Is it possible to execute a double-spending attack in Ripple during a network split? From the spec (emphasis added):


  Under a net split, a ledger may be closed by the minority of network, this ledger may be discarded in the future.


Does this mean it would be possible to spend twice, once on each side of the split?

Even if the transaction is merely rejected later, you could trick a merchant into accepting your payment, then take delivery, and then let the network reject the transaction once the split is resolved. Is this correct? How would the minority of the nodes know that they're separated from the rest of the network?
Ripple should be immune to this attack because a transaction is not considered validated until an overwhelming majority of validators (that you care about) have signed a receipt saying that they have processed it (by validating a ledger that includes it either in that ledger or in one of its prior ledgers). If the network had split, you could not receive receipts from an overwhelming majority of validators.

Ripple servers have an internal "gate". They continue to track the network, try to reach a consensus, sign validations, and so on. But they don't report transactions as confirmed to clients until they pass this internal gate. To pass the gate, a ledger must have sufficient validations from trusted sources. Once a ledger meets that threshold, the gate is advanced to just past that ledger and everything up to that new point is considered fully validated.

Anything after the gate is in flux, subject to consensus with other validators. Everything behind the gate is forever committed. The overwhelming majority of validators have committed to it.

If you are on the minority side of a split (or even the slight majority side of a bad split), no transactions will pass the gate. The network will be unusable, but nobody will rely on a transaction that gets undone when a split is resolved.

In exchange for immunity to this attack and in exchange for Ripple's fast confirmations with no proof of work needed, a price is paid. One can imagine situations where transactions might fail to pass the gate even though there's no network split. For example, if a large number of validators suddenly stop validating all at the same time, you might think you're split off from them, and manual intervention might be needed to permit any transactions to pass the gate.