Attacker wallet pre-strike probe (low-gas failing txs)
Chainlink CCIP's assessment for RD-F-159 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Applicable — pre-strike probe pattern (low-gas failing txs to OnRamp/OffRamp from CTI-flagged addresses). No confirmed pre-strike probe pattern detected via public OSINT. CCIP's architecture means useful reconnaissance requires actual valid cross-chain message attempts, not just failing low-gas txs. PH signal; mempool + CTI feed required; v1 phase 2 infra scope.
Sources #
- InternalChainlink CCIP profile — incidents section.research/protocols/chainlink-ccip/00-profile.md §10 — no known protocol exploits or reconnaissance patterns documentedretrieved 2026-05-16
Methodology #
Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-159 score gray collected_at 2026-05-16 01:55:09