run ubsan on gcc-15 as well.

Signed-off-by: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>

.github/actions/generate-version/action.yml

@@ -1,42 +0,0 @@
-name: Generate build version number
-description: "Generate build version number."
-
-outputs:
-  version:
-    description: "The generated build version number."
-    value: ${{ steps.version.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    # When a tag is pushed, the version is used as-is.
-    - name: Generate version for tag event
-      if: ${{ github.event_name == 'tag' }}
-      shell: bash
-      env:
-        VERSION: ${{ github.ref_name }}
-      run: echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
-
-    # When a tag is not pushed, then the version is extracted from the
-    # BuildInfo.cpp file and the shortened commit hash appended to it.
-    - name: Generate version for non-tag event
-      if: ${{ github.event_name != 'tag' }}
-      shell: bash
-      run: |
-        echo 'Extracting version from BuildInfo.cpp.'
-        VERSION="$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')"
-        if [[ -z "${VERSION}" ]]; then
-          echo 'Unable to extract version from BuildInfo.cpp.'
-          exit 1
-        fi
-
-        echo 'Appending shortened commit hash to version.'
-        SHA='${{ github.sha }}'
-        VERSION="${VERSION}-${SHA:0:7}"
-
-        echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
-
-    - name: Output version
-      id: version
-      shell: bash
-      run: echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"

.github/actions/setup-conan/action.yml

@@ -2,11 +2,11 @@ name: Setup Conan
 description: "Set up Conan configuration, profile, and remote."
 
 inputs:
-  remote_name:
+  conan_remote_name:
     description: "The name of the Conan remote to use."
     required: false
     default: xrplf
-  remote_url:
+  conan_remote_url:
     description: "The URL of the Conan endpoint to use."
     required: false
     default: https://conan.ripplex.io
@@ -36,11 +36,11 @@ runs:
     - name: Set up Conan remote
       shell: bash
       env:
-        REMOTE_NAME: ${{ inputs.remote_name }}
-        REMOTE_URL: ${{ inputs.remote_url }}
+        CONAN_REMOTE_NAME: ${{ inputs.conan_remote_name }}
+        CONAN_REMOTE_URL: ${{ inputs.conan_remote_url }}
       run: |
-        echo "Adding Conan remote '${REMOTE_NAME}' at '${REMOTE_URL}'."
-        conan remote add --index 0 --force "${REMOTE_NAME}" "${REMOTE_URL}"
+        echo "Adding Conan remote '${CONAN_REMOTE_NAME}' at '${CONAN_REMOTE_URL}'."
+        conan remote add --index 0 --force "${CONAN_REMOTE_NAME}" "${CONAN_REMOTE_URL}"
 
         echo 'Listing Conan remotes.'
         conan remote list

.github/scripts/levelization/results/ordering.txt

@@ -19,7 +19,6 @@ libxrpl.protocol > xrpl.json
 libxrpl.protocol > xrpl.protocol
 libxrpl.resource > xrpl.basics
 libxrpl.resource > xrpl.json
-libxrpl.resource > xrpl.protocol
 libxrpl.resource > xrpl.resource
 libxrpl.server > xrpl.basics
 libxrpl.server > xrpl.json

.github/scripts/strategy-matrix/generate.py

@@ -242,21 +242,23 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
         # names get truncated.
         # Add Address and Thread (both coupled with UB) sanitizers for specific bookworm distros.
         # GCC-Asan rippled-embedded tests are failing because of https://github.com/google/sanitizers/issues/856
-        if (
-            os["distro_version"] == "bookworm"
-            and f"{os['compiler_name']}-{os['compiler_version']}" == "clang-20"
-        ):
+        if os[
+            "distro_version"
+        ] == "bookworm" and f"{os['compiler_name']}-{os['compiler_version']}" in [
+            "clang-20",
+            "gcc-15",
+        ]:
             # Add ASAN + UBSAN configuration.
             configurations.append(
                 {
-                    "config_name": config_name + "-asan-ubsan",
+                    "config_name": config_name + "-ubsan",
                     "cmake_args": cmake_args,
                     "cmake_target": cmake_target,
                     "build_only": build_only,
                     "build_type": build_type,
                     "os": os,
                     "architecture": architecture,
-                    "sanitizers": "address,undefinedbehavior",
+                    "sanitizers": "undefinedbehavior",
                 }
             )
             # TSAN is deactivated due to seg faults with latest compilers.

.github/workflows/on-pr.yml

@@ -1,8 +1,7 @@
 # This workflow runs all workflows to check, build and test the project on
 # various Linux flavors, as well as on MacOS and Windows, on every push to a
 # user branch. However, it will not run if the pull request is a draft unless it
-# has the 'DraftRunCI' label. For commits to PRs that target a release branch,
-# it also uploads the libxrpl recipe to the Conan remote.
+# has the 'DraftRunCI' label.
 name: PR
 
 on:
@@ -54,6 +53,7 @@ jobs:
             .github/scripts/rename/**
             .github/workflows/reusable-check-levelization.yml
             .github/workflows/reusable-check-rename.yml
+            .github/workflows/reusable-notify-clio.yml
             .github/workflows/on-pr.yml
 
             # Keep the paths below in sync with those in `on-trigger.yml`.
@@ -66,7 +66,6 @@ jobs:
             .github/workflows/reusable-build-test.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
-            .github/workflows/reusable-upload-recipe.yml
             .codecov.yml
             cmake/**
             conan/**
@@ -122,42 +121,22 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  upload-recipe:
+  notify-clio:
     needs:
       - should-run
       - build-test
-    # Only run when committing to a PR that targets a release branch in the
-    # XRPLF repository.
-    if: ${{ github.repository_owner == 'XRPLF' && needs.should-run.outputs.go == 'true' && startsWith(github.ref, 'refs/heads/release') }}
-    uses: ./.github/workflows/reusable-upload-recipe.yml
+    if: ${{ needs.should-run.outputs.go == 'true' && startsWith(github.ref, 'refs/heads/release') }}
+    uses: ./.github/workflows/reusable-notify-clio.yml
     secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
-
-  notify-clio:
-    needs: upload-recipe
-    runs-on: ubuntu-latest
-    steps:
-      # Notify the Clio repository about the newly proposed release version, so
-      # it can be checked for compatibility before the release is actually made.
-      - name: Notify Clio
-        env:
-          GH_TOKEN: ${{ secrets.CLIO_NOTIFY_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-        run: |
-          gh api --method POST -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
-          /repos/xrplf/clio/dispatches -f "event_type=check_libxrpl" \
-          -F "client_payload[ref]=${{ needs.upload-recipe.outputs.recipe_ref }}" \
-          -F "client_payload[pr_url]=${PR_URL}"
+      clio_notify_token: ${{ secrets.CLIO_NOTIFY_TOKEN }}
+      conan_remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      conan_remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   passed:
     if: failure() || cancelled()
     needs:
-      - check-levelization
-      - check-rename
       - build-test
-      - upload-recipe
-      - notify-clio
+      - check-levelization
     runs-on: ubuntu-latest
     steps:
       - name: Fail

.github/workflows/on-tag.yml

@@ -1,25 +0,0 @@
-# This workflow uploads the libxrpl recipe to the Conan remote when a versioned
-# tag is pushed.
-name: Tag
-
-on:
-  push:
-    tags:
-      - "v*"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload-recipe:
-    # Only run when a tag is pushed to the XRPLF repository.
-    if: ${{ github.repository_owner == 'XRPLF' }}
-    uses: ./.github/workflows/reusable-upload-recipe.yml
-    secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}

.github/workflows/on-trigger.yml

@@ -1,7 +1,8 @@
 # This workflow runs all workflows to build and test the code on various Linux
 # flavors, as well as on MacOS and Windows, on a scheduled basis, on merge into
-# the 'develop' or 'release*' branches, or when requested manually. Upon pushes
-# to the develop branch it also uploads the libxrpl recipe to the Conan remote.
+# the 'develop' or 'release*' branches, or when requested manually. Upon
+# successful completion, it also uploads the built libxrpl package to the Conan
+# remote.
 name: Trigger
 
 on:
@@ -23,7 +24,6 @@ on:
       - ".github/workflows/reusable-build-test.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
-      - ".github/workflows/reusable-upload-recipe.yml"
       - ".codecov.yml"
       - "cmake/**"
       - "conan/**"
@@ -76,12 +76,3 @@ jobs:
       strategy_matrix: ${{ github.event_name == 'schedule' && 'all' || 'minimal' }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  upload-recipe:
-    needs: build-test
-    # Only run when pushing to the develop branch in the XRPLF repository.
-    if: ${{ github.repository_owner == 'XRPLF' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
-    uses: ./.github/workflows/reusable-upload-recipe.yml
-    secrets:
-      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}

.github/workflows/reusable-build-test-config.yml

@@ -205,7 +205,6 @@ jobs:
         run: |
           echo "ASAN_OPTIONS=print_stacktrace=1:detect_container_overflow=0:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/asan.supp" >> ${GITHUB_ENV}
           echo "TSAN_OPTIONS=second_deadlock_stack=1:halt_on_error=0:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/tsan.supp" >> ${GITHUB_ENV}
-          echo "UBSAN_OPTIONS=suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/ubsan.supp" >> ${GITHUB_ENV}
           echo "LSAN_OPTIONS=suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/lsan.supp" >> ${GITHUB_ENV}
 
       - name: Run the separate tests
@@ -226,6 +225,7 @@ jobs:
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
         env:
           BUILD_NPROC: ${{ steps.nproc.outputs.nproc }}
+          PREFIX: ${{ (runner.arch == 'X64' && env.ENABLED_SANITIZERS == 'true') && 'setarch x86_64 -R' || '' }}
         run: |
           ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}"
 

