`STTx::checkBatchMultiSign` omits the batch-signer's AccountID from the signed data, so a single multi-signer signature authorizes batch entries on every account that has that multi-signer on their SignerList

`book_offers` reports MPT order books with the wrong transfer rate and the wrong global-freeze flag because `getBookPage` calls the IOU-only helpers on `book.out.getIssuer()` / `book.in.getIssuer()`

A holder who deposits a permissioned MPT into an AMM and then self-unauthorizes their MPToken permanently disables the issuer's AMMClawback path for that holder, stranding the issuer's asset in the pool

DelegateSet plants ledger entries in any account's owner directory without consent, permanently disabling AccountDelete for regular accounts and AMMDelete / VaultDelete / LoanBrokerDelete for pseudo-accounts

Disabling confidentiality after a Convert/ConvertBack round-trip strands the holder's public MPT balance

`toAmount` silently drops the caller-supplied rounding mode for MPT, freezing AMM offers for small MPT pools (feature: MPT DEX, XLS-0082)

Destroying or replacing a legacy SignerList over-refunds the sponsor's pre-funded `sfReserveCount` by up to 33 units

PaymentChannelCreate skips the post-deduction balance check whenever a reserve sponsor is present, letting the owner drop below their own reserve and forcing the XRPBalanceChecks invariant to fire as a backstop

TrustSet doApply binds the submitter's tx-level sponsor to the peer's side of an existing trust line when the peer's DefaultRipple drifts, and the AccountObjects sponsored filter ignores which side belongs to the queried account

MPT DEX/LendingProtocol arithmetic helpers throw `std::overflow_error` on extreme MPT/IOU amounts, escape `FlowException`-only handlers, surface as `tecINTERNAL` on DEX/payment paths; uncaught throw in `LoanPay::calculateBaseFee` terminates rippled

Co-signed TicketCreate without a Sponsorship object inflates the sponsorship's ReserveCount on consumption, converting a one-shot ticket grant into standing pre-funded reserve credits

CheckCreate persists an MPT SendMax with mantissa above maxMPTokenAmount, wedging the check until cancelled

applyCreateAccountAttestations binds a sponsor to the door's claim ID without consuming the sponsor's authorized ReserveCount, letting a witness silently inflate the sponsor's reserve burden past their cap (Sponsored Fees and Reserves, XLS-0068)

AMMDeposit checkBalance verifies the sponsor's liquid XRP instead of the depositor's, breaking sponsored XRP deposits

ElGamal decrypt is hard-capped at 1,000,000 while encrypt and on-ledger homomorphic accumulation accept the full uint64 range, permanently stranding any confidential MPT balance above the cap and breaking issuer clawback / auditor verification

Pathfinder constructor silently drops `srcAmount` after the MPT-DEX refactor, so `ripple_path_find` ranks paths with an unbounded source budget and returns suboptimal paths in `convert_all` mode

Payment with tfSponsorCreatedAccount and a non-XRP SendMax skips the sponsor reserve check on the cross-currency / ripple branch

simulate RPC crashes the rippled process via SIGSEGV when SponsorSignature is not a JSON object

[Confidential Transfers for MPT] Inbox poisoning via crafted Send blinding factor drives MergeInbox into the point-at-infinity branch of homomorphicAdd, locking the victim's confidential balance

Multiply-before-divide in unlocked_rewards computation permanently bricks all lending operations

reduce_outflow only modifies the current time segment, making cross-segment deposits and repayments a no-op on the rate limiter

deposit_limit_breached subtracts cash_reserve twice, producing wrong results in every market with accumulated fees

close_pool_reward extracts rewards entitled to unregistered obligations because the num_obligation_reward_managers guard only tracks lazily-created entries

D4 liquidation paybackValue can be inflated or deflated by manipulating the DEX pool spot price, because HF check values debt using oracle-derived sqrtPriceX96 but the actual liquidation execution uses the DEX pool's sqrtPriceX96

Lack of input validation with custom Hub Request Manager permits Spoofing of messages which cause drains of all Funds from Global Escrow

User can inflate share price by not claiming his redeem, causing potential permanent fund loss