security-partial-payment, security-validate-meta, ws-lifecycle
"Sign and submit", "send a transaction", "send XRP" tx-autofill-and-sign, tx-submitandwait, security-lastledgersequence, tx-handle-tec-codes
"Set up an exchange deposit address", "custodial account" security-validate-destination-tag, wallet
"Generate a wallet", "key management" wallet
"Connect to rippled", "websocket", "subscribe to a stream" client, ws-lifecycle
"Balance math", "convert XRP / drops", "IOU value" amounts
"Retry a failed tx", "tec error" tx-handle-tec-codes, tx-idempotent-retry, tx-submitandwait
"List trust lines / NFTs / offers", "account_lines", "account_objects" read-pagination-marker
"Audit our xrpl-go integration" Read all security-* rules first, then amounts, wallet, and ws-lifecycle.

Full rule index

Impact tags below match each rule file's frontmatter (CRITICAL, HIGH, MEDIUM).

Security

Amounts & numbers

  • amounts — CRITICAL — Drops + currency.XrpToDrops for XRP, pkg/big-decimal for IOUs, never float64; respect the 15-digit IOU mantissa

Client & connection

  • client — HIGH — rpc.Client for one-shots, websocket.Client for streams; share the client, don't construct per call
  • ws-lifecycle — HIGH — Register handlers, Connect, Subscribe; on shutdown Disconnect. Never call Connect() inside a handler. Don't block in handlers.

Wallet & signing

  • wallet — CRITICAL — wallet.New(crypto.ED25519()) by default; never log Seed / PrivateKey; SetRegularKey for hot wallets

Transactions & submission

  • tx-autofill-and-sign — HIGH — tx.Flatten() → client.Autofill(&flatTx) → wallet.Sign(flatTx) → client.SubmitTxBlobAndWait(blob, false)
  • tx-submitandwait — HIGH — Prefer SubmitTxBlobAndWait / SubmitTxAndWait over SubmitTxBlob / SubmitTx
  • tx-handle-tec-codes — HIGH — Branch on meta.TransactionResult: tec* is applied-but-failed (fee burned, sequence consumed)
  • tx-idempotent-retry — HIGH — Reuse Sequence or a TicketSequence on retry; do not blindly re-Autofill
  • read-pagination-marker — MEDIUM — Loop on Marker for paginated Get* requests

How to use a rule file

Once you have picked a rule from the table above, read its file:

Read <skill-dir>/rules/<rule-name>.md

<skill-dir> resolves to wherever the skill is installed — ~/.claude/skills/xrpl-go/ for a user-level Claude Code install, .claude/skills/xrpl-go/ for a project-level install, /mnt/skills/user/xrpl-go/ on claude.ai, or a plugin-managed path. Don't hard-code the directory; rely on the path the host resolves.

Each rule file contains:

  • Frontmatter — title, impact (CRITICAL / HIGH / MEDIUM), tags, and where applicable xrpl_go_source, upstream_docs, example. Fields with no good link are omitted; treat any of these as optional metadata.
  • Why it matters — one or two sentences explaining the failure mode.
  • The fix — a prose summary of the idiomatic Go pattern, naming the exact xrpl-go types and helpers involved.
  • Notes — edge cases, related amendments, version caveats.
  • See also — explicit links back to the relevant xrpl-go package source and a runnable example under examples/.

Runnable examples

The rules in this skill explain what to do and why. When you need a runnable, end-to-end example — how to actually construct, sign, and submit a transaction — go to the xrpl-go examples directory. They are maintained alongside the library and stay current with the API. Prefer them over inventing example code.

Task Example
Send XRP (RPC + WS variants) send-xrp, send-payment
Partial payment partial-payment
Subscribe to ledger / transaction streams subscription
Multi-signing multisigning
Use Tickets for parallel submission use-tickets
Regular key / disable master set-regular-key
Account / ledger queries queries, ledger
Batch transactions batch
Issued currency / clawback token-issuance, clawback
NFTs nft
MPT mptoken
Faucet faucet

Companion skill: xrpl-standards

If the task touches a specific XLS amendment (AMM, MPT, NFToken, Credentials, Batch, DID, Clawback, Permissioned DEX, etc.), load the xrpl-standards skill alongside this one. That skill holds the raw spec text — field definitions, transaction formats, ledger objects, failure conditions — that this skill deliberately does not duplicate.

Authoritative external resources