.github/workflows/reusable-notify-clio.yml

@@ -0,0 +1,91 @@
+# This workflow exports the built libxrpl package to the Conan remote on a
+# a channel named after the pull request, and notifies the Clio repository about
+# the new version so it can check for compatibility.
+name: Notify Clio
+
+# This workflow can only be triggered by other workflows.
+on:
+  workflow_call:
+    inputs:
+      conan_remote_name:
+        description: "The name of the Conan remote to use."
+        required: false
+        type: string
+        default: xrplf
+      conan_remote_url:
+        description: "The URL of the Conan endpoint to use."
+        required: false
+        type: string
+        default: https://conan.ripplex.io
+    secrets:
+      clio_notify_token:
+        description: "The GitHub token to notify Clio about new versions."
+        required: true
+      conan_remote_username:
+        description: "The username for logging into the Conan remote."
+        required: true
+      conan_remote_password:
+        description: "The password for logging into the Conan remote."
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-clio
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  upload:
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/ci/ubuntu-noble:gcc-13-sha-5dd7158
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - name: Generate outputs
+        id: generate
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          echo 'Generating user and channel.'
+          echo "user=clio" >> "${GITHUB_OUTPUT}"
+          echo "channel=pr_${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
+          echo 'Extracting version.'
+          echo "version=$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')" >> "${GITHUB_OUTPUT}"
+      - name: Calculate conan reference
+        id: conan_ref
+        run: |
+          echo "conan_ref=${{ steps.generate.outputs.version }}@${{ steps.generate.outputs.user }}/${{ steps.generate.outputs.channel }}" >> "${GITHUB_OUTPUT}"
+      - name: Set up Conan
+        uses: ./.github/actions/setup-conan
+        with:
+          conan_remote_name: ${{ inputs.conan_remote_name }}
+          conan_remote_url: ${{ inputs.conan_remote_url }}
+      - name: Log into Conan remote
+        env:
+          CONAN_REMOTE_NAME: ${{ inputs.conan_remote_name }}
+        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.conan_remote_username }}" --password "${{ secrets.conan_remote_password }}"
+      - name: Upload package
+        env:
+          CONAN_REMOTE_NAME: ${{ inputs.conan_remote_name }}
+        run: |
+          conan export --user=${{ steps.generate.outputs.user }} --channel=${{ steps.generate.outputs.channel }} .
+          conan upload --confirm --check --remote="${CONAN_REMOTE_NAME}" xrpl/${{ steps.conan_ref.outputs.conan_ref }}
+    outputs:
+      conan_ref: ${{ steps.conan_ref.outputs.conan_ref }}
+
+  notify:
+    needs: upload
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Clio
+        env:
+          GH_TOKEN: ${{ secrets.clio_notify_token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh api --method POST -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
+          /repos/xrplf/clio/dispatches -f "event_type=check_libxrpl" \
+          -F "client_payload[conan_ref]=${{ needs.upload.outputs.conan_ref }}" \
+          -F "client_payload[pr_url]=${PR_URL}"

.github/workflows/reusable-upload-recipe.yml

@@ -1,78 +0,0 @@
-# This workflow exports the built libxrpl package to the Conan remote.
-name: Upload Conan recipe
-
-# This workflow can only be triggered by other workflows.
-on:
-  workflow_call:
-    inputs:
-      remote_name:
-        description: "The name of the Conan remote to use."
-        required: false
-        type: string
-        default: xrplf
-      remote_url:
-        description: "The URL of the Conan endpoint to use."
-        required: false
-        type: string
-        default: https://conan.ripplex.io
-
-    secrets:
-      remote_username:
-        description: "The username for logging into the Conan remote."
-        required: true
-      remote_password:
-        description: "The password for logging into the Conan remote."
-        required: true
-
-    outputs:
-      recipe_ref:
-        description: "The Conan recipe reference ('name/version') that was uploaded."
-        value: ${{ jobs.upload.outputs.ref }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-upload-recipe
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/ci/ubuntu-noble:gcc-13-sha-5dd7158
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-
-      - name: Generate build version number
-        id: version
-        uses: ./.github/actions/generate-version
-
-      - name: Determine recipe reference
-        id: ref
-        run: echo "ref=xrpl/${{ steps.version.outputs.version }}" >> "${GITHUB_OUTPUT}"
-
-      - name: Set up Conan
-        uses: ./.github/actions/setup-conan
-        with:
-          remote_name: ${{ inputs.remote_name }}
-          remote_url: ${{ inputs.remote_url }}
-
-      - name: Log into Conan remote
-        env:
-          REMOTE_NAME: ${{ inputs.remote_name }}
-          REMOTE_USERNAME: ${{ inputs.remote_username }}
-          REMOTE_PASSWORD: ${{ inputs.remote_password }}
-        run: conan remote login "${REMOTE_NAME}" "${REMOTE_USERNAME}" --password "${REMOTE_PASSWORD}"
-
-      - name: Upload Conan recipe
-        env:
-          RECIPE_REF: ${{ steps.ref.outputs.ref }}
-          REMOTE_NAME: ${{ inputs.remote_name }}
-        run: |
-          conan export .
-          conan upload --confirm --check --remote="${REMOTE_NAME}" ${RECIPE_REF}
-
-    outputs:
-      ref: ${{ steps.ref.outputs.ref }}

.github/workflows/upload-conan-deps.yml

@@ -86,8 +86,8 @@ jobs:
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
         with:
-          remote_name: ${{ env.CONAN_REMOTE_NAME }}
-          remote_url: ${{ env.CONAN_REMOTE_URL }}
+          conan_remote_name: ${{ env.CONAN_REMOTE_NAME }}
+          conan_remote_url: ${{ env.CONAN_REMOTE_URL }}
 
       - name: Build dependencies
         uses: ./.github/actions/build-deps

SECURITY.md

@@ -78,61 +78,72 @@ To report a qualifying bug, please send a detailed report to:
 
 | Email Address | bugs@ripple.com                                     |
 | :-----------: | :-------------------------------------------------- |
-| Short Key ID  | `0xA9F514E0`                                        |
-|  Long Key ID  | `0xD900855AA9F514E0`                                |
-|  Fingerprint  | `B72C 0654 2F2A E250 2763 A268 D900 855A A9F5 14E0` |
+| Short Key ID  | `0xC57929BE`                                        |
+|  Long Key ID  | `0xCD49A0AFC57929BE`                                |
+|  Fingerprint  | `24E6 3B02 37E0 FA9C 5E96 8974 CD49 A0AF C579 29BE` |
 
