Bridge binds message to srcChainId
Lombard Finance's assessment for RD-F-152 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Mailbox/GMP path: inbound messages validated against $.inboundMessagePath[payload.msgPath] which encodes remote mailbox + chain; srcChainId is implicitly bound via path ID (path-based srcChainId binding). BridgeV2: chainId extracted via $.mailbox.getInboundMessagePath(payload.msgPath); rate limits keyed by (sourceChain, token) pair. CCIP path: sourceChainSelector is native to Chainlink's Any2EVMMessage struct; received by Lombard's TokenPool via CCIP's structured message format. All three active bridge paths bind messages to their source chain identifier.
Sources #
- GitHub
- Lombard BridgeV2.sol sourceBridgeV2.sol — (sourceChain, token) keyed rate limitsretrieved 2026-05-05
Methodology #
Determine whether the bridge message struct includes `srcChainId` and the verifier enforces per-chain separation.
See the full factor methodology and distribution across all protocols →