Blockchains and cryptocurrencies, like Ripple, are becoming more widely used. Testing the large decentralized systems these technologies on is complex, as the behavior of the system is dependent on many external factors. We will examine the viability of using passive model inference techniques to test the systems based on the network traffic they produce. Passive inference techniques have been used extensively to model and test different types of systems. However, it is unclear how well passive model inference techniques work for inferring models of large decentralized systems based on the network traffic that these systems produce. Here we show that detecting bugs in the implementations of decentralized protocols is possible. These results were achieved by simulating a version of the Ripple network and modeling the workings of a node in this network. We also simulated the network with defective nodes and by observing the different models generated, were able to detect these bugs. Our results suggest that using passive model inference techniques on network traffic can help test large decentralized systems.

The Ripple XRP Ledger network hosts a cryptocurrency called XRP which uses the TLS protocol to send messages between nodes. It is crucial that the network is tested against attacks to ensure its security. The Ripple XRP Ledger could be vulnerable to a Man-in-the-Middle (MITM) attack. This MITM attack is an attack which can intercept and modify data by posing as intended receiver of the message. Potentially, this could have major implications as message content could be intercepted and used maliciously. Therefore this paper aims to answer the question: ``Is it possible to conduct a TLS MITM attack on the XRP ledger to gain access to message content and how does such an attack affect the performance of the system?". The research done in this paper concluded that it is possible to conduct a TLS MITM attack on the XRP Ledger. The impact on performance is a delay in the travel time of a message. However, how big this delay is, is dependent on the network the attack is executed on. In the tested environment it was roughly adding a 69.2\% delay to a message. Future research is necessary to be able to modify the message content and to confirm if the larger the delay added by the MITM, the higher the probability that the MITM is detected.