 The full PGP key for this address, which is also available on several key servers (e.g. on [keyserver.ubuntu.com](https://keyserver.ubuntu.com)), is:
 
 ```
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-mQINBGkSZAQBEACprU199OhgdsOsygNjiQV4msuN3vDOUooehL+NwfsGfW79Tbqq
-Q2u7uQ3NZjW+M2T4nsDwuhkr7pe7xSReR5W8ssaczvtUyxkvbMClilcgZ2OSCAuC
-N9tzJsqOqkwBvXoNXkn//T2jnPz0ZU2wSF+NrEibq5FeuyGdoX3yXXBxq9pW9HzK
-HkQll63QSl6BzVSGRQq+B6lGgaZGLwf3mzmIND9Z5VGLNK2jKynyz9z091whNG/M
-kV+E7/r/bujHk7WIVId07G5/COTXmSr7kFnNEkd2Umw42dkgfiNKvlmJ9M7c1wLK
-KbL9Eb4ADuW6rRc5k4s1e6GT8R4/VPliWbCl9SE32hXH8uTkqVIFZP2eyM5WRRHs
-aKzitkQG9UK9gcb0kdgUkxOvvgPHAe5IuZlcHFzU4y0dBbU1VEFWVpiLU0q+IuNw
-5BRemeHc59YNsngkmAZ+/9zouoShRusZmC8Wzotv75C2qVBcjijPvmjWAUz0Zunm
-Lsr+O71vqHE73pERjD07wuD/ISjiYRYYE/bVrXtXLZijC7qAH4RE3nID+2ojcZyO
-/2jMQvt7un56RsGH4UBHi3aBHi9bUoDGCXKiQY981cEuNaOxpou7Mh3x/ONzzSvk
-sTV6nl1LOZHykN1JyKwaNbTSAiuyoN+7lOBqbV04DNYAHL88PrT21P83aQARAQAB
-tB1SaXBwbGUgTGFicyA8YnVnc0ByaXBwbGUuY29tPokCTgQTAQgAOBYhBLcsBlQv
-KuJQJ2OiaNkAhVqp9RTgBQJpEmQEAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
-AAoJENkAhVqp9RTgBzgP/i7y+aDWl1maig1XMdyb+o0UGusumFSW4Hmj278wlKVv
-usgLPihYgHE0PKrv6WRyKOMC1tQEcYYN93M+OeQ1vFhS2YyURq6RCMmh4zq/awXG
-uZbG36OURB5NH8lGBOHiN/7O+nY0CgenBT2JWm+GW3nEOAVOVm4+r5GlpPlv+Dp1
-NPBThcKXFMnH73++NpSQoDzTfRYHPxhDAX3jkLi/moXfSanOLlR6l94XNNN0jBHW
-Quao0rzf4WSXq9g6AS224xhAA5JyIcFl8TX7hzj5HaFn3VWo3COoDu4U7H+BM0fl
-85yqiMQypp7EhN2gxpMMWaHY5TFM85U/bFXFYfEgihZ4/gt4uoIzsNI9jlX7mYvG
-KFdDij+oTlRsuOxdIy60B3dKcwOH9nZZCz0SPsN/zlRWgKzK4gDKdGhFkU9OlvPu
-94ZqscanoiWKDoZkF96+sjgfjkuHsDK7Lwc1Xi+T4drHG/3aVpkYabXox+lrKB/S
-yxZjeqOIQzWPhnLgCaLyvsKo5hxKzL0w3eURu8F3IS7RgOOlljv4M+Me9sEVcdNV
-aN3/tQwbaomSX1X5D5YXqhBwC3rU3wXwamsscRTGEpkV+JCX6KUqGP7nWmxCpAly
-FL05XuOd5SVHJjXLeuje0JqLUpN514uL+bThWwDbDTdAdwW3oK/2WbXz7IfJRLBj
-uQINBGkSZAQBEADdI3SL2F72qkrgFqXWE6HSRBu9bsAvTE5QrRPWk7ux6at537r4
-S4sIw2dOwLvbyIrDgKNq3LQ5wCK88NO/NeCOFm4AiCJSl3pJHXYnTDoUxTrrxx+o
-vSRI4I3fHEql/MqzgiAb0YUezjgFdh3vYheMPp/309PFbOLhiFqEcx80Mx5h06UH
-gDzu1qNj3Ec+31NLic5zwkrAkvFvD54d6bqYR3SEgMau6aYEewpGHbWBi2pLqSi2
-lQcAeOFixqGpTwDmAnYR8YtjBYepy0MojEAdTHcQQlOYSDk4q4elG+io2N8vECfU
-rD6ORecN48GXdZINYWTAdslrUeanmBdgQrYkSpce8TSghgT9P01SNaXxmyaehVUO
-lqI4pcg5G2oojAE8ncNS3TwDtt7daTaTC3bAdr4PXDVAzNAiewjMNZPB7xidkDGQ
-Y4W1LxTMXyJVWxehYOH7tsbBRKninlfRnLgYzmtIbNRAAvNcsxU6ihv3AV0WFknN
-YbSzotEv1Xq/5wk309x8zCDe+sP0cQicvbXafXmUzPAZzeqFg+VLFn7F9MP1WGlW
-B1u7VIvBF1Mp9Nd3EAGBAoLRdRu+0dVWIjPTQuPIuD9cCatJA0wVaKUrjYbBMl88
-a12LixNVGeSFS9N7ADHx0/o7GNT6l88YbaLP6zggUHpUD/bR+cDN7vllIQARAQAB
-iQI2BBgBCAAgFiEEtywGVC8q4lAnY6Jo2QCFWqn1FOAFAmkSZAQCGwwACgkQ2QCF
-Wqn1FOAfAA/8CYq4p0p4bobY20CKEMsZrkBTFJyPDqzFwMeTjgpzqbD7Y3Qq5QCK
-OBbvY02GWdiIsNOzKdBxiuam2xYP9WHZj4y7/uWEvT0qlPVmDFu+HXjoJ43oxwFd
-CUp2gMuQ4cSL3X94VRJ3BkVL+tgBm8CNY0vnTLLOO3kum/R69VsGJS1JSGUWjNM+
-4qwS3mz+73xJu1HmERyN2RZF/DGIZI2PyONQQ6aH85G1Dd2ohu2/DBAkQAMBrPbj
-FrbDaBLyFhODxU3kTWqnfLlaElSm2EGdIU2yx7n4BggEa//NZRMm5kyeo4vzhtlQ
-YIVUMLAOLZvnEqDnsLKp+22FzNR/O+htBQC4lPywl53oYSALdhz1IQlcAC1ru5KR
-XPzhIXV6IIzkcx9xNkEclZxmsuy5ERXyKEmLbIHAlzFmnrldlt2ZgXDtzaorLmxj
-klKibxd5tF50qOpOivz+oPtFo7n+HmFa1nlVAMxlDCUdM0pEVeYDKI5zfVwalyhZ
-NnjpakdZSXMwgc7NP/hH9buF35hKDp7EckT2y3JNYwHsDdy1icXN2q40XZw5tSIn
-zkPWdu3OUY8PISohN6Pw4h0RH4ZmoX97E8sEfmdKaT58U4Hf2aAv5r9IWCSrAVqY
-u5jvac29CzQR9Kal0A+8phHAXHNFD83SwzIC0syaT9ficAguwGH8X6Q=
-=nGuD
+mQINBFUwGHYBEAC0wpGpBPkd8W1UdQjg9+cEFzeIEJRaoZoeuJD8mofwI5Ejnjdt
+kCpUYEDal0ygkKobu8SzOoATcDl18iCrScX39VpTm96vISFZMhmOryYCIp4QLJNN
+4HKc2ZdBj6W4igNi6vj5Qo6JMyGpLY2mz4CZskbt0TNuUxWrGood+UrCzpY8x7/N
+a93fcvNw+prgCr0rCH3hAPmAFfsOBbtGzNnmq7xf3jg5r4Z4sDiNIF1X1y53DAfV
+rWDx49IKsuCEJfPMp1MnBSvDvLaQ2hKXs+cOpx1BCZgHn3skouEUxxgqbtTzBLt1
+xXpmuijsaltWngPnGO7mOAzbpZSdBm82/Emrk9bPMuD0QaLQjWr7HkTSUs6ZsKt4
+7CLPdWqxyY/QVw9UaxeHEtWGQGMIQGgVJGh1fjtUr5O1sC9z9jXcQ0HuIHnRCTls
+GP7hklJmfH5V4SyAJQ06/hLuEhUJ7dn+BlqCsT0tLmYTgZYNzNcLHcqBFMEZHvHw
+9GENMx/tDXgajKql4bJnzuTK0iGU/YepanANLd1JHECJ4jzTtmKOus9SOGlB2/l1
+0t0ADDYAS3eqOdOcUvo9ElSLCI5vSVHhShSte/n2FMWU+kMUboTUisEG8CgQnrng
+g2CvvQvqDkeOtZeqMcC7HdiZS0q3LJUWtwA/ViwxrVlBDCxiTUXCotyBWwARAQAB
+tDBSaXBwbGUgTGFicyBCdWcgQm91bnR5IFByb2dyYW0gPGJ1Z3NAcmlwcGxlLmNv
+bT6JAjcEEwEKACEFAlUwGHYCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
+zUmgr8V5Kb6R0g//SwY/mVJY59k87iL26/KayauSoOcz7xjcST26l4ZHVVX85gOY
+HYZl8k0+m8X3zxeYm9a3QAoAml8sfoaFRFQP8ynnefRrLUPaZ2MjbJ0SACMwZNef
+T6o7Mi8LBAaiNZdYVyIfX1oM6YXtqYkuJdav6ZCyvVYqc9OvMJPY2ZzJYuI/ZtvQ
+/lTndxCeg9ALNX/iezOLGdfMpf4HuIFVwcPPlwGi+HDlB9/bggDEHC8z434SXVFc
+aQatXAPcDkjMUweU7y0CZtYEj00HITd4pSX6MqGiHrxlDZTqinCOPs1Ieqp7qufs
+MzlM6irLGucxj1+wa16ieyYvEtGaPIsksUKkywx0O7cf8N2qKg+eIkUk6O0Uc6eO
+CszizmiXIXy4O6OiLlVHGKkXHMSW9Nwe9GE95O8G9WR8OZCEuDv+mHPAutO+IjdP
+PDAAUvy+3XnkceO+HGWRpVvJZfFP2YH4A33InFL5yqlJmSoR/yVingGLxk55bZDM
++HYGR3VeMb8Xj1rf/02qERsZyccMCFdAvKDbTwmvglyHdVLu5sPmktxbBYiemfyJ
+qxMxmYXCc9S0hWrWZW7edktBa9NpE58z1mx+hRIrDNbS2sDHrib9PULYCySyVYcF
+P+PWEe1CAS5jqkR2ker5td2/pHNnJIycynBEs7l6zbc9fu+nktFJz0q2B+GJAhwE
+EAEKAAYFAlUwGaQACgkQ+tiY1qQ2QkjMFw//f2hNY3BPNe+1qbhzumMDCnbTnGif
+kLuAGl9OKt81VHG1f6RnaGiLpR696+6Ja45KzH15cQ5JJl5Bgs1YkR/noTGX8IAD
+c70eNwiFu8JXTaaeeJrsmFkF9Tueufb364risYkvPP8tNUD3InBFEZT3WN7JKwix
+coD4/BwekUwOZVDd/uCFEyhlhZsROxdKNisNo3VtAq2s+3tIBAmTrriFUl0K+ZC5
+zgavcpnPN57zMtW9aK+VO3wXqAKYLYmtgxkVzSLUZt2M7JuwOaAdyuYWAneKZPCu
+1AXkmyo+d84sd5mZaKOr5xArAFiNMWPUcZL4rkS1Fq4dKtGAqzzR7a7hWtA5o27T
+6vynuxZ1n0PPh0er2O/zF4znIjm5RhTlfjp/VmhZdQfpulFEQ/dMxxGkQ9z5IYbX
+mTlSDbCSb+FMsanRBJ7Drp5EmBIudVGY6SHI5Re1RQiEh7GoDfUMUwZO+TVDII5R
+Ra7WyuimYleJgDo/+7HyfuIyGDaUCVj6pwVtYtYIdOI3tTw1R1Mr0V8yaNVnJghL
+CHcEJQL+YHSmiMM3ySil3O6tm1By6lFz8bVe/rgG/5uklQrnjMR37jYboi1orCC4
+yeIoQeV0ItlxeTyBwYIV/o1DBNxDevTZvJabC93WiGLw2XFjpZ0q/9+zI2rJUZJh
+qxmKP+D4e27lCI65Ag0EVTAYdgEQAMvttYNqeRNBRpSX8fk45WVIV8Fb21fWdwk6
+2SkZnJURbiC0LxQnOi7wrtii7DeFZtwM2kFHihS1VHekBnIKKZQSgGoKuFAQMGyu
+a426H4ZsSmA9Ufd7kRbvdtEcp7/RTAanhrSL4lkBhaKJrXlxBJ27o3nd7/rh7r3a
+OszbPY6DJ5bWClX3KooPTDl/RF2lHn+fweFk58UvuunHIyo4BWJUdilSXIjLun+P
+Qaik4ZAsZVwNhdNz05d+vtai4AwbYoO7adboMLRkYaXSQwGytkm+fM6r7OpXHYuS
+cR4zB/OK5hxCVEpWfiwN71N2NMvnEMaWd/9uhqxJzyvYgkVUXV9274TUe16pzXnW
+ZLfmitjwc91e7mJBBfKNenDdhaLEIlDRwKTLj7k58f9srpMnyZFacntu5pUMNblB
+cjXwWxz5ZaQikLnKYhIvrIEwtWPyjqOzNXNvYfZamve/LJ8HmWGCKao3QHoAIDvB
+9XBxrDyTJDpxbog6Qu4SY8AdgVlan6c/PsLDc7EUegeYiNTzsOK+eq3G5/E92eIu
+TsUXlciypFcRm1q8vLRr+HYYe2mJDo4GetB1zLkAFBcYJm/x9iJQbu0hn5NxJvZO
+R0Y5nOJQdyi+muJzKYwhkuzaOlswzqVXkq/7+QCjg7QsycdcwDjiQh3OrsgXHrwl
+M7gyafL9ABEBAAGJAh8EGAEKAAkFAlUwGHYCGwwACgkQzUmgr8V5Kb50BxAAhj9T
+TwmNrgRldTHszj+Qc+v8RWqV6j+R+zc0cn5XlUa6XFaXI1OFFg71H4dhCPEiYeN0
+IrnocyMNvCol+eKIlPKbPTmoixjQ4udPTR1DC1Bx1MyW5FqOrsgBl5t0e1VwEViM
+NspSStxu5Hsr6oWz2GD48lXZWJOgoL1RLs+uxjcyjySD/em2fOKASwchYmI+ezRv
+plfhAFIMKTSCN2pgVTEOaaz13M0U+MoprThqF1LWzkGkkC7n/1V1f5tn83BWiagG
+2N2Q4tHLfyouzMUKnX28kQ9sXfxwmYb2sA9FNIgxy+TdKU2ofLxivoWT8zS189z/
+Yj9fErmiMjns2FzEDX+bipAw55X4D/RsaFgC+2x2PDbxeQh6JalRA2Wjq32Ouubx
+u+I4QhEDJIcVwt9x6LPDuos1F+M5QW0AiUhKrZJ17UrxOtaquh/nPUL9T3l2qPUn
+1ChrZEEEhHO6vA8+jn0+cV9n5xEz30Str9iHnDQ5QyR5LyV4UBPgTdWyQzNVKA69
+KsSr9lbHEtQFRzGuBKwt6UlSFv9vPWWJkJit5XDKAlcKuGXj0J8OlltToocGElkF
++gEBZfoOWi/IBjRLrFW2cT3p36DTR5O1Ud/1DLnWRqgWNBLrbs2/KMKE6EnHttyD
+7Tz8SQkuxltX/yBXMV3Ddy0t6nWV2SZEfuxJAQI=
+=spg4
 -----END PGP PUBLIC KEY BLOCK-----
 ```

