fix: Enforce aggregate MaximumAmount in multi-send MPT

rippleSendMultiMPT used a read-only SLE snapshot (view.read) to check
MaximumAmount per iteration. Since rippleCreditMPT updates a separate
mutable copy (view.peek), the snapshot's sfOutstandingAmount was stale
after the first iteration, allowing the aggregate to exceed
MaximumAmount.

Replace the per-iteration check with a running total that validates
the aggregate against MaximumAmount within the send loop. The old
per-iteration check is retained behind a !fixAssortedFixes gate for
ledger replay compatibility.

.github/scripts/levelization/results/ordering.txt

@@ -43,7 +43,6 @@ libxrpl.tx > xrpl.server
 libxrpl.tx > xrpl.tx
 test.app > test.jtx
 test.app > test.rpc
-test.app > test.shamap
 test.app > test.toplevel
 test.app > test.unit_test
 test.app > xrpl.basics
@@ -59,7 +58,6 @@ test.app > xrpl.protocol
 test.app > xrpl.rdb
 test.app > xrpl.resource
 test.app > xrpl.server
-test.app > xrpl.shamap
 test.app > xrpl.tx
 test.basics > test.jtx
 test.basics > test.unit_test

include/xrpl/basics/Slice.h

@@ -11,7 +11,6 @@
 #include <limits>
 #include <stdexcept>
 #include <string>
-#include <string_view>
 #include <type_traits>
 #include <vector>
 
@@ -232,11 +231,4 @@ makeSlice(std::basic_string<char, Traits, Alloc> const& s)
     return Slice(s.data(), s.size());
 }
 
-template <class Traits>
-Slice
-makeSlice(std::basic_string_view<char, Traits> const& s)
-{
-    return Slice(s.data(), s.size());
-}
-
 }  // namespace xrpl

include/xrpl/proto/xrpl.proto

@@ -244,15 +244,7 @@ message TMGetObjectByHash {
 
 message TMLedgerNode {
   required bytes nodedata = 1;
-
-  // Used when protocol version <2.3. Not set for ledger base data.
-  optional bytes nodeid = 2;
-
-  // Used when protocol version >=2.3. Neither value is set for ledger base data.
-  oneof reference {
-    bytes id = 3;      // Set for inner nodes.
-    uint32 depth = 4;  // Set for leaf nodes.
-  }
+  optional bytes nodeid = 2;  // missing for ledger base data
 }
 
 enum TMLedgerInfoType {

include/xrpl/protocol/detail/features.macro

@@ -16,6 +16,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
+XRPL_FIX    (AssortedFixes, Supported::yes, VoteBehavior::DefaultNo) // PLACEHOLDER
 XRPL_FIX   (PermissionedDomainInvariant, Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (ExpiredNFTokenOfferRemoval, Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (BatchInnerSigs,             Supported::no, VoteBehavior::DefaultNo)

include/xrpl/shamap/SHAMap.h

@@ -16,7 +16,6 @@
 
 #include <set>
 #include <stack>
-#include <tuple>
 #include <vector>
 
 namespace xrpl {
@@ -254,7 +253,7 @@ public:
     bool
     getNodeFat(
         SHAMapNodeID const& wanted,
-        std::vector<std::tuple<SHAMapNodeID, Blob, bool>>& data,
+        std::vector<std::pair<SHAMapNodeID, Blob>>& data,
         bool fatLeaves,
         std::uint32_t depth) const;
 
@@ -281,45 +280,10 @@ public:
     void
     serializeRoot(Serializer& s) const;
 
-    /** Add a root node to the SHAMap during synchronization.
-     *
-     * This function is used when receiving the root node of a SHAMap from a peer during ledger
-     * synchronization. The node must already have been deserialized.
-     *
-     * @param hash The expected hash of the root node.
-     * @param rootNode A deserialized root node to add.
-     * @param filter Optional sync filter to track received nodes.
-     * @return Status indicating whether the node was useful, duplicate, or invalid.
-     *
-     * @note This function expects the rootNode to be a valid, deserialized SHAMapTreeNode. The
-     *       caller is responsible for deserialization and basic validation before calling this
-     *       function.
-     */
     SHAMapAddNode
-    addRootNode(
-        SHAMapHash const& hash,
-        intr_ptr::SharedPtr<SHAMapTreeNode> rootNode,
-        SHAMapSyncFilter const* filter);
-
-    /** Add a known node at a specific position in the SHAMap during synchronization.
-     *
-     * This function is used when receiving nodes from peers during ledger synchronization. The node
-     * is inserted at the position specified by nodeID. The node must already have been
-     * deserialized.
-     *
-     * @param nodeID The position in the tree where this node belongs.
-     * @param treeNode A deserialized tree node to add.
-     * @param filter Optional sync filter to track received nodes.
-     * @return Status indicating whether the node was useful, duplicate, or invalid.
-     *
-     * @note This function expects that the caller has already validated that the nodeID is
-     * consistent with the node's content.
-     */
+    addRootNode(SHAMapHash const& hash, Slice const& rootNode, SHAMapSyncFilter* filter);
     SHAMapAddNode
-    addKnownNode(
-        SHAMapNodeID const& nodeID,
-        intr_ptr::SharedPtr<SHAMapTreeNode> treeNode,
-        SHAMapSyncFilter const* filter);
+    addKnownNode(SHAMapNodeID const& nodeID, Slice const& rawNode, SHAMapSyncFilter* filter);
 
     // status functions
     void
@@ -380,11 +344,11 @@ private:
     intr_ptr::SharedPtr<SHAMapTreeNode>
     fetchNodeNT(SHAMapHash const& hash) const;
     intr_ptr::SharedPtr<SHAMapTreeNode>
-    fetchNodeNT(SHAMapHash const& hash, SHAMapSyncFilter const* filter) const;
+    fetchNodeNT(SHAMapHash const& hash, SHAMapSyncFilter* filter) const;
     intr_ptr::SharedPtr<SHAMapTreeNode>
     fetchNode(SHAMapHash const& hash) const;
     intr_ptr::SharedPtr<SHAMapTreeNode>
-    checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) const;
+    checkFilter(SHAMapHash const& hash, SHAMapSyncFilter* filter) const;
 
     /** Update hashes up to the root */
     void
@@ -456,7 +420,7 @@ private:
     descendAsync(
         SHAMapInnerNode* parent,
         int branch,
-        SHAMapSyncFilter const* filter,
+        SHAMapSyncFilter* filter,
         bool& pending,
         descendCallback&&) const;
 
@@ -465,7 +429,7 @@ private:
         SHAMapInnerNode* parent,
         SHAMapNodeID const& parentID,
         int branch,
-        SHAMapSyncFilter const* filter) const;
+        SHAMapSyncFilter* filter) const;
 
     // Non-storing
     // Does not hook the returned node to its parent

src/libxrpl/ledger/View.cpp

@@ -2507,57 +2507,74 @@ rippleSendMultiMPT(
     beast::Journal j,
     WaiveTransferFee waiveFee)
 {
-    // Safe to get MPT since rippleSendMultiMPT is only called by
-    // accountSendMultiMPT
     auto const& issuer = mptIssue.getIssuer();
 
     auto const sle = view.read(keylet::mptIssuance(mptIssue.getMptID()));
     if (!sle)
         return tecOBJECT_NOT_FOUND;
 
-    // These may diverge
+    // For the issuer-as-sender case, track the running total to validate
+    // against MaximumAmount. The read-only SLE (view.read) is not updated
+    // by rippleCreditMPT, so a per-iteration SLE read would be stale.
+    Number totalSendAmount;
+    auto const maximumAmount = sle->at(~sfMaximumAmount).value_or(maxMPTokenAmount);
+    auto const outstandingAmount = sle->getFieldU64(sfOutstandingAmount);
+
+    // actual accumulates the total cost to the sender (includes transfer
+    // fees for third-party transit sends). takeFromSender accumulates only
+    // the transit portion that is debited to the issuer in bulk after the
+    // loop. They diverge when there are transfer fees.
     STAmount takeFromSender{mptIssue};
     actual = takeFromSender;
 
