★ Default bytes32(0) acceptable as valid root
Chainlink CCIP's assessment for RD-F-154 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] GREEN - PASS. OffRamp.sol commit function line 919: 'if (merkleRoot == bytes32(0)) revert InvalidRoot()'. The Nomad-class zero-root acceptance vulnerability is explicitly guarded. bytes32(0) root cannot be committed; the attack vector of accepting any message against a zero default root is blocked.
Sources #
- AuditCode4rena November 2024 Chainlink CCIP AuditCode4rena 2024-11 Chainlink CCIP audit - OffRamp.sol within audit scope; $235K pool; 5 wardens received payouts indicating review coverageretrieved 2026-05-16
- Chainlink CCIP OffRamp.sol - bytes32(0) root rejection (2024-11 audit scope)OffRamp.sol line 919: 'if (merkleRoot == bytes32(0)) revert InvalidRoot()' - explicit Nomad-class guardretrieved 2026-05-16
Methodology #
Determine whether the bridge inbox accepts a default-value (bytes32(0)) Merkle root as a valid proof root (Nomad bug class).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-154 score green collected_at 2026-05-16 01:55:09