conanfile.py

@@ -1,4 +1,5 @@
 import re
+import os
 
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 
@@ -126,6 +127,12 @@ class Xrpl(ConanFile):
         if self.settings.compiler in ["clang", "gcc"]:
             self.options["boost"].without_cobalt = True
 
+        # Check if environment variable exists
+        if "SANITIZERS" in os.environ:
+            sanitizers = os.environ["SANITIZERS"]
+            if "Address" in sanitizers:
+                self.default_options["fPIC"] = False
+
     def requirements(self):
         # Conan 2 requires transitive headers to be specified
         transitive_headers_opt = (

include/xrpl/basics/DecayingSample.h

@@ -69,8 +69,11 @@ private:
             }
             else
             {
-                while (elapsed--)
+                while (elapsed > 0)
+                {
+                    --elapsed;
                     m_value -= (m_value + Window - 1) / Window;
+                }
             }
         }
 

include/xrpl/basics/Number.h

@@ -4,7 +4,6 @@
 #include <xrpl/beast/utility/instrumentation.h>
 
 #include <cstdint>
-#include <functional>
 #include <limits>
 #include <optional>
 #include <ostream>

include/xrpl/beast/test/yield_to.h

@@ -47,7 +47,7 @@ public:
         : work_(boost::asio::make_work_guard(ios_))
     {
         threads_.reserve(concurrency);
-        while (concurrency--)
+        for (std::size_t i = 0; i < concurrency; ++i)
             threads_.emplace_back([&] { ios_.run(); });
     }
 

include/xrpl/core/Job.h

@@ -3,19 +3,16 @@
 
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/core/ClosureCounter.h>
+#include <xrpl/core/LoadMonitor.h>
 
 #include <functional>
-#include <memory>
 
 namespace xrpl {
 
-class LoadEvent;
-class LoadMonitor;
-
 // Note that this queue should only be used for CPU-bound jobs
 // It is primarily intended for signature checking
 
-enum JobType : int {
+enum JobType {
     // Special type indicating an invalid job - will go away soon.
     jtINVALID = -1,
 

include/xrpl/core/JobQueue.h

@@ -5,7 +5,6 @@
 #include <xrpl/core/ClosureCounter.h>
 #include <xrpl/core/JobTypeData.h>
 #include <xrpl/core/JobTypes.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/detail/Workers.h>
 #include <xrpl/json/json_value.h>
 

include/xrpl/core/JobTypeData.h

@@ -4,12 +4,9 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/insight/Collector.h>
 #include <xrpl/core/JobTypeInfo.h>
-#include <xrpl/core/LoadMonitor.h>
 
 namespace xrpl {
 
-enum JobType : int;
-
 struct JobTypeData
 {
 private:

include/xrpl/core/JobTypeInfo.h

@@ -1,13 +1,10 @@
 #ifndef XRPL_CORE_JOBTYPEINFO_H_INCLUDED
 #define XRPL_CORE_JOBTYPEINFO_H_INCLUDED
 
-#include <chrono>
-#include <string>
+#include <xrpl/core/Job.h>
 
 namespace xrpl {
 
-enum JobType : int;
-
 /** Holds all the 'static' information about a job, which does not change */
 class JobTypeInfo
 {

include/xrpl/core/LoadMonitor.h

@@ -3,14 +3,13 @@
 
 #include <xrpl/basics/UptimeClock.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/LoadEvent.h>
 
 #include <chrono>
 #include <mutex>
 
 namespace xrpl {
 
-class LoadEvent;
-
 // Monitors load levels and response times
 
 // VFALCO TODO Rename this. Having both LoadManager and LoadMonitor is

include/xrpl/core/PerfLog.h

@@ -1,8 +1,9 @@
 #ifndef XRPL_CORE_PERFLOG_H
 #define XRPL_CORE_PERFLOG_H
 
-#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/basics/BasicConfig.h>
 #include <xrpl/core/JobTypes.h>
+#include <xrpl/json/json_value.h>
 
 #include <boost/filesystem.hpp>
 
@@ -12,14 +13,11 @@
 #include <memory>
 #include <string>
 
-namespace Json {
-class Value;
+namespace beast {
+class Journal;
 }
 
-class Section;
-
 namespace xrpl {
-
 class Application;
 namespace perf {
 

include/xrpl/ledger/CredentialHelpers.h

@@ -7,13 +7,11 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 
 namespace xrpl {
-
-class STArray;
-class STTx;
-
 namespace credentials {
 
 // These function will be used by the code that use DepositPreauth / Credentials

include/xrpl/ledger/PaymentSandbox.h

@@ -1,6 +1,7 @@
 #ifndef XRPL_LEDGER_PAYMENTSANDBOX_H_INCLUDED
 #define XRPL_LEDGER_PAYMENTSANDBOX_H_INCLUDED
 
+#include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/Sandbox.h>
 #include <xrpl/ledger/detail/ApplyViewBase.h>
 #include <xrpl/protocol/AccountID.h>
@@ -9,9 +10,6 @@
 
 namespace xrpl {
 
-// Forward declarations
-class RawView;
-
 namespace detail {
 
 // VFALCO TODO Inline this implementation

include/xrpl/ledger/ReadView.h

@@ -12,17 +12,14 @@
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
 
 #include <cstdint>
-#include <memory>
 #include <optional>
 #include <unordered_set>
 
 namespace xrpl {
 
-class STTx;
-class STObject;
-
 //------------------------------------------------------------------------------
 
 /** A view into a ledger.

include/xrpl/nodestore/detail/varint.h

@@ -54,8 +54,9 @@ read_varint(void const* buf, std::size_t buflen, std::size_t& t)
         return 1;
     }
     auto const used = n;
-    while (n--)
+    while (n > 0)
     {
+        --n;
         auto const d = p[n];
         auto const t0 = t;
         t *= 127;

include/xrpl/protocol/Indexes.h

@@ -6,6 +6,7 @@
 #include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STXChainBridge.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/UintTypes.h>

include/xrpl/protocol/NFTSyntheticSerializer.h

@@ -2,14 +2,13 @@
 #define XRPL_PROTOCOL_NFTSYNTHETICSERIALIZER_H_INCLUDED
 
 #include <xrpl/json/json_forwards.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TxMeta.h>
 
 #include <memory>
 
 namespace xrpl {
 
-class STTx;
-class TxMeta;
-
 namespace RPC {
 
 /**

include/xrpl/protocol/NFTokenID.h

@@ -3,6 +3,8 @@
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_forwards.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TxMeta.h>
 
 #include <memory>
 #include <optional>
@@ -10,9 +12,6 @@
 
 namespace xrpl {
 
-class STTx;
-class TxMeta;
-
 /**
    Add a `nftoken_ids` field to the `meta` output parameter.
    The field is only added to successful NFTokenMint, NFTokenAcceptOffer,

include/xrpl/protocol/NFTokenOfferID.h

@@ -3,15 +3,14 @@
 
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_forwards.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TxMeta.h>
 
 #include <memory>
 #include <optional>
 
 namespace xrpl {
 
-class STTx;
-class TxMeta;
-
 /**
    Add an `offer_id` field to the `meta` output parameter.
    The field is only added to successful NFTokenCreateOffer transactions.

include/xrpl/protocol/Permissions.h

@@ -1,17 +1,15 @@
 #ifndef XRPL_PROTOCOL_PERMISSION_H_INCLUDED
 #define XRPL_PROTOCOL_PERMISSION_H_INCLUDED
 
-#include <xrpl/basics/base_uint.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
 
 #include <optional>
 #include <string>
 #include <unordered_map>
 
 namespace xrpl {
-
-class Rules;
-enum TxType : std::uint16_t;
 /**
  * We have both transaction type permissions and granular type permissions.
  * Since we will reuse the TransactionFormats to parse the Transaction

include/xrpl/protocol/STAmount.h

@@ -11,6 +11,7 @@
 #include <xrpl/protocol/MPTAmount.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
+#include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/protocol/json_get_or_throw.h>
 