-    for (auto const& r : receivers)
+    for (auto const& [receiverID, amt] : receivers)
     {
-        auto const& receiverID = r.first;
-        STAmount amount{mptIssue, r.second};
+        STAmount const amount{mptIssue, amt};
 
         if (amount < beast::zero)
-        {
             return tecINTERNAL;  // LCOV_EXCL_LINE
-        }
 
-        /* If we aren't sending anything or if the sender is the same as the
-         * receiver then we don't need to do anything.
-         */
-        if (!amount || (senderID == receiverID))
+        if (!amount || senderID == receiverID)
             continue;
 
         if (senderID == issuer || receiverID == issuer)
         {
-            // if sender is issuer, check that the new OutstandingAmount will
-            // not exceed MaximumAmount
             if (senderID == issuer)
             {
                 XRPL_ASSERT_PARTS(
                     takeFromSender == beast::zero,
                     "rippler::rippleSendMultiMPT",
                     "sender == issuer, takeFromSender == zero");
+
                 auto const sendAmount = amount.mpt().value();
-                auto const maximumAmount = sle->at(~sfMaximumAmount).value_or(maxMPTokenAmount);
-                if (sendAmount > maximumAmount ||
-                    sle->getFieldU64(sfOutstandingAmount) > maximumAmount - sendAmount)
-                    return tecPATH_DRY;
+
+                if (view.rules().enabled(fixAssortedFixes))
+                {
+                    // Post-fixAssortedFixes: aggregate MaximumAmount check
+                    // using a running total.
+                    totalSendAmount += sendAmount;
+                    if (sendAmount > maximumAmount ||
+                        outstandingAmount + totalSendAmount > maximumAmount)
+                        return tecPATH_DRY;
+                }
+                else
+                {
+                    // Pre-fixAssortedFixes: per-iteration MaximumAmount
+                    // check. Reads sfOutstandingAmount from a stale
+                    // view.read() snapshot — incorrect for multi-destination
+                    // sends but retained for ledger replay compatibility.
+                    if (sendAmount > maximumAmount ||
+                        outstandingAmount + sendAmount > maximumAmount)
+                        return tecPATH_DRY;
+                }
             }
 
             // Direct send: redeeming MPTs and/or sending own MPTs.
             if (auto const ter = rippleCreditMPT(view, senderID, receiverID, amount, j))
                 return ter;
             actual += amount;
-            // Do not add amount to takeFromSender, because rippleCreditMPT took
-            // it
+            // Do not add amount to takeFromSender, because rippleCreditMPT
+            // took it.
 
             continue;
         }

src/libxrpl/shamap/SHAMap.cpp

@@ -179,7 +179,7 @@ SHAMap::finishFetch(SHAMapHash const& hash, std::shared_ptr<NodeObject> const& o
 
 // See if a sync filter has a node
 intr_ptr::SharedPtr<SHAMapTreeNode>
-SHAMap::checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) const
+SHAMap::checkFilter(SHAMapHash const& hash, SHAMapSyncFilter* filter) const
 {
     if (auto nodeData = filter->getNode(hash))
     {
@@ -205,7 +205,7 @@ SHAMap::checkFilter(SHAMapHash const& hash, SHAMapSyncFilter const* filter) cons
 // Get a node without throwing
 // Used on maps where missing nodes are expected
 intr_ptr::SharedPtr<SHAMapTreeNode>
-SHAMap::fetchNodeNT(SHAMapHash const& hash, SHAMapSyncFilter const* filter) const
+SHAMap::fetchNodeNT(SHAMapHash const& hash, SHAMapSyncFilter* filter) const
 {
     auto node = cacheLookup(hash);
     if (node)
@@ -318,7 +318,7 @@ SHAMap::descend(
     SHAMapInnerNode* parent,
     SHAMapNodeID const& parentID,
     int branch,
-    SHAMapSyncFilter const* filter) const
+    SHAMapSyncFilter* filter) const
 {
     XRPL_ASSERT(parent->isInner(), "xrpl::SHAMap::descend : valid parent input");
     XRPL_ASSERT(
@@ -347,7 +347,7 @@ SHAMapTreeNode*
 SHAMap::descendAsync(
     SHAMapInnerNode* parent,
     int branch,
-    SHAMapSyncFilter const* filter,
+    SHAMapSyncFilter* filter,
     bool& pending,
     descendCallback&& callback) const
 {

src/libxrpl/shamap/SHAMapNodeID.cpp

@@ -122,9 +122,7 @@ selectBranch(SHAMapNodeID const& id, uint256 const& hash)
 SHAMapNodeID
 SHAMapNodeID::createID(int depth, uint256 const& key)
 {
-    XRPL_ASSERT(
-        depth >= 0 && depth <= SHAMap::leafDepth,
-        "xrpl::SHAMapNodeID::createID : valid branch input");
+    XRPL_ASSERT((depth >= 0) && (depth < 65), "xrpl::SHAMapNodeID::createID : valid branch input");
     return SHAMapNodeID(depth, key & depthMask(depth));
 }
 

src/libxrpl/shamap/SHAMapSync.cpp

@@ -392,7 +392,7 @@ SHAMap::getMissingNodes(int max, SHAMapSyncFilter* filter)
 bool
 SHAMap::getNodeFat(
     SHAMapNodeID const& wanted,
-    std::vector<std::tuple<SHAMapNodeID, Blob, bool>>& data,
+    std::vector<std::pair<SHAMapNodeID, Blob>>& data,
     bool fatLeaves,
     std::uint32_t depth) const
 {
@@ -438,7 +438,7 @@ SHAMap::getNodeFat(
         // Add this node to the reply
         s.erase();
         node->serializeForWire(s);
-        data.emplace_back(std::make_tuple(nodeID, s.getData(), node->isLeaf()));
+        data.emplace_back(std::make_pair(nodeID, s.getData()));
 
         if (node->isInner())
         {
@@ -468,8 +468,7 @@ SHAMap::getNodeFat(
                             // Just include this node
                             s.erase();
                             childNode->serializeForWire(s);
-                            data.emplace_back(
-                                std::make_tuple(childID, s.getData(), childNode->isLeaf()));
+                            data.emplace_back(std::make_pair(childID, s.getData()));
                         }
                     }
                 }
@@ -487,18 +486,8 @@ SHAMap::serializeRoot(Serializer& s) const
 }
 
 SHAMapAddNode
-SHAMap::addRootNode(
-    SHAMapHash const& hash,
-    intr_ptr::SharedPtr<SHAMapTreeNode> rootNode,
-    SHAMapSyncFilter const* filter)
+SHAMap::addRootNode(SHAMapHash const& hash, Slice const& rootNode, SHAMapSyncFilter* filter)
 {
-    XRPL_ASSERT(rootNode, "xrpl::SHAMap::addRootNode : non-null root node");
-    if (!rootNode)
-    {
-        JLOG(journal_.error()) << "Null node received";
-        return SHAMapAddNode::invalid();
-    }
-
     // we already have a root_ node
     if (root_->getHash().isNonZero())
     {
@@ -508,16 +497,14 @@ SHAMap::addRootNode(
     }
 
     XRPL_ASSERT(cowid_ >= 1, "xrpl::SHAMap::addRootNode : valid cowid");
-    if (rootNode->getHash() != hash)
-    {
-        JLOG(journal_.warn()) << "Corrupt node received";
+    auto node = SHAMapTreeNode::makeFromWire(rootNode);
+    if (!node || node->getHash() != hash)
         return SHAMapAddNode::invalid();
-    }
 
     if (backed_)
-        canonicalize(hash, rootNode);
+        canonicalize(hash, node);
 
-    root_ = std::move(rootNode);
+    root_ = node;
 
     if (root_->isLeaf())
         clearSynching();
@@ -534,23 +521,9 @@ SHAMap::addRootNode(
 }
 
