Deployed bytecode matches signed release tag
Chainlink CCIP's assessment for RD-F-136 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
CCIP uses redeployment (not proxy upgrade). Contracts are verified on Etherscan providing source-to-bytecode confirmation at verification time. No signed release-tag commit was directly matched against deployed bytecode (would require local build reproduction). Partial credit: Etherscan verification confirms source-bytecode alignment. Full deterministic build reproduction not confirmed.
Sources #
- EtherscanCCIP Router — Etherscan verified sourceCCIP core contracts verified on Etherscan — Router, ARMProxy, ARM impl, MCMS, RBACTimelock all show verified sourceretrieved 2026-05-16
- Code4rena 2024-11-chainlink audit repoCode4rena 2024-11 repo pinned to audit commit for v1.5/v1.6 contractsretrieved 2026-05-16
Methodology #
Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-136 score yellow collected_at 2026-05-16 01:55:09