@@ -394,10 +395,12 @@ inline STAmount::STAmount(IOUAmount const& amount, Issue const& issue)
     , mOffset(amount.exponent())
     , mIsNegative(amount < beast::zero)
 {
+    // Negate in unsigned domain to avoid undefined behavior when
+    // mantissa == INT64_MIN
     if (mIsNegative)
-        mValue = unsafe_cast<std::uint64_t>(-amount.mantissa());
+        mValue = -static_cast<std::uint64_t>(amount.mantissa());
     else
-        mValue = unsafe_cast<std::uint64_t>(amount.mantissa());
+        mValue = static_cast<std::uint64_t>(amount.mantissa());
 
     canonicalize();
 }
@@ -405,10 +408,12 @@ inline STAmount::STAmount(IOUAmount const& amount, Issue const& issue)
 inline STAmount::STAmount(MPTAmount const& amount, MPTIssue const& mptIssue)
     : mAsset(mptIssue), mOffset(0), mIsNegative(amount < beast::zero)
 {
+    // Negate in unsigned domain to avoid undefined behavior when
+    // value == INT64_MIN
     if (mIsNegative)
-        mValue = unsafe_cast<std::uint64_t>(-amount.value());
+        mValue = -static_cast<std::uint64_t>(amount.value());
     else
-        mValue = unsafe_cast<std::uint64_t>(amount.value());
+        mValue = static_cast<std::uint64_t>(amount.value());
 
     canonicalize();
 }

include/xrpl/protocol/STBase.h

@@ -5,6 +5,7 @@
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <ostream>
 #include <string>
 #include <type_traits>
 #include <typeinfo>

include/xrpl/protocol/TER.h

@@ -5,6 +5,8 @@
 #include <xrpl/json/json_value.h>
 
 #include <optional>
+#include <ostream>
+#include <string>
 #include <unordered_map>
 
 namespace xrpl {

include/xrpl/protocol/TxFormats.h

@@ -38,16 +38,13 @@ enum TxType : std::uint16_t
 {
 
 #pragma push_macro("TRANSACTION")
-#pragma push_macro("TRANSACTION_INCLUDE")
 #undef TRANSACTION
-#undef TRANSACTION_INCLUDE
 
 #define TRANSACTION(tag, value, ...) tag = value,
 
 #include <xrpl/protocol/detail/transactions.macro>
 
 #undef TRANSACTION
-#pragma pop_macro("TRANSACTION_INCLUDE")
 #pragma pop_macro("TRANSACTION")
 
     /** This transaction type is deprecated; it is retained for historical purposes. */

include/xrpl/protocol/nft.h

@@ -82,7 +82,12 @@ cipheredTaxon(std::uint32_t tokenSeq, Taxon taxon)
     // **IMPORTANT** Changing these numbers would be a breaking change requiring
     //               an amendment along with a way to distinguish token IDs that
     //               were generated with the old code.
-    return taxon ^ toTaxon(((384160001 * tokenSeq) + 2459));
+    // Note: The multiplication is intentionally allowed to overflow (wrap
+    // around) as part of the linear congruential generator algorithm.
+    return taxon ^
+        toTaxon(static_cast<std::uint32_t>(
+            (static_cast<std::uint64_t>(384160001) * tokenSeq + 2459) &
+            0xFFFFFFFF));
 }
 
 inline Taxon

include/xrpl/resource/Consumer.h

@@ -2,13 +2,11 @@
 #define XRPL_RESOURCE_CONSUMER_H_INCLUDED
 
 #include <xrpl/basics/Log.h>
+#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/resource/Charge.h>
 #include <xrpl/resource/Disposition.h>
 
 namespace xrpl {
-
-class PublicKey;
-
 namespace Resource {
 
 struct Entry;

include/xrpl/resource/detail/Entry.h

@@ -5,7 +5,6 @@
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/core/List.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/resource/detail/Key.h>
 #include <xrpl/resource/detail/Tuning.h>
 

sanitizers/suppressions/ubsan.supp

@@ -11,7 +11,6 @@ float-cast-overflow:external
 float-divide-by-zero:external
 function:external
 implicit-integer-sign-change:external
-implicit-signed-integer-truncation::external
 implicit-signed-integer-truncation:external
 implicit-unsigned-integer-truncation:external
 integer-divide-by-zero:external
@@ -71,134 +70,15 @@ vla-bound:boost
 vptr_check:boost
 vptr:boost
 
-# Google protobuf
+# Google protobuf - intentional overflows in hash functions
 undefined:protobuf
-
-# Suppress UBSan errors in rippled code by source file path
-undefined:src/libxrpl/basics/base64.cpp
-undefined:src/libxrpl/basics/Number.cpp
-undefined:src/libxrpl/beast/utility/beast_Journal.cpp
-undefined:src/libxrpl/crypto/RFC1751.cpp
-undefined:src/libxrpl/ledger/ApplyView.cpp
-undefined:src/libxrpl/ledger/View.cpp
-undefined:src/libxrpl/protocol/Permissions.cpp
-undefined:src/libxrpl/protocol/STAmount.cpp
-undefined:src/libxrpl/protocol/STPathSet.cpp
-undefined:src/libxrpl/protocol/tokens.cpp
-undefined:src/libxrpl/shamap/SHAMap.cpp
-undefined:src/test/app/Batch_test.cpp
-undefined:src/test/app/Invariants_test.cpp
-undefined:src/test/app/NFToken_test.cpp
-undefined:src/test/app/Offer_test.cpp
-undefined:src/test/app/Path_test.cpp
-undefined:src/test/basics/XRPAmount_test.cpp
-undefined:src/test/beast/LexicalCast_test.cpp
-undefined:src/test/jtx/impl/acctdelete.cpp
-undefined:src/test/ledger/SkipList_test.cpp
-undefined:src/test/rpc/Subscribe_test.cpp
-undefined:src/tests/libxrpl/basics/RangeSet.cpp
-undefined:src/xrpld/app/main/BasicApp.cpp
-undefined:src/xrpld/app/main/BasicApp.cpp
-undefined:src/xrpld/app/misc/detail/AmendmentTable.cpp
-undefined:src/xrpld/app/misc/NetworkOPs.cpp
-undefined:src/libxrpl/json/json_value.cpp
-undefined:src/xrpld/app/paths/detail/StrandFlow.h
-undefined:src/xrpld/app/tx/detail/NFTokenMint.cpp
-undefined:src/xrpld/app/tx/detail/SetOracle.cpp
-undefined:src/xrpld/core/detail/JobQueue.cpp
-undefined:src/xrpld/core/detail/Workers.cpp
-undefined:src/xrpld/rpc/detail/Role.cpp
-undefined:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
-undefined:xrpl/basics/base_uint.h
-undefined:xrpl/basics/DecayingSample.h
-undefined:xrpl/beast/test/yield_to.h
-undefined:xrpl/beast/xor_shift_engine.h
-undefined:xrpl/nodestore/detail/varint.h
-undefined:xrpl/peerfinder/detail/Counts.h
-undefined:xrpl/protocol/nft.h
-
-# basic_string.h:483:51: runtime error: unsigned integer overflow
-unsigned-integer-overflow:basic_string.h
-unsigned-integer-overflow:bits/chrono.h
-unsigned-integer-overflow:bits/random.h
-unsigned-integer-overflow:bits/random.tcc
-unsigned-integer-overflow:bits/stl_algobase.h
-unsigned-integer-overflow:bits/uniform_int_dist.h
-unsigned-integer-overflow:string_view
-
-# runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'std::size_t' (aka 'unsigned long')
-unsigned-integer-overflow:src/libxrpl/basics/base64.cpp
-unsigned-integer-overflow:src/libxrpl/basics/Number.cpp
-unsigned-integer-overflow:src/libxrpl/crypto/RFC1751.cpp
-unsigned-integer-overflow:rc/libxrpl/json/json_value.cpp
-unsigned-integer-overflow:src/libxrpl/ledger/ApplyView.cpp
-unsigned-integer-overflow:src/libxrpl/ledger/View.cpp
-unsigned-integer-overflow:src/libxrpl/protocol/Permissions.cpp
-unsigned-integer-overflow:src/libxrpl/protocol/STAmount.cpp
-unsigned-integer-overflow:src/libxrpl/protocol/STPathSet.cpp
-unsigned-integer-overflow:src/libxrpl/protocol/tokens.cpp
-unsigned-integer-overflow:src/libxrpl/shamap/SHAMap.cpp
-unsigned-integer-overflow:src/test/app/Batch_test.cpp
-unsigned-integer-overflow:src/test/app/Invariants_test.cpp
-unsigned-integer-overflow:src/test/app/NFToken_test.cpp
-unsigned-integer-overflow:src/test/app/Offer_test.cpp
-unsigned-integer-overflow:src/test/app/Path_test.cpp
-unsigned-integer-overflow:src/test/basics/XRPAmount_test.cpp
-unsigned-integer-overflow:src/test/beast/LexicalCast_test.cpp
-unsigned-integer-overflow:src/test/jtx/impl/acctdelete.cpp
-unsigned-integer-overflow:src/test/ledger/SkipList_test.cpp
-unsigned-integer-overflow:src/test/rpc/Subscribe_test.cpp
-unsigned-integer-overflow:src/tests/libxrpl/basics/RangeSet.cpp
-unsigned-integer-overflow:src/xrpld/app/main/BasicApp.cpp
-unsigned-integer-overflow:src/xrpld/app/misc/detail/AmendmentTable.cpp
-unsigned-integer-overflow:src/xrpld/app/misc/NetworkOPs.cpp
-unsigned-integer-overflow:src/xrpld/app/paths/detail/StrandFlow.h
-unsigned-integer-overflow:src/xrpld/app/tx/detail/NFTokenMint.cpp
-unsigned-integer-overflow:src/xrpld/app/tx/detail/SetOracle.cpp
-unsigned-integer-overflow:src/xrpld/rpc/detail/Role.cpp
-unsigned-integer-overflow:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
-unsigned-integer-overflow:xrpl/basics/base_uint.h
-unsigned-integer-overflow:xrpl/basics/DecayingSample.h
-unsigned-integer-overflow:xrpl/beast/test/yield_to.h
-unsigned-integer-overflow:xrpl/beast/xor_shift_engine.h
-unsigned-integer-overflow:xrpl/nodestore/detail/varint.h
-unsigned-integer-overflow:xrpl/peerfinder/detail/Counts.h
-unsigned-integer-overflow:xrpl/protocol/nft.h
-
-# Rippled intentional overflows and operations
-# STAmount uses intentional negation of INT64_MIN and overflow in arithmetic
-signed-integer-overflow:src/libxrpl/protocol/STAmount.cpp
-unsigned-integer-overflow:src/libxrpl/protocol/STAmount.cpp
-
-# XRPAmount test intentional overflows
-signed-integer-overflow:src/test/basics/XRPAmount_test.cpp
-
-# Peerfinder intentional overflow in counter arithmetic
-unsigned-integer-overflow:src/xrpld/peerfinder/detail/Counts.h
-
-# Signed integer overflow suppressions
-signed-integer-overflow:src/test/beast/LexicalCast_test.cpp
-
-# External library suppressions
-unsigned-integer-overflow:nudb/detail/xxhash.hpp
-
-# Protobuf intentional overflows in hash functions
-# Protobuf uses intentional unsigned overflow for hash computation (stringpiece.h:393)
 unsigned-integer-overflow:google/protobuf/stubs/stringpiece.h
 