 SHAMapAddNode
-SHAMap::addKnownNode(
-    SHAMapNodeID const& nodeID,
-    intr_ptr::SharedPtr<SHAMapTreeNode> treeNode,
-    SHAMapSyncFilter const* filter)
+SHAMap::addKnownNode(SHAMapNodeID const& node, Slice const& rawNode, SHAMapSyncFilter* filter)
 {
-    XRPL_ASSERT(!nodeID.isRoot(), "xrpl::SHAMap::addKnownNode : valid node input");
-    if (nodeID.isRoot())
-    {
-        JLOG(journal_.error()) << "Root node received";
-        return SHAMapAddNode::invalid();
-    }
-    XRPL_ASSERT(treeNode, "xrpl::SHAMap::addKnownNode : non-null tree node");
-    if (!treeNode)
-    {
-        JLOG(journal_.error()) << "Null node received";
-        return SHAMapAddNode::invalid();
-    }
+    XRPL_ASSERT(!node.isRoot(), "xrpl::SHAMap::addKnownNode : valid node input");
 
     if (!isSynching())
     {
@@ -564,14 +537,14 @@ SHAMap::addKnownNode(
 
     while (currNode->isInner() &&
            !safe_downcast<SHAMapInnerNode*>(currNode)->isFullBelow(generation) &&
-           (currNodeID.getDepth() < nodeID.getDepth()))
+           (currNodeID.getDepth() < node.getDepth()))
     {
-        int const branch = selectBranch(currNodeID, nodeID.getNodeID());
+        int const branch = selectBranch(currNodeID, node.getNodeID());
         XRPL_ASSERT(branch >= 0, "xrpl::SHAMap::addKnownNode : valid branch");
         auto inner = safe_downcast<SHAMapInnerNode*>(currNode);
         if (inner->isEmptyBranch(branch))
         {
-            JLOG(journal_.warn()) << "Add known node for empty branch" << nodeID;
+            JLOG(journal_.warn()) << "Add known node for empty branch" << node;
             return SHAMapAddNode::invalid();
         }
 
@@ -587,44 +560,67 @@ SHAMap::addKnownNode(
         if (currNode != nullptr)
             continue;
 
-        if (childHash != treeNode->getHash())
+        auto newNode = SHAMapTreeNode::makeFromWire(rawNode);
+
+        if (!newNode || childHash != newNode->getHash())
         {
             JLOG(journal_.warn()) << "Corrupt node received";
             return SHAMapAddNode::invalid();
         }
 
+        // In rare cases, a node can still be corrupt even after hash
+        // validation. For leaf nodes, we perform an additional check to
+        // ensure the node's position in the tree is consistent with its
+        // content to prevent inconsistencies that could
+        // propagate further down the line.
+        if (newNode->isLeaf())
+        {
+            auto const& actualKey =
+                safe_downcast<SHAMapLeafNode const*>(newNode.get())->peekItem()->key();
+
+            // Validate that this leaf belongs at the target position
+            auto const expectedNodeID = SHAMapNodeID::createID(node.getDepth(), actualKey);
+            if (expectedNodeID.getNodeID() != node.getNodeID())
+            {
+                JLOG(journal_.debug())
+                    << "Leaf node position mismatch: "
+                    << "expected=" << expectedNodeID.getNodeID() << ", actual=" << node.getNodeID();
+                return SHAMapAddNode::invalid();
+            }
+        }
+
         // Inner nodes must be at a level strictly less than 64
         // but leaf nodes (while notionally at level 64) can be
         // at any depth up to and including 64:
         if ((currNodeID.getDepth() > leafDepth) ||
-            (treeNode->isInner() && currNodeID.getDepth() == leafDepth))
+            (newNode->isInner() && currNodeID.getDepth() == leafDepth))
         {
             // Map is provably invalid
             state_ = SHAMapState::Invalid;
             return SHAMapAddNode::useful();
         }
 
-        if (currNodeID != nodeID)
+        if (currNodeID != node)
         {
             // Either this node is broken or we didn't request it (yet)
-            JLOG(journal_.warn()) << "unable to hook node " << nodeID;
+            JLOG(journal_.warn()) << "unable to hook node " << node;
             JLOG(journal_.info()) << " stuck at " << currNodeID;
-            JLOG(journal_.info()) << "got depth=" << nodeID.getDepth()
+            JLOG(journal_.info()) << "got depth=" << node.getDepth()
                                   << ", walked to= " << currNodeID.getDepth();
             return SHAMapAddNode::useful();
         }
 
         if (backed_)
-            canonicalize(childHash, treeNode);
+            canonicalize(childHash, newNode);
 
-        treeNode = prevNode->canonicalizeChild(branch, std::move(treeNode));
+        newNode = prevNode->canonicalizeChild(branch, std::move(newNode));
 
         if (filter)
         {
             Serializer s;
-            treeNode->serializeWithPrefix(s);
+            newNode->serializeWithPrefix(s);
             filter->gotNode(
-                false, childHash, ledgerSeq_, std::move(s.modData()), treeNode->getType());
+                false, childHash, ledgerSeq_, std::move(s.modData()), newNode->getType());
         }
 
         return SHAMapAddNode::useful();

src/libxrpl/tx/transactors/oracle/OracleSet.cpp

@@ -98,7 +98,7 @@ OracleSet::preclaim(PreclaimContext const& ctx)
         return !v || *v == (*sle)[field];
     };
 
-    std::uint32_t adjustReserve = 0;
+    std::int8_t adjustReserve = 0;
     if (sle)
     {
         // update