-# gRPC intentional overflows
-# gRPC uses intentional overflow in timer calculations
+# gRPC intentional overflows in timer calculations
 unsigned-integer-overflow:grpc
 unsigned-integer-overflow:timer_manager.cc
 
-# Standard library intentional overflows
-# These are intentional overflows in random number generation and character conversion
-unsigned-integer-overflow:__random/seed_seq.h
-unsigned-integer-overflow:__charconv/traits.h
-
-
-# Suppress errors in RocksDB
-# RocksDB uses intentional unsigned integer overflows in hash functions and CRC calculations
+# RocksDB intentional unsigned integer overflows in hash functions and CRC calculations
 unsigned-integer-overflow:rocks*/*/util/xxhash.h
 unsigned-integer-overflow:rocks*/*/util/xxph3.h
 unsigned-integer-overflow:rocks*/*/util/hash.cc
@@ -210,13 +90,14 @@ unsigned-integer-overflow:rocks*/*/table/format.cc
 unsigned-integer-overflow:rocks*/*/table/block_based/block_based_table_builder.cc
 unsigned-integer-overflow:rocks*/*/table/block_based/reader_common.cc
 unsigned-integer-overflow:rocks*/*/db/version_set.cc
-
-# RocksDB misaligned loads (intentional for performance on ARM64)
 alignment:rocks*/*/util/crc32c_arm64.cc
+undefined:rocks.*/*/util/crc32c_arm64.cc
+undefined:rocks.*/*/util/xxhash.h
 
 # nudb intentional overflows in hash functions
 unsigned-integer-overflow:nudb/detail/xxhash.hpp
 alignment:nudb/detail/xxhash.hpp
+undefined:nudb
 
 # Snappy compression library intentional overflows
 unsigned-integer-overflow:snappy.cc
@@ -228,10 +109,88 @@ unsigned-integer-overflow:absl/base/internal/low_level_alloc.cc
 unsigned-integer-overflow:absl/hash/internal/hash.h
 unsigned-integer-overflow:absl/container/internal/raw_hash_set.h
 
-# Standard library intentional overflows in chrono duration arithmetic
+# Standard library intentional overflows
+unsigned-integer-overflow:basic_string.h
+unsigned-integer-overflow:bits/chrono.h
+unsigned-integer-overflow:bits/random.h
+unsigned-integer-overflow:bits/random.tcc
+unsigned-integer-overflow:bits/stl_algobase.h
+unsigned-integer-overflow:bits/uniform_int_dist.h
+unsigned-integer-overflow:string_view
+unsigned-integer-overflow:__random/seed_seq.h
+unsigned-integer-overflow:__charconv/traits.h
 unsigned-integer-overflow:__chrono/duration.h
 
-# Suppress undefined errors in RocksDB and nudb
-undefined:rocks.*/*/util/crc32c_arm64.cc
-undefined:rocks.*/*/util/xxhash.h
-undefined:nudb
+# =============================================================================
+# Rippled code suppressions
+# =============================================================================
+
+# Intentional overflows and wraparound arithmetic in rippled code
+# These are by design and mathematically correct for their use cases
+
+# base_uint.h: Increment/decrement operators intentionally wrap around
+unsigned-integer-overflow:xrpl/basics/base_uint.h
+
+# Safe loop patterns that trigger UBSAN (e.g., while(len-- && ...))
+# These are mathematically sound patterns where underflow is handled correctly
+unsigned-integer-overflow:src/libxrpl/basics/base64.cpp
+unsigned-integer-overflow:src/libxrpl/basics/Number.cpp
+unsigned-integer-overflow:src/libxrpl/crypto/RFC1751.cpp
+unsigned-integer-overflow:src/libxrpl/json/json_value.cpp
+unsigned-integer-overflow:src/libxrpl/ledger/ApplyView.cpp
+unsigned-integer-overflow:src/libxrpl/ledger/View.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/Permissions.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/STPathSet.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/tokens.cpp
+unsigned-integer-overflow:src/libxrpl/shamap/SHAMap.cpp
+unsigned-integer-overflow:src/test/app/Batch_test.cpp
+unsigned-integer-overflow:src/test/app/Invariants_test.cpp
+unsigned-integer-overflow:src/test/app/NFToken_test.cpp
+unsigned-integer-overflow:src/test/app/Offer_test.cpp
+unsigned-integer-overflow:src/test/app/Path_test.cpp
+unsigned-integer-overflow:src/test/jtx/impl/acctdelete.cpp
+unsigned-integer-overflow:src/test/ledger/SkipList_test.cpp
+unsigned-integer-overflow:src/test/rpc/Subscribe_test.cpp
+unsigned-integer-overflow:src/tests/libxrpl/basics/RangeSet.cpp
+unsigned-integer-overflow:src/xrpld/app/misc/detail/AmendmentTable.cpp
+unsigned-integer-overflow:src/xrpld/app/misc/NetworkOPs.cpp
+unsigned-integer-overflow:src/xrpld/app/paths/detail/StrandFlow.h
+unsigned-integer-overflow:src/xrpld/app/tx/detail/NFTokenMint.cpp
+unsigned-integer-overflow:src/xrpld/app/tx/detail/SetOracle.cpp
+unsigned-integer-overflow:src/xrpld/rpc/detail/Role.cpp
+unsigned-integer-overflow:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
+unsigned-integer-overflow:xrpl/beast/xor_shift_engine.h
+
+# General undefined behavior suppressions for rippled code
+# These files have patterns that UBSAN flags but are safe in context
+undefined:src/libxrpl/basics/base64.cpp
+undefined:src/libxrpl/basics/Number.cpp
+undefined:src/libxrpl/beast/utility/beast_Journal.cpp
+undefined:src/libxrpl/crypto/RFC1751.cpp
+undefined:src/libxrpl/json/json_value.cpp
+undefined:src/libxrpl/ledger/ApplyView.cpp
+undefined:src/libxrpl/ledger/View.cpp
+undefined:src/libxrpl/protocol/Permissions.cpp
+undefined:src/libxrpl/protocol/STPathSet.cpp
+undefined:src/libxrpl/protocol/tokens.cpp
+undefined:src/libxrpl/shamap/SHAMap.cpp
+undefined:src/test/app/Batch_test.cpp
+undefined:src/test/app/Invariants_test.cpp
+undefined:src/test/app/NFToken_test.cpp
+undefined:src/test/app/Offer_test.cpp
+undefined:src/test/app/Path_test.cpp
+undefined:src/test/jtx/impl/acctdelete.cpp
+undefined:src/test/ledger/SkipList_test.cpp
+undefined:src/test/rpc/Subscribe_test.cpp
+undefined:src/tests/libxrpl/basics/RangeSet.cpp
+undefined:src/xrpld/app/misc/detail/AmendmentTable.cpp
+undefined:src/xrpld/app/misc/NetworkOPs.cpp
+undefined:src/xrpld/app/paths/detail/StrandFlow.h
+undefined:src/xrpld/app/tx/detail/NFTokenMint.cpp
+undefined:src/xrpld/app/tx/detail/SetOracle.cpp
+undefined:src/xrpld/core/detail/JobQueue.cpp
+undefined:src/xrpld/core/detail/Workers.cpp
+undefined:src/xrpld/rpc/detail/Role.cpp
+undefined:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
+undefined:xrpl/basics/base_uint.h
+undefined:xrpl/beast/xor_shift_engine.h

src/libxrpl/beast/core/CurrentThreadName.cpp

@@ -89,14 +89,14 @@ setCurrentThreadNameImpl(std::string_view name)
 
     pthread_setname_np(pthread_self(), boundedName);
 
-#ifdef TRUNCATED_THREAD_NAME_LOGS
-    if (name.size() > maxThreadNameLength)
-    {
-        std::cerr << "WARNING: Thread name \"" << name << "\" (length "
-                  << name.size() << ") exceeds maximum of "
-                  << maxThreadNameLength << " characters on Linux.\n";
-    }
-#endif
+    // #ifdef TRUNCATED_THREAD_NAME_LOGS
+    //     if (name.size() > maxThreadNameLength)
+    //     {
+    //         std::cerr << "WARNING: Thread name \"" << name << "\" (length "
+    //                   << name.size() << ") exceeds maximum of "
+    //                   << maxThreadNameLength << " characters on Linux.\n";
+    //     }
+    // #endif
 }
 
 }  // namespace beast::detail

src/libxrpl/core/detail/Job.cpp

@@ -1,7 +1,5 @@
 #include <xrpl/beast/core/CurrentThreadName.h>
 #include <xrpl/core/Job.h>
-#include <xrpl/core/LoadEvent.h>
-#include <xrpl/core/LoadMonitor.h>
 
 namespace xrpl {
 

src/libxrpl/core/detail/JobQueue.cpp

@@ -1,6 +1,5 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/core/JobQueue.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/PerfLog.h>
 
 #include <mutex>

src/libxrpl/core/detail/LoadMonitor.cpp

@@ -1,6 +1,5 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/UptimeClock.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/LoadMonitor.h>
 
 namespace xrpl {

src/libxrpl/ledger/ApplyView.cpp

@@ -1,7 +1,6 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/ApplyView.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Protocol.h>
 
 #include <limits>

src/libxrpl/ledger/CredentialHelpers.cpp

@@ -1,7 +1,5 @@
 #include <xrpl/ledger/CredentialHelpers.h>
 #include <xrpl/ledger/View.h>
-#include <xrpl/protocol/STArray.h>
-#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/digest.h>
 

src/libxrpl/ledger/OpenView.cpp

@@ -1,6 +1,5 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/ledger/OpenView.h>
-#include <xrpl/protocol/STTx.h>
 
 namespace xrpl {
 

src/libxrpl/ledger/PaymentSandbox.cpp

@@ -1,6 +1,5 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/ledger/PaymentSandbox.h>
-#include <xrpl/ledger/RawView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/protocol/SField.h>
 

src/libxrpl/ledger/View.cpp

@@ -2,7 +2,6 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/CredentialHelpers.h>
 #include <xrpl/ledger/Credit.h>
 #include <xrpl/ledger/ReadView.h>

src/libxrpl/nodestore/Database.cpp

@@ -1,9 +1,7 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/beast/core/CurrentThreadName.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/nodestore/Backend.h>
 #include <xrpl/nodestore/Database.h>
-#include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/jss.h>
 

src/libxrpl/protocol/MPTAmount.cpp

@@ -19,7 +19,10 @@ MPTAmount::operator-=(MPTAmount const& other)
 MPTAmount
 MPTAmount::operator-() const
 {
-    return MPTAmount{-value_};
+    // Cast to unsigned before negating to avoid undefined behavior
+    // when value_ == INT64_MIN
+    return MPTAmount{
+        static_cast<value_type>(-static_cast<std::uint64_t>(value_))};
 }
 
 bool

src/libxrpl/protocol/Permissions.cpp

@@ -1,8 +1,6 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Permissions.h>
-#include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/jss.h>
 
 namespace xrpl {

src/libxrpl/protocol/STAmount.cpp

@@ -64,16 +64,17 @@ getInt64Value(STAmount const& amount, bool valid, char const* error)
     XRPL_ASSERT(
         amount.exponent() == 0, "xrpl::getInt64Value : exponent is zero");
 
-    auto ret = static_cast<std::int64_t>(amount.mantissa());
-
     XRPL_ASSERT(
-        static_cast<std::uint64_t>(ret) == amount.mantissa(),
+        amount.mantissa() <= static_cast<std::uint64_t>(
+                                 std::numeric_limits<std::int64_t>::max()),
         "xrpl::getInt64Value : mantissa must roundtrip");
 
+    // Negate in unsigned domain then cast to signed to avoid undefined
+    // behavior when mantissa would represent INT64_MIN as signed
     if (amount.negative())
-        ret = -ret;
+        return static_cast<std::int64_t>(-amount.mantissa());
 
-    return ret;
+    return static_cast<std::int64_t>(amount.mantissa());
 }
 
 static std::int64_t
@@ -231,10 +232,12 @@ STAmount::STAmount(std::uint64_t mantissa, bool negative)
 STAmount::STAmount(XRPAmount const& amount)
     : mAsset(xrpIssue()), mOffset(0), mIsNegative(amount < beast::zero)
 {
+    // Negate in unsigned domain to avoid undefined behavior when
+    // amount.drops() == INT64_MIN
     if (mIsNegative)
-        mValue = unsafe_cast<std::uint64_t>(-amount.drops());
+        mValue = -static_cast<std::uint64_t>(amount.drops());
     else
-        mValue = unsafe_cast<std::uint64_t>(amount.drops());
+        mValue = static_cast<std::uint64_t>(amount.drops());
 
     canonicalize();
 }
@@ -269,11 +272,12 @@ STAmount::xrp() const
         Throw<std::logic_error>(
             "Cannot return non-native STAmount as XRPAmount");
 
-    auto drops = static_cast<XRPAmount::value_type>(mValue);
     XRPL_ASSERT(mOffset == 0, "xrpl::STAmount::xrp : amount is canonical");
 
-    if (mIsNegative)
-        drops = -drops;
+    // Cast to unsigned, negate if needed, then cast to signed to avoid
+    // undefined behavior when mValue would represent INT64_MIN as signed
+    auto drops = mIsNegative ? static_cast<XRPAmount::value_type>(-mValue)
+                             : static_cast<XRPAmount::value_type>(mValue);
 
     return XRPAmount{drops};
 }
@@ -284,11 +288,12 @@ STAmount::iou() const
     if (integral())
         Throw<std::logic_error>("Cannot return non-IOU STAmount as IOUAmount");
 
-    auto mantissa = static_cast<std::int64_t>(mValue);
     auto exponent = mOffset;
 
-    if (mIsNegative)
-        mantissa = -mantissa;
+    // Negate in unsigned domain then cast to signed to avoid undefined
+    // behavior when mValue would represent INT64_MIN as signed
+    auto mantissa = mIsNegative ? static_cast<std::int64_t>(-mValue)
+                                : static_cast<std::int64_t>(mValue);
 
     return {mantissa, exponent};
 }
@@ -299,11 +304,12 @@ STAmount::mpt() const
     if (!holds<MPTIssue>())
         Throw<std::logic_error>("Cannot return STAmount as MPTAmount");
 
-    auto value = static_cast<MPTAmount::value_type>(mValue);
     XRPL_ASSERT(mOffset == 0, "xrpl::STAmount::mpt : amount is canonical");
 
-    if (mIsNegative)
-        value = -value;
+    // Negate in unsigned domain then cast to signed to avoid undefined
+    // behavior when mValue would represent INT64_MIN as signed
+    auto value = mIsNegative ? static_cast<MPTAmount::value_type>(-mValue)
+                             : static_cast<MPTAmount::value_type>(mValue);
 
     return MPTAmount{value};
 }
@@ -384,9 +390,22 @@ operator+(STAmount const& v1, STAmount const& v2)
     }
 
     if (v1.native())
-        return {v1.getFName(), getSNValue(v1) + getSNValue(v2)};
+    {
+        // Perform addition in unsigned domain to avoid signed overflow UB,
+        // then cast back to signed for the STAmount constructor
+        auto const sum = static_cast<std::int64_t>(
+            static_cast<std::uint64_t>(getSNValue(v1)) +
+            static_cast<std::uint64_t>(getSNValue(v2)));
+        return {v1.getFName(), sum};
+    }
     if (v1.holds<MPTIssue>())
-        return {v1.mAsset, v1.mpt().value() + v2.mpt().value()};
+    {
+        // Perform addition in unsigned domain to avoid signed overflow UB
+        auto const sum = static_cast<MPTAmount::value_type>(
+            static_cast<std::uint64_t>(v1.mpt().value()) +
+            static_cast<std::uint64_t>(v2.mpt().value()));
+        return {v1.mAsset, sum};
+    }
 
     if (getSTNumberSwitchover())
     {
@@ -399,11 +418,13 @@ operator+(STAmount const& v1, STAmount const& v2)
     std::int64_t vv1 = static_cast<std::int64_t>(v1.mantissa());
     std::int64_t vv2 = static_cast<std::int64_t>(v2.mantissa());
 
+    // Negate in unsigned domain then cast back to signed to avoid UB
+    // when vv1 or vv2 would represent INT64_MIN
     if (v1.negative())
-        vv1 = -vv1;
+        vv1 = static_cast<std::int64_t>(-static_cast<std::uint64_t>(vv1));
 
     if (v2.negative())
-        vv2 = -vv2;
+        vv2 = static_cast<std::int64_t>(-static_cast<std::uint64_t>(vv2));
 
     while (ov1 < ov2)
     {
@@ -433,8 +454,9 @@ operator+(STAmount const& v1, STAmount const& v2)
             ov1,
             false};
 
+    // Negate in unsigned domain to avoid potential UB
     return STAmount{
-        v1.getFName(), v1.asset(), static_cast<std::uint64_t>(-fv), ov1, true};
+        v1.getFName(), v1.asset(), -static_cast<std::uint64_t>(fv), ov1, true};
 }
 
 STAmount
@@ -973,7 +995,9 @@ STAmount::set(std::int64_t v)
     if (v < 0)
     {
         mIsNegative = true;
-        mValue = static_cast<std::uint64_t>(-v);
+        // Cast to unsigned before negating to avoid undefined behavior
+        // when v == INT64_MIN (negating INT64_MIN in signed is UB)
+        mValue = -static_cast<std::uint64_t>(v);
     }
     else
     {

src/libxrpl/protocol/TER.cpp

@@ -1,11 +1,9 @@
-#include <xrpl/json/json_value.h>
 #include <xrpl/protocol/TER.h>
 
 #include <boost/range/adaptor/transformed.hpp>
 #include <boost/range/iterator_range_core.hpp>
 
 #include <optional>
-#include <ostream>
 #include <string>
 #include <unordered_map>
 #include <utility>

src/libxrpl/resource/Consumer.cpp

@@ -1,7 +1,6 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/resource/Charge.h>
 #include <xrpl/resource/Consumer.h>
 #include <xrpl/resource/Disposition.h>

src/libxrpl/shamap/SHAMap.cpp

@@ -1,13 +1,9 @@
 #include <xrpl/basics/TaggedCache.ipp>
 #include <xrpl/basics/contract.h>
-#include <xrpl/shamap/Family.h>
 #include <xrpl/shamap/SHAMap.h>
 #include <xrpl/shamap/SHAMapAccountStateLeafNode.h>
-#include <xrpl/shamap/SHAMapInnerNode.h>
-#include <xrpl/shamap/SHAMapLeafNode.h>
 #include <xrpl/shamap/SHAMapNodeID.h>
 #include <xrpl/shamap/SHAMapSyncFilter.h>
-#include <xrpl/shamap/SHAMapTreeNode.h>
 #include <xrpl/shamap/SHAMapTxLeafNode.h>
 #include <xrpl/shamap/SHAMapTxPlusMetaLeafNode.h>
 

src/test/app/ValidatorSite_test.cpp

@@ -163,7 +163,7 @@ private:
             std::vector<Validator> list;
             std::string uri;
             FetchListConfig const& cfg;
-            bool isRetry;
+            bool isRetry{false};
         };
         std::vector<publisher> servers;
 

src/test/basics/XRPAmount_test.cpp

@@ -223,7 +223,13 @@ public:
                 mulRatio(big, 3, 4, false).value() == (big.value() / 4) * 3);
             BEAST_EXPECT(
                 mulRatio(big, 3, 4, true).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT((big.value() * 3) / 4 != (big.value() / 4) * 3);
+            // Cast to unsigned to avoid signed overflow UB while still
+            // demonstrating the naive approach gives wrong results
+            BEAST_EXPECT(
+                static_cast<std::int64_t>(
+                    static_cast<std::uint64_t>(big.value()) * 3) /
+                    4 !=
+                (big.value() / 4) * 3);
         }
 