src/test/app/LedgerNodeHelpers_test.cpp

@@ -1,358 +0,0 @@
-#include <test/shamap/common.h>
-
-#include <xrpld/app/ledger/detail/LedgerNodeHelpers.h>
-
-#include <xrpl/beast/unit_test.h>
-#include <xrpl/protocol/messages.h>
-#include <xrpl/shamap/SHAMap.h>
-#include <xrpl/shamap/SHAMapAccountStateLeafNode.h>
-#include <xrpl/shamap/SHAMapInnerNode.h>
-#include <xrpl/shamap/SHAMapItem.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <bit>
-
-namespace xrpl {
-namespace tests {
-
-class LedgerNodeHelpers_test : public beast::unit_test::suite
-{
-    // Helper function to create a simple SHAMapItem for testing.
-    static boost::intrusive_ptr<SHAMapItem>
-    makeTestItem(std::uint32_t seed)
-    {
-        Serializer s;
-        s.add32(seed);
-        s.add32(seed + 1);
-        s.add32(seed + 2);
-        return make_shamapitem(s.getSHA512Half(), s.slice());
-    }
-
-    // Helper function to serialize a tree node to wire format.
-    static std::string
-    serializeNode(intr_ptr::SharedPtr<SHAMapTreeNode> const& node)
-    {
-        Serializer s;
-        node->serializeForWire(s);
-        auto const slice = s.slice();
-        return std::string(std::bit_cast<char const*>(slice.data()), slice.size());
-    }
-
-    void
-    testValidateLedgerNode()
-    {
-        // In the tests below the validity of the content of the node data and ID fields is not
-        // checked - only that the fields have values when expected. The content of the fields is
-        // verified in the other tests in this file.
-        testcase("validateLedgerNode");
-
-        // Invalid: missing all fields.
-        {
-            protocol::TMLedgerNode node;
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Invalid: missing `nodedata` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodeid("test_nodeid");
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Invalid: missing `nodedata` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_id("test_nodeid");
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Invalid: missing `nodedata` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_depth(1);
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Valid: legacy `nodeid` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_nodeid("test_nodeid");
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Invalid: has both legacy `nodeid` and new `id` fields.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_nodeid("test_nodeid");
-            node.set_id("test_nodeid");
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Invalid: has both legacy `nodeid` and new `depth` fields.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_nodeid("test_nodeid");
-            node.set_depth(5);
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-
-        // Valid: new `id` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_id("test_id");
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Valid: new `depth` field.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_depth(5);
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Valid: `depth` at minimum depth.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_depth(0);
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Valid: `depth` at arbitrary depth between minimum and maximum.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_depth(10);
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Valid: `depth` at maximum depth.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_depth(SHAMap::leafDepth);
-            BEAST_EXPECT(validateLedgerNode(node));
-        }
-
-        // Invalid: `depth` is greater than maximum depth.
-        {
-            protocol::TMLedgerNode node;
-            node.set_nodedata("test_data");
-            node.set_depth(SHAMap::leafDepth + 1);
-            BEAST_EXPECT(!validateLedgerNode(node));
-        }
-    }
-
-    void
-    testGetTreeNode()
-    {
-        testcase("getTreeNode");
-
-        // Valid: inner node. It must have at least one child for `serializeNode` to work.
-        {
-            auto const innerNode = intr_ptr::make_shared<SHAMapInnerNode>(1);
-            auto const childNode = intr_ptr::make_shared<SHAMapInnerNode>(1);
-            innerNode->setChild(0, childNode);
-            auto const innerData = serializeNode(innerNode);
-            auto const result = getTreeNode(innerData);
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT((*result)->isInner());
-        }
-
-        // Valid: leaf node.
-        {
-            auto const leafItem = makeTestItem(12345);
-            auto const leafNode =
-                intr_ptr::make_shared<SHAMapAccountStateLeafNode>(std::move(leafItem), 1);
-            auto const leafData = serializeNode(leafNode);
-            auto result = getTreeNode(leafData);
-            BEAST_EXPECT(result.has_value());
-            BEAST_EXPECT((*result)->isLeaf());
-        }
-
-        // Invalid: empty data.
-        {
-            auto const result = getTreeNode("");
-            BEAST_EXPECT(!result.has_value());
-        }
-
-        // Invalid: garbage data.
-        {
-            auto const result = getTreeNode("invalid");
-            BEAST_EXPECT(!result.has_value());
-        }
-
-        // Invalid: truncated data.
-        {
-            auto const leafItem = makeTestItem(54321);
-            auto const leafNode =
-                intr_ptr::make_shared<SHAMapAccountStateLeafNode>(std::move(leafItem), 1);
-            // Truncate the data to trigger an exception in SHAMapTreeNode::makeAccountState when
-            // the data is used to deserialize the node.
-            uint256 tag;
-            auto const leafData = serializeNode(leafNode).substr(0, tag.bytes - 1);
-            auto const result = getTreeNode(leafData);
-            BEAST_EXPECT(!result.has_value());
-        }
-    }
-
-    void
-    testGetSHAMapNodeID()
-    {
-        testcase("getSHAMapNodeID");
-
-        {
-            // Tests using inner nodes at various depths.
-            auto const innerNode = intr_ptr::make_shared<SHAMapInnerNode>(1);
-            auto const childNode = intr_ptr::make_shared<SHAMapInnerNode>(1);
-            innerNode->setChild(0, childNode);
-            auto const innerData = serializeNode(innerNode);
-
-            // Valid: legacy `nodeid` field at arbitrary depth.
-            {
-                auto const innerDepth = 3;
-                auto const innerID = SHAMapNodeID::createID(innerDepth, uint256{});
-
-                protocol::TMLedgerNode node;
-                node.set_nodedata(innerData);
-                node.set_nodeid(innerID.getRawString());
-                auto const result = getSHAMapNodeID(node, innerNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == innerID);
-            }
-
-            // Valid: new `id` field at minimum depth.
-            {
-                auto const innerDepth = 0;
-                auto const innerID = SHAMapNodeID::createID(innerDepth, uint256{});
-
-                protocol::TMLedgerNode node;
-                node.set_nodedata(innerData);
-                node.set_id(innerID.getRawString());
-                auto const result = getSHAMapNodeID(node, innerNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == innerID);
-            }
-
-            // Invalid: new `depth` field should not be used for inner nodes.
-            {
-                protocol::TMLedgerNode node;
-                node.set_nodedata(innerData);
-                node.set_depth(10);
-                auto const result = getSHAMapNodeID(node, innerNode);
-                BEAST_EXPECT(!result.has_value());
-            }
-        }
-
-        {
-            // Tests using leaf nodes at various depths.
-            auto const leafItem = makeTestItem(12345);
-            auto const leafNode = intr_ptr::make_shared<SHAMapAccountStateLeafNode>(leafItem, 1);
-            auto const leafData = serializeNode(leafNode);
-            auto const leafKey = leafItem->key();
-
-            // Valid: legacy `nodeid` field at arbitrary depth.
-            {
-                auto const leafDepth = 5;
-                auto const leafID = SHAMapNodeID::createID(leafDepth, leafKey);
-
-                protocol::TMLedgerNode ledgerNode;
-                ledgerNode.set_nodedata(leafData);
-                ledgerNode.set_nodeid(leafID.getRawString());
-                auto result = getSHAMapNodeID(ledgerNode, leafNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == leafID);
-            }
-
-            // Invalid: new `id` field should not be used for leaf nodes.
-            {
-                auto const leafDepth = 5;
-                auto const leafID = SHAMapNodeID::createID(leafDepth, leafKey);
-
-                protocol::TMLedgerNode ledgerNode;
-                ledgerNode.set_nodedata(leafData);
-                ledgerNode.set_id(leafID.getRawString());
-                auto result = getSHAMapNodeID(ledgerNode, leafNode);
-                BEAST_EXPECT(!result.has_value());
-            }
-
-            // Valid: new `depth` field at minimum depth.
-            {
-                auto const leafDepth = 0;
-                auto const leafID = SHAMapNodeID::createID(leafDepth, leafKey);
-
-                protocol::TMLedgerNode node;
-                node.set_nodedata(leafData);
-                node.set_depth(leafDepth);
-                auto result = getSHAMapNodeID(node, leafNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == leafID);
-            }
-
-            // Valid: new `depth` field at arbitrary depth between minimum and maximum.
-            {
-                auto const leafDepth = 10;
-                auto const leafID = SHAMapNodeID::createID(leafDepth, leafKey);
-
-                protocol::TMLedgerNode ledgerNode;
-                ledgerNode.set_nodedata(leafData);
-                ledgerNode.set_depth(leafDepth);
-                auto result = getSHAMapNodeID(ledgerNode, leafNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == leafID);
-            }
-
-            // Valid: new `depth` field at maximum depth.
-            // Note that we do not test a depth greater than the maximum depth, because the proto
-            // message is assumed to have been validated by the time the getSHAMapNodeID function is
-            // called.
-            {
-                auto const leafDepth = SHAMap::leafDepth;
-                auto const leafID = SHAMapNodeID::createID(leafDepth, leafKey);
-
-                protocol::TMLedgerNode node;
-                node.set_nodedata(leafData);
-                node.set_depth(leafDepth);
-                auto result = getSHAMapNodeID(node, leafNode);
-                BEAST_EXPECT(result.has_value());
-                BEAST_EXPECT(*result == leafID);
-            }
-
-            // Invalid: legacy `nodeid` field where the node ID is inconsistent with the key.
-            {
-                auto const otherItem = makeTestItem(54321);
-                auto const otherNode =
-                    intr_ptr::make_shared<SHAMapAccountStateLeafNode>(otherItem, 1);
-                auto const otherData = serializeNode(otherNode);
-                auto const otherKey = otherItem->key();
-                auto const otherDepth = 1;
-                auto const otherID = SHAMapNodeID::createID(otherDepth, otherKey);
-
-                protocol::TMLedgerNode ledgerNode;
-                ledgerNode.set_nodedata(otherData);
-                ledgerNode.set_nodeid(otherID.getRawString());
-                auto result = getSHAMapNodeID(ledgerNode, leafNode);
-                BEAST_EXPECT(!result.has_value());
-            }
-        }
-    }
-
-public:
-    void
-    run() override
-    {
-        testValidateLedgerNode();
-        testGetTreeNode();
-        testGetSHAMapNodeID();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(LedgerNodeHelpers, app, xrpl);
-
-}  // namespace tests
-}  // namespace xrpl

src/test/app/MPToken_test.cpp

@@ -3272,6 +3272,90 @@ class MPToken_test : public beast::unit_test::suite
         mptAlice.claw(alice, bob, 1, tecNO_PERMISSION);
     }
 