         {
@@ -239,7 +245,13 @@ public:
                 mulRatio(big, 3, 4, false).value() == (big.value() / 4) * 3);
             BEAST_EXPECT(
                 mulRatio(big, 3, 4, true).value() == (big.value() / 4) * 3);
-            BEAST_EXPECT((big.value() * 3) / 4 != (big.value() / 4) * 3);
+            // Cast to unsigned to avoid signed overflow UB while still
+            // demonstrating the naive approach gives wrong results
+            BEAST_EXPECT(
+                static_cast<std::int64_t>(
+                    static_cast<std::uint64_t>(big.value()) * 3) /
+                    4 !=
+                (big.value() / 4) * 3);
         }
 
         {

src/test/beast/LexicalCast_test.cpp

@@ -19,7 +19,7 @@ public:
     testInteger(IntType in)
     {
         std::string s;
-        IntType out(in + 1);
+        IntType out{};  // Initialize to avoid relying on overflow behavior
 
         expect(lexicalCastChecked(s, in));
         expect(lexicalCastChecked(out, s));

src/xrpld/app/ledger/AcceptedLedgerTx.cpp

@@ -2,8 +2,6 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/StringUtilities.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/jss.h>
 

src/xrpld/app/ledger/AcceptedLedgerTx.h

@@ -4,8 +4,6 @@
 #include <xrpld/app/ledger/Ledger.h>
 
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TxFormats.h>
 
 #include <boost/container/flat_set.hpp>
 

src/xrpld/app/ledger/InboundLedger.h

@@ -7,8 +7,6 @@
 #include <xrpld/overlay/PeerSet.h>
 
 #include <xrpl/basics/CountedObject.h>
-#include <xrpl/shamap/SHAMapAddNode.h>
-#include <xrpl/shamap/SHAMapSyncFilter.h>
 
 #include <mutex>
 #include <set>

src/xrpld/app/ledger/Ledger.cpp

@@ -23,7 +23,6 @@
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/digest.h>
 #include <xrpl/protocol/jss.h>
-#include <xrpl/shamap/SHAMap.h>
 
 #include <utility>
 #include <vector>

src/xrpld/app/ledger/Ledger.h

@@ -9,7 +9,6 @@
 #include <xrpl/ledger/CachedView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/TxMeta.h>
@@ -17,7 +16,6 @@
 
 namespace xrpl {
 
-// Forward declarations
 class Application;
 class Job;
 class TransactionMaster;

src/xrpld/app/main/Application.cpp

@@ -28,7 +28,6 @@
 #include <xrpld/app/rdb/RelationalDatabase.h>
 #include <xrpld/app/rdb/Wallet.h>
 #include <xrpld/app/tx/apply.h>
-#include <xrpld/core/Config.h>
 #include <xrpld/core/DatabaseCon.h>
 #include <xrpld/overlay/Cluster.h>
 #include <xrpld/overlay/PeerReservationTable.h>

src/xrpld/app/main/Application.h

@@ -1,6 +1,9 @@
 #ifndef XRPL_APP_MAIN_APPLICATION_H_INCLUDED
 #define XRPL_APP_MAIN_APPLICATION_H_INCLUDED
 
+#include <xrpld/core/Config.h>
+#include <xrpld/overlay/PeerReservationTable.h>
+
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/beast/utility/PropertyStream.h>
 #include <xrpl/protocol/Protocol.h>
@@ -13,10 +16,6 @@
 
 namespace xrpl {
 
-// Forward declarations
-class Config;
-class PeerReservationTable;
-
 namespace unl {
 class Manager;
 }

src/xrpld/app/main/BasicApp.cpp

@@ -9,11 +9,10 @@ BasicApp::BasicApp(std::size_t numberOfThreads)
     work_.emplace(boost::asio::make_work_guard(io_context_));
     threads_.reserve(numberOfThreads);
 
-    while (numberOfThreads--)
+    for (std::size_t i = 0; i < numberOfThreads; ++i)
     {
-        threads_.emplace_back([this, numberOfThreads]() {
-            beast::setCurrentThreadName(
-                "io svc #" + std::to_string(numberOfThreads));
+        threads_.emplace_back([this, i]() {
+            beast::setCurrentThreadName("io svc #" + std::to_string(i));
             this->io_context_.run();
         });
     }

src/xrpld/app/misc/AmendmentTable.h

@@ -6,9 +6,7 @@
 
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/STValidation.h>
-#include <xrpl/protocol/TxFormats.h>
 
 #include <optional>
 

src/xrpld/app/misc/NegativeUNLVote.cpp

@@ -2,8 +2,6 @@
 #include <xrpld/app/ledger/Ledger.h>
 #include <xrpld/app/misc/NegativeUNLVote.h>
 
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TxFormats.h>
 #include <xrpl/shamap/SHAMapItem.h>
 
 namespace xrpl {

src/xrpld/app/misc/NetworkOPs.cpp

@@ -38,7 +38,6 @@
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/basics/scope.h>
 #include <xrpl/beast/utility/rngfill.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/crypto/RFC1751.h>
 #include <xrpl/crypto/csprng.h>

src/xrpld/app/misc/PermissionedDEXHelpers.cpp

@@ -1,7 +1,6 @@
 #include <xrpld/app/misc/PermissionedDEXHelpers.h>
 
 #include <xrpl/ledger/CredentialHelpers.h>
-#include <xrpl/protocol/STBlob.h>
 
 namespace xrpl {
 namespace permissioned_dex {

src/xrpld/app/misc/SHAMapStoreImp.cpp

@@ -1,4 +1,3 @@
-#include <xrpld/app/ledger/LedgerMaster.h>
 #include <xrpld/app/ledger/TransactionMaster.h>
 #include <xrpld/app/misc/NetworkOPs.h>
 #include <xrpld/app/misc/SHAMapStoreImp.h>
@@ -7,7 +6,6 @@
 #include <xrpld/core/ConfigSections.h>
 
 #include <xrpl/beast/core/CurrentThreadName.h>
-#include <xrpl/nodestore/DatabaseRotating.h>
 #include <xrpl/nodestore/Scheduler.h>
 #include <xrpl/nodestore/detail/DatabaseRotatingImp.h>
 #include <xrpl/shamap/SHAMapMissingNode.h>

src/xrpld/app/paths/detail/StepChecks.h

@@ -6,7 +6,6 @@
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/ledger/View.h>
 #include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/UintTypes.h>
 
 namespace xrpl {

src/xrpld/app/tx/applySteps.h

@@ -3,7 +3,6 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyViewImpl.h>
-#include <xrpl/protocol/SeqProxy.h>
 
 namespace xrpl {
 

src/xrpld/app/tx/detail/Offer.h

@@ -4,7 +4,6 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/ledger/View.h>
-#include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/Quality.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>

src/xrpld/overlay/detail/ConnectAttempt.cpp

@@ -3,12 +3,8 @@
 #include <xrpld/overlay/detail/PeerImp.h>
 #include <xrpld/overlay/detail/ProtocolVersion.h>
 
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/json/json_reader.h>
 
-#include <boost/beast/core/tcp_stream.hpp>
-#include <boost/beast/ssl/ssl_stream.hpp>
-
 #include <sstream>
 
 namespace xrpl {

src/xrpld/overlay/detail/OverlayImpl.cpp

@@ -1,4 +1,3 @@
-#include <xrpld/app/main/Application.h>
 #include <xrpld/app/misc/HashRouter.h>
 #include <xrpld/app/misc/NetworkOPs.h>
 #include <xrpld/app/misc/ValidatorList.h>
@@ -12,17 +11,14 @@
 #include <xrpld/overlay/detail/Tuning.h>
 #include <xrpld/overlay/predicates.h>
 #include <xrpld/peerfinder/make_Manager.h>
-#include <xrpld/rpc/ServerHandler.h>
 #include <xrpld/rpc/handlers/GetCounts.h>
 #include <xrpld/rpc/json_body.h>
 
-#include <xrpl/basics/Resolver.h>
 #include <xrpl/basics/base64.h>
 #include <xrpl/basics/make_SSLContext.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/beast/core/LexicalCast.h>
 #include <xrpl/protocol/STTx.h>
-#include <xrpl/server/Handoff.h>
 #include <xrpl/server/SimpleWriter.h>
 
 #include <boost/algorithm/string/predicate.hpp>

src/xrpld/overlay/detail/PeerImp.cpp

@@ -17,7 +17,6 @@
 #include <xrpl/basics/base64.h>
 #include <xrpl/basics/random.h>
 #include <xrpl/basics/safe_cast.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/digest.h>

src/xrpld/peerfinder/detail/Counts.h

@@ -231,15 +231,25 @@ public:
 
     //--------------------------------------------------------------------------
 private:
+    // Helper to safely adjust a size_t counter by a signed value
+    static void
+    adjustCounter(std::size_t& counter, int const n)
+    {
+        if (n >= 0)
+            counter += static_cast<std::size_t>(n);
+        else
+            counter -= static_cast<std::size_t>(-n);
+    }
+
     // Adjusts counts based on the specified slot, in the direction indicated.
     void
     adjust(Slot const& s, int const n)
     {
         if (s.fixed())
-            m_fixed += n;
+            adjustCounter(m_fixed, n);
 
         if (s.reserved())
-            m_reserved += n;
+            adjustCounter(m_reserved, n);
 
         switch (s.state())
         {
@@ -261,15 +271,15 @@ private:
 
             case Slot::active:
                 if (s.fixed())
-                    m_fixed_active += n;
+                    adjustCounter(m_fixed_active, n);
                 if (!s.fixed() && !s.reserved())
                 {
                     if (s.inbound())
-                        m_in_active += n;
+                        adjustCounter(m_in_active, n);
                     else
-                        m_out_active += n;
+                        adjustCounter(m_out_active, n);
                 }
-                m_active += n;
+                adjustCounter(m_active, n);
                 break;
 
             case Slot::closing:

src/xrpld/rpc/detail/RPCHandler.cpp

@@ -13,7 +13,6 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/core/JobQueue.h>
-#include <xrpl/core/LoadEvent.h>
 #include <xrpl/core/PerfLog.h>
 #include <xrpl/json/to_string.h>
 #include <xrpl/protocol/ErrorCodes.h>

src/xrpld/rpc/handlers/Reservations.cpp

@@ -1,4 +1,3 @@
-#include <xrpld/overlay/PeerReservationTable.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/handlers/Handlers.h>