+    void
+    testMultiSendMaximumAmount(FeatureBitset features)
+    {
+        // Verify that rippleSendMultiMPT correctly enforces MaximumAmount
+        // when the issuer sends to multiple receivers. Pre-fixAssortedFixes,
+        // a stale view.read() snapshot caused per-iteration checks to miss
+        // aggregate overflows. Post-fix, a running total is used instead.
+        testcase("Multi-send MaximumAmount enforcement");
+
+        using namespace test::jtx;
+
+        Account const issuer("issuer");
+        Account const alice("alice");
+        Account const bob("bob");
+
+        std::uint64_t constexpr maxAmt = 150;
+        Env env{*this, features};
+
+        MPTTester mptt(env, issuer, {.holders = {alice, bob}});
+        mptt.create({.maxAmt = maxAmt, .ownerCount = 1, .flags = tfMPTCanTransfer});
+        mptt.authorize({.account = alice});
+        mptt.authorize({.account = bob});
+
+        Asset const asset{MPTIssue{mptt.issuanceID()}};
+
+        // Each test case creates a fresh ApplyView and calls
+        // accountSendMulti from the issuer to the given receivers.
+        auto const runTest = [&](MultiplePaymentDestinations const& receivers,
+                                 TER expectedTer,
+                                 std::optional<std::uint64_t> expectedOutstanding,
+                                 std::string const& label) {
+            ApplyViewImpl av(&*env.current(), tapNONE);
+            auto const ter =
+                accountSendMulti(av, issuer.id(), asset, receivers, env.app().journal("View"));
+            BEAST_EXPECTS(ter == expectedTer, label);
+
+            // Only verify OutstandingAmount on success — on error the
+            // view may contain partial state and must be discarded.
+            if (expectedOutstanding)
+            {
+                auto const sle = av.peek(keylet::mptIssuance(mptt.issuanceID()));
+                if (!BEAST_EXPECT(sle))
+                    return;
+                BEAST_EXPECTS(sle->getFieldU64(sfOutstandingAmount) == *expectedOutstanding, label);
+            }
+        };
+
+        using R = MultiplePaymentDestinations;
+
+        // Post-amendment: aggregate check with running total
+        runTest(
+            R{{alice.id(), 100}, {bob.id(), 100}},
+            tecPATH_DRY,
+            std::nullopt,
+            "aggregate exceeds max");
+
+        runTest(R{{alice.id(), 75}, {bob.id(), 75}}, tesSUCCESS, maxAmt, "aggregate at boundary");
+
+        runTest(R{{alice.id(), 50}, {bob.id(), 50}}, tesSUCCESS, 100, "aggregate within limit");
+
+        runTest(
+            R{{alice.id(), 150}, {bob.id(), 0}},
+            tesSUCCESS,
+            maxAmt,
+            "one receiver at max, other zero");
+
+        runTest(
+            R{{alice.id(), 151}, {bob.id(), 0}},
+            tecPATH_DRY,
+            std::nullopt,
+            "one receiver exceeds max, other zero");
+
+        // Pre-amendment: the stale per-iteration check allows each
+        // individual send (100 <= 150) even though the aggregate (200)
+        // exceeds MaximumAmount. Preserved for ledger replay.
+        env.disableFeature(fixAssortedFixes);
+        env.close();
+        runTest(
+            R{{alice.id(), 100}, {bob.id(), 100}},
+            tesSUCCESS,
+            200,
+            "pre-amendment allows over-send");
+    }
+
 public:
     void
     run() override
@@ -3279,6 +3363,7 @@ public:
         using namespace test::jtx;
         FeatureBitset const all{testable_amendments()};
 
+        testMultiSendMaximumAmount(all);
         // MPTokenIssuanceCreate
         testCreateValidation(all - featureSingleAssetVault);
         testCreateValidation(all - featurePermissionedDomains);

src/test/overlay/ProtocolVersion_test.cpp

@@ -66,8 +66,8 @@ public:
                 negotiateProtocolVersion("RTXP/1.2, XRPL/2.0, XRPL/2.1") == make_protocol(2, 1));
             BEAST_EXPECT(negotiateProtocolVersion("XRPL/2.2") == make_protocol(2, 2));
             BEAST_EXPECT(
-                negotiateProtocolVersion("RTXP/1.2, XRPL/2.3, XRPL/2.4, XRPL/999.999") ==
-                make_protocol(2, 3));
+                negotiateProtocolVersion("RTXP/1.2, XRPL/2.2, XRPL/2.3, XRPL/999.999") ==
+                make_protocol(2, 2));
             BEAST_EXPECT(negotiateProtocolVersion("XRPL/999.999, WebSocket/1.0") == std::nullopt);
             BEAST_EXPECT(negotiateProtocolVersion("") == std::nullopt);
         }

src/test/shamap/SHAMapSync_test.cpp

@@ -103,17 +103,14 @@ public:
         destination.setSynching();
 
         {
-            std::vector<std::tuple<SHAMapNodeID, Blob, bool>> a;
+            std::vector<std::pair<SHAMapNodeID, Blob>> a;
 
             BEAST_EXPECT(source.getNodeFat(SHAMapNodeID(), a, rand_bool(eng_), rand_int(eng_, 2)));
 
             unexpected(a.empty(), "NodeSize");
 
-            auto node = SHAMapTreeNode::makeFromWire(makeSlice(std::get<1>(a[0])));
-            if (!node)
-                fail("", __FILE__, __LINE__);
-            BEAST_EXPECT(
-                destination.addRootNode(source.getHash(), std::move(node), nullptr).isGood());
+            BEAST_EXPECT(destination.addRootNode(source.getHash(), makeSlice(a[0].second), nullptr)
+                             .isGood());
         }
 
         do
@@ -127,7 +124,7 @@ public:
                 break;
 
             // get as many nodes as possible based on this information
-            std::vector<std::tuple<SHAMapNodeID, Blob, bool>> b;
+            std::vector<std::pair<SHAMapNodeID, Blob>> b;
 
             for (auto& it : nodesMissing)
             {
@@ -149,10 +146,7 @@ public:
                 // Don't use BEAST_EXPECT here b/c it will be called a
                 // non-deterministic number of times and the number of tests run
                 // should be deterministic
-                auto node = SHAMapTreeNode::makeFromWire(makeSlice(std::get<1>(b[i])));
-                if (!node)
-                    fail("", __FILE__, __LINE__);
-                if (!destination.addKnownNode(std::get<0>(b[i]), std::move(node), nullptr)
+                if (!destination.addKnownNode(b[i].first, makeSlice(b[i].second), nullptr)
                          .isUseful())
                     fail("", __FILE__, __LINE__);
             }

src/xrpld/app/ledger/InboundLedger.h

@@ -9,7 +9,6 @@
 
 #include <mutex>
 #include <set>
-#include <string_view>
 #include <utility>
 
 namespace xrpl {
@@ -132,16 +131,16 @@ private:
     processData(std::shared_ptr<Peer> peer, protocol::TMLedgerData& data);
 
     bool
-    takeHeader(std::string_view data);
+    takeHeader(std::string const& data);
 
     void
-    receiveNode(protocol::TMLedgerData& packet, SHAMapAddNode& san);
+    receiveNode(protocol::TMLedgerData& packet, SHAMapAddNode&);
 
     bool
-    takeTxRootNode(std::string_view data, SHAMapAddNode& san);
+    takeTxRootNode(Slice const& data, SHAMapAddNode&);
 
     bool
-    takeAsRootNode(std::string_view data, SHAMapAddNode& san);
+    takeAsRootNode(Slice const& data, SHAMapAddNode&);
 
     std::vector<uint256>
     neededTxHashes(int max, SHAMapSyncFilter* filter) const;

src/xrpld/app/ledger/detail/InboundLedger.cpp

@@ -3,7 +3,6 @@
 #include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/TransactionStateSF.h>
-#include <xrpld/app/ledger/detail/LedgerNodeHelpers.h>
 #include <xrpld/app/main/Application.h>
 #include <xrpld/overlay/Overlay.h>
 
@@ -769,7 +768,7 @@ InboundLedger::filterNodes(
 */
 // data must not have hash prefix
 bool
-InboundLedger::takeHeader(std::string_view data)
+InboundLedger::takeHeader(std::string const& data)
 {
     // Return value: true=normal, false=bad data
     JLOG(journal_.trace()) << "got header acquiring ledger " << hash_;
@@ -856,31 +855,20 @@ InboundLedger::receiveNode(protocol::TMLedgerData& packet, SHAMapAddNode& san)
     {
         auto const f = filter.get();
 
-        for (auto const& ledger_node : packet.nodes())
+        for (auto const& node : packet.nodes())
         {
-            auto treeNode = getTreeNode(ledger_node.nodedata());
-            if (!treeNode)
-            {
-                JLOG(journal_.warn()) << "Got invalid node data";
-                san.incInvalid();
-                return;
-            }
+            auto const nodeID = deserializeSHAMapNodeID(node.nodeid());
 
-            auto const nodeID = getSHAMapNodeID(ledger_node, *treeNode);
             if (!nodeID)
-            {
-                JLOG(journal_.warn()) << "Got invalid node id";
-                san.incInvalid();
-                return;
-            }
+                throw std::runtime_error("data does not properly deserialize");
 
             if (nodeID->isRoot())
             {
-                san += map.addRootNode(rootHash, std::move(*treeNode), f);
+                san += map.addRootNode(rootHash, makeSlice(node.nodedata()), f);
             }
             else
             {
-                san += map.addKnownNode(*nodeID, std::move(*treeNode), f);
+                san += map.addKnownNode(*nodeID, makeSlice(node.nodedata()), f);
             }
 
             if (!san.isGood())
@@ -920,7 +908,7 @@ InboundLedger::receiveNode(protocol::TMLedgerData& packet, SHAMapAddNode& san)
     Call with a lock
 */
 bool
-InboundLedger::takeAsRootNode(std::string_view data, SHAMapAddNode& san)
+InboundLedger::takeAsRootNode(Slice const& data, SHAMapAddNode& san)
 {
     if (failed_ || mHaveState)
     {
@@ -936,17 +924,9 @@ InboundLedger::takeAsRootNode(std::string_view data, SHAMapAddNode& san)
         // LCOV_EXCL_STOP
     }
 
-    auto treeNode = getTreeNode(data);
-    if (!treeNode)
-    {
-        JLOG(journal_.warn()) << "Got invalid node data";
-        san.incInvalid();
-        return false;
-    }
-
     AccountStateSF filter(mLedger->stateMap().family().db(), app_.getLedgerMaster());
-    san += mLedger->stateMap().addRootNode(
-        SHAMapHash{mLedger->header().accountHash}, std::move(*treeNode), &filter);
+    san +=
+        mLedger->stateMap().addRootNode(SHAMapHash{mLedger->header().accountHash}, data, &filter);
     return san.isGood();
 }
 
@@ -954,7 +934,7 @@ InboundLedger::takeAsRootNode(std::string_view data, SHAMapAddNode& san)
     Call with a lock
 */
 bool
-InboundLedger::takeTxRootNode(std::string_view data, SHAMapAddNode& san)
+InboundLedger::takeTxRootNode(Slice const& data, SHAMapAddNode& san)
 {
     if (failed_ || mHaveTransactions)
     {
@@ -970,17 +950,8 @@ InboundLedger::takeTxRootNode(std::string_view data, SHAMapAddNode& san)
         // LCOV_EXCL_STOP
     }
 
-    auto treeNode = getTreeNode(data);
-    if (!treeNode)
-    {
-        JLOG(journal_.warn()) << "Got invalid node data";
-        san.incInvalid();
-        return false;
-    }
-
     TransactionStateSF filter(mLedger->txMap().family().db(), app_.getLedgerMaster());
-    san += mLedger->txMap().addRootNode(
-        SHAMapHash{mLedger->header().txHash}, std::move(*treeNode), &filter);
+    san += mLedger->txMap().addRootNode(SHAMapHash{mLedger->header().txHash}, data, &filter);
     return san.isGood();
 }
 
@@ -1077,13 +1048,13 @@ InboundLedger::processData(std::shared_ptr<Peer> peer, protocol::TMLedgerData& p
             }
 
             if (!mHaveState && (packet.nodes().size() > 1) &&
-                !takeAsRootNode(packet.nodes(1).nodedata(), san))
+                !takeAsRootNode(makeSlice(packet.nodes(1).nodedata()), san))
             {
                 JLOG(journal_.warn()) << "Included AS root invalid";
             }
 
             if (!mHaveTransactions && (packet.nodes().size() > 2) &&
-                !takeTxRootNode(packet.nodes(2).nodedata(), san))
+                !takeTxRootNode(makeSlice(packet.nodes(2).nodedata()), san))
             {
                 JLOG(journal_.warn()) << "Included TX root invalid";
             }
@@ -1114,13 +1085,13 @@ InboundLedger::processData(std::shared_ptr<Peer> peer, protocol::TMLedgerData& p
 
         ScopedLockType sl(mtx_);
 
-        // Verify nodes are complete
-        for (auto const& ledger_node : packet.nodes())
+        // Verify node IDs and data are complete
+        for (auto const& node : packet.nodes())
         {
-            if (!validateLedgerNode(ledger_node))
+            if (!node.has_nodeid() || !node.has_nodedata())
             {
-                JLOG(journal_.warn()) << "Got malformed ledger node";
-                peer->charge(Resource::feeMalformedRequest, "ledger_node");
+                JLOG(journal_.warn()) << "Got bad node";
+                peer->charge(Resource::feeMalformedRequest, "ledger_data bad node");
                 return -1;
             }
         }

src/xrpld/app/ledger/detail/InboundLedgers.cpp

@@ -1,6 +1,5 @@
 #include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/LedgerMaster.h>
-#include <xrpld/app/ledger/detail/LedgerNodeHelpers.h>
 #include <xrpld/app/main/Application.h>
 
 #include <xrpl/basics/DecayingSample.h>
@@ -225,21 +224,23 @@ public:
         Serializer s;
         try
         {
-            for (auto const& ledger_node : packet_ptr->nodes())
+            for (int i = 0; i < packet_ptr->nodes().size(); ++i)
             {
-                if (!validateLedgerNode(ledger_node))
+                auto const& node = packet_ptr->nodes(i);
+
+                if (!node.has_nodeid() || !node.has_nodedata())
                     return;
 
-                auto const treeNode = getTreeNode(ledger_node.nodedata());
-                if (!treeNode)
+                auto newNode = SHAMapTreeNode::makeFromWire(makeSlice(node.nodedata()));
+
+                if (!newNode)
                     return;
-                auto const tn = *treeNode;
 
                 s.erase();
-                tn->serializeWithPrefix(s);
+                newNode->serializeWithPrefix(s);
 
                 app_.getLedgerMaster().addFetchPack(
-                    tn->getHash().as_uint256(), std::make_shared<Blob>(s.begin(), s.end()));
+                    newNode->getHash().as_uint256(), std::make_shared<Blob>(s.begin(), s.end()));
             }
         }
         catch (std::exception const&)  // NOLINT(bugprone-empty-catch)

src/xrpld/app/ledger/detail/InboundTransactions.cpp

@@ -1,6 +1,5 @@
 #include <xrpld/app/ledger/InboundLedgers.h>
 #include <xrpld/app/ledger/InboundTransactions.h>
-#include <xrpld/app/ledger/detail/LedgerNodeHelpers.h>
 #include <xrpld/app/ledger/detail/TransactionAcquire.h>
 #include <xrpld/app/main/Application.h>
 
@@ -133,35 +132,26 @@ public:
             return;
         }
 
-        std::vector<std::pair<SHAMapNodeID, intr_ptr::SharedPtr<SHAMapTreeNode>>> data;
+        std::vector<std::pair<SHAMapNodeID, Slice>> data;
         data.reserve(packet.nodes().size());
 
-        for (auto const& ledger_node : packet.nodes())
+        for (auto const& node : packet.nodes())
         {
-            if (!validateLedgerNode(ledger_node))
+            if (!node.has_nodeid() || !node.has_nodedata())
             {
-                JLOG(j_.warn()) << "Got malformed ledger node";
-                peer->charge(Resource::feeMalformedRequest, "ledger_node");
+                peer->charge(Resource::feeMalformedRequest, "ledger_data");
                 return;
             }
 
-            auto treeNode = getTreeNode(ledger_node.nodedata());
-            if (!treeNode)
+            auto const id = deserializeSHAMapNodeID(node.nodeid());
+
+            if (!id)
             {
-                JLOG(j_.warn()) << "Got invalid node data";
-                peer->charge(Resource::feeInvalidData, "node_data");
+                peer->charge(Resource::feeInvalidData, "ledger_data");
                 return;
             }
 
-            auto const nodeID = getSHAMapNodeID(ledger_node, *treeNode);
-            if (!nodeID)
-            {
-                JLOG(j_.warn()) << "Got invalid node id";
-                peer->charge(Resource::feeInvalidData, "node_id");
-                return;
-            }
-
-            data.emplace_back(std::make_pair(*nodeID, std::move(*treeNode)));
+            data.emplace_back(std::make_pair(*id, makeSlice(node.nodedata())));
         }
 
         if (!ta->takeNodes(data, peer).isUseful())

src/xrpld/app/ledger/detail/LedgerNodeHelpers.cpp

@@ -1,95 +0,0 @@
-#include <xrpld/app/ledger/detail/LedgerNodeHelpers.h>
-
-#include <xrpl/basics/IntrusivePointer.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/safe_cast.h>
-#include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/messages.h>
-#include <xrpl/shamap/SHAMap.h>
-#include <xrpl/shamap/SHAMapLeafNode.h>
-#include <xrpl/shamap/SHAMapNodeID.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <optional>
-#include <string>
-
-namespace xrpl {
-
-bool
-validateLedgerNode(protocol::TMLedgerNode const& ledger_node)
-{
-    if (!ledger_node.has_nodedata())
-        return false;
-
-    if (ledger_node.has_nodeid())
-        return !ledger_node.has_id() && !ledger_node.has_depth();
-
-    return ledger_node.has_id() ||
-        (ledger_node.has_depth() && ledger_node.depth() <= SHAMap::leafDepth);
-}
-
-std::optional<intr_ptr::SharedPtr<SHAMapTreeNode>>
-getTreeNode(std::string_view data)
-{
-    auto const slice = makeSlice(data);
-    try
-    {
-        auto treeNode = SHAMapTreeNode::makeFromWire(slice);
-        if (!treeNode)
-            return std::nullopt;
-        return treeNode;
-    }
-    catch (std::exception const&)
-    {
-        return std::nullopt;
-    }
-}
-
-std::optional<SHAMapNodeID>
-getSHAMapNodeID(
-    protocol::TMLedgerNode const& ledger_node,
-    intr_ptr::SharedPtr<SHAMapTreeNode> const& treeNode)
-{
-    if (ledger_node.has_id() || ledger_node.has_depth())
-    {
-        if (treeNode->isInner())
-        {
-            if (!ledger_node.has_id())
-                return std::nullopt;
-
-            return deserializeSHAMapNodeID(ledger_node.id());
-        }
-
-        if (treeNode->isLeaf())
-        {
-            if (!ledger_node.has_depth())
-                return std::nullopt;
-
-            auto const key =
-                safe_downcast<SHAMapLeafNode const*>(treeNode.get())->peekItem()->key();
-            return SHAMapNodeID::createID(ledger_node.depth(), key);
-        }
-
-        UNREACHABLE("xrpl::getSHAMapNodeID : tree node is neither inner nor leaf");
-        return std::nullopt;
-    }
-
-    if (!ledger_node.has_nodeid())
-        return std::nullopt;
-
-    auto const nodeID = deserializeSHAMapNodeID(ledger_node.nodeid());
-    if (!nodeID.has_value())
-        return std::nullopt;
-
-    if (treeNode->isLeaf())
-    {
-        auto const key = safe_downcast<SHAMapLeafNode const*>(treeNode.get())->peekItem()->key();
-        auto const expected_id = SHAMapNodeID::createID(static_cast<int>(nodeID->getDepth()), key);
-        if (nodeID->getNodeID() != expected_id.getNodeID())
-            return std::nullopt;
-    }
-
-    return nodeID;
-}
-
-}  // namespace xrpl

src/xrpld/app/ledger/detail/LedgerNodeHelpers.h

@@ -1,75 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/IntrusivePointer.h>
-#include <xrpl/shamap/SHAMapNodeID.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
-
-#include <optional>
-#include <string_view>
-
-namespace protocol {
-class TMLedgerNode;
-}  // namespace protocol
-
-namespace xrpl {
-
-/**
- * @brief Validates a ledger node proto message.
- *
- * This function checks whether a ledger node has the expected fields (for non-ledger base data):
- * - The node must have `nodedata`.
- * - If the legacy `nodeid` field is present then the new `id` and `depth` fields must not be
- *   present.
- * - If the new `id` or `depth` fields are present (it is a oneof field, so only one of the two can
- *   be set) then the legacy `nodeid` must not be present.
- * - If the `depth` field is present then it must be between 0 and SHAMap::leafDepth (inclusive).
- *
- * @param ledger_node The ledger node to validate.
- * @return true if the ledger node has the expected fields, false otherwise.
- */
-[[nodiscard]] bool
-validateLedgerNode(protocol::TMLedgerNode const& ledger_node);
-
-/**
- * @brief Deserializes a SHAMapTreeNode from wire format data.
- *
- * This function attempts to create a SHAMapTreeNode from the provided data string. If the data is
- * malformed or deserialization fails, the function returns std::nullopt instead of throwing an
- * exception.
- *
- * @param data The serialized node data in wire format.
- * @return An optional containing the deserialized tree node if successful, or std::nullopt if
- *         deserialization fails.
- */
-[[nodiscard]] std::optional<intr_ptr::SharedPtr<SHAMapTreeNode>>
-getTreeNode(std::string_view data);
-
-/**
- * @brief Extracts or reconstructs the SHAMapNodeID from a ledger node proto message.
- *
- * This function retrieves the SHAMapNodeID for a tree node, with behavior that depends on which
- * field is set and the node type (inner vs. leaf).
- *
- * When the legacy `nodeid` field is set in the message:
- * - For all nodes: Deserializes the node ID from the field.
- * - For leaf nodes: Validates that the node ID is consistent with the leaf's key.
- *
- * When the new `id` or `depth` field is set in the message:
- * - For inner nodes: Deserializes the node ID from the `id` field. Note that root nodes are also
- *   inner nodes.
- * - For leaf nodes: Reconstructs the node ID using both the depth from the `depth` field and the
- *   key from the leaf node's item.
- *
- * @param ledger_node The validated protocol message containing the ledger node data.
- * @param treeNode The deserialized tree node (inner or leaf node).
- * @return An optional containing the node ID if extraction/reconstruction succeeds, or std::nullopt
- *         if the required fields are missing or validation fails.
- * @note This function expects that the caller has already validated the ledger node by calling the
- *       `validateLedgerNode` function and obtained a valid tree node by calling `getTreeNode`.
- */
-[[nodiscard]] std::optional<SHAMapNodeID>
-getSHAMapNodeID(
-    protocol::TMLedgerNode const& ledger_node,
-    intr_ptr::SharedPtr<SHAMapTreeNode> const& treeNode);
-
-}  // namespace xrpl

src/xrpld/app/ledger/detail/TransactionAcquire.cpp

@@ -159,7 +159,7 @@ TransactionAcquire::trigger(std::shared_ptr<Peer> const& peer)
 
 SHAMapAddNode
 TransactionAcquire::takeNodes(
-    std::vector<std::pair<SHAMapNodeID, intr_ptr::SharedPtr<SHAMapTreeNode>>> const& data,
+    std::vector<std::pair<SHAMapNodeID, Slice>> const& data,
     std::shared_ptr<Peer> const& peer)
 {
     ScopedLockType sl(mtx_);
@@ -183,7 +183,7 @@ TransactionAcquire::takeNodes(
 
         ConsensusTransSetSF sf(app_, app_.getTempNodeCache());
 
-        for (auto& d : data)
+        for (auto const& d : data)
         {
             if (d.first.isRoot())
             {
@@ -191,8 +191,7 @@ TransactionAcquire::takeNodes(
                 {
                     JLOG(journal_.debug()) << "Got root TXS node, already have it";
                 }
-                else if (!mMap->addRootNode(SHAMapHash{hash_}, std::move(d.second), nullptr)
-                              .isGood())
+                else if (!mMap->addRootNode(SHAMapHash{hash_}, d.second, nullptr).isGood())
                 {
                     JLOG(journal_.warn()) << "TX acquire got bad root node";
                 }
@@ -201,7 +200,7 @@ TransactionAcquire::takeNodes(
                     mHaveRoot = true;
                 }
             }
-            else if (!mMap->addKnownNode(d.first, std::move(d.second), &sf).isGood())
+            else if (!mMap->addKnownNode(d.first, d.second, &sf).isGood())
             {
                 JLOG(journal_.warn()) << "TX acquire got bad non-root node";
                 return SHAMapAddNode::invalid();

src/xrpld/app/ledger/detail/TransactionAcquire.h

@@ -20,8 +20,8 @@ public:
 
     SHAMapAddNode
     takeNodes(
-        std::vector<std::pair<SHAMapNodeID, intr_ptr::SharedPtr<SHAMapTreeNode>>> const& data,
-        std::shared_ptr<Peer> const& peer);
+        std::vector<std::pair<SHAMapNodeID, Slice>> const& data,
+        std::shared_ptr<Peer> const&);
 
     void
     init(int startPeers);

src/xrpld/overlay/Peer.h

@@ -17,7 +17,6 @@ enum class ProtocolFeature {
     ValidatorListPropagation,
     ValidatorList2Propagation,
     LedgerReplay,
-    LedgerNodeDepth,
 };
 
 /** Represents a peer connection in the overlay. */

src/xrpld/overlay/detail/PeerImp.cpp

@@ -30,7 +30,6 @@
 #include <mutex>
 #include <numeric>
 #include <sstream>
-#include <tuple>
 
 using namespace std::chrono_literals;
 
@@ -499,8 +498,6 @@ PeerImp::supportsFeature(ProtocolFeature f) const
             return protocol_ >= make_protocol(2, 1);
         case ProtocolFeature::ValidatorList2Propagation:
             return protocol_ >= make_protocol(2, 2);
-        case ProtocolFeature::LedgerNodeDepth:
-            return protocol_ >= make_protocol(2, 3);
         case ProtocolFeature::LedgerReplay:
             return ledgerReplayEnabled_;
     }
@@ -3391,19 +3388,13 @@ PeerImp::processLedgerRequest(std::shared_ptr<protocol::TMGetLedger> const& m)
         std::uint32_t const defaultDepth = isHighLatency() ? 2 : 1;
         auto const queryDepth{m->has_querydepth() ? m->querydepth() : defaultDepth};
 
-        std::vector<std::tuple<SHAMapNodeID, Blob, bool>> data;
-        auto const useLedgerNodeDepth = supportsFeature(ProtocolFeature::LedgerNodeDepth);
+        std::vector<std::pair<SHAMapNodeID, Blob>> data;
 
         for (int i = 0;
              i < m->nodeids_size() && ledgerData.nodes_size() < Tuning::softMaxReplyNodes;
              ++i)
         {
             auto const shaMapNodeId{deserializeSHAMapNodeID(m->nodeids(i))};
-            if (!shaMapNodeId.has_value())
-            {
-                JLOG(p_journal_.error()) << "processLedgerRequest: Invalid SHAMap node ID";
-                return;
-            }
 
             data.clear();
             data.reserve(Tuning::softMaxReplyNodes);
@@ -3419,28 +3410,9 @@ PeerImp::processLedgerRequest(std::shared_ptr<protocol::TMGetLedger> const& m)
                     {
                         if (ledgerData.nodes_size() >= Tuning::hardMaxReplyNodes)
                             break;
-
                         protocol::TMLedgerNode* node{ledgerData.add_nodes()};
-
-                        auto const& nodeData = std::get<1>(d);
-                        node->set_nodedata(nodeData.data(), nodeData.size());
-
-                        // When the LedgerNodeDepth protocol feature is not supported by the peer,
-                        // we always set the `nodeid` field. However, when it is supported then we
-                        // set the `id` field for inner nodes and the `depth` field for leaf nodes.
-                        auto const& nodeID = std::get<0>(d);
-                        if (!useLedgerNodeDepth)
-                        {
-                            node->set_nodeid(nodeID.getRawString());
-                        }
-                        else if (std::get<2>(d))
-                        {
-                            node->set_depth(nodeID.getDepth());
-                        }
-                        else
-                        {
-                            node->set_id(nodeID.getRawString());
-                        }
+                        node->set_nodeid(d.first.getRawString());
+                        node->set_nodedata(d.second.data(), d.second.size());
                     }
                 }
                 else

src/xrpld/overlay/detail/ProtocolVersion.cpp

@@ -21,8 +21,7 @@ namespace xrpl {
 constexpr ProtocolVersion const supportedProtocolList[]
 {
     {2, 1},
-    {2, 2},
-    {2, 3},
+    {2, 2}
 };
 // clang-format on
 

src/xrpld/rpc/handlers/GetAggregatePrice.cpp

@@ -218,6 +218,12 @@ doGetAggregatePrice(RPC::JsonContext& context)
         return result;
     }
 
+    // Get the ledger
+    std::shared_ptr<ReadView const> ledger;
+    result = RPC::lookupLedger(ledger, context);
+    if (!ledger)
+        return result;  // LCOV_EXCL_LINE
+
     // Collect the dataset into bimap keyed by lastUpdateTime and
     // STAmount (Number is int64 and price is uint64)
     Prices prices;
@@ -238,11 +244,6 @@ doGetAggregatePrice(RPC::JsonContext& context)
             return result;
         }
 
-        std::shared_ptr<ReadView const> ledger;
-        result = RPC::lookupLedger(ledger, context);
-        if (!ledger)
-            return result;  // LCOV_EXCL_LINE
-
         auto const sle = ledger->read(keylet::oracle(*account, *documentID));
         iteratePriceData(context, sle, [&](STObject const& node) {
             auto const& series = node.getFieldArray(sfPriceDataSeries);
@@ -284,8 +285,8 @@ doGetAggregatePrice(RPC::JsonContext& context)
     if (auto const threshold = std::get<std::uint32_t>(timeThreshold))
     {
         // threshold defines an acceptable range {max,min} of lastUpdateTime as
-        // {latestTime, latestTime - threshold}, the prices with lastUpdateTime
-        // greater than (latestTime - threshold) are erased.
+        // {latestTime, latestTime - threshold}. Prices with lastUpdateTime
+        // less than (latestTime - threshold) are erased (outdated prices).
         auto const oldestTime = prices.left.rbegin()->first;
         auto const upperBound = latestTime > threshold ? (latestTime - threshold) : oldestTime;
         if (upperBound > oldestTime)