Audit-to-deploy gap

Chainlink CCIP's assessment for RD-F-006 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Code4rena Nov-2024 ended 2024-11-25; CCIP v1.5 live Jan 2025 (~60 days gap, at green boundary). Cyfrin Jul-2024 ended 2024-07-17; v1.5 launched Jan 2025 (~180 days, yellow/red boundary). Cyfrin scope was limited to CCT token pools (subset). Nov-2024 to v1.6 launch May 2025: ~176 days. Mixed signals across engagements; yellow overall.

Sources #

Docs
CCIP Release NotesCCIP v1.5 launch January 2025; v1.6 launch May 2025 per profile §2retrieved 2026-05-16
URL
Cyfrin CCIP v1.5 audit (Jul 2024) — start-to-end Jul 2–17 2024Cyfrin Jul-2024 audit end date and scoperetrieved 2026-05-16

Methodology #

Measure the number of days between the audit report sign-off date and the mainnet deploy of the audited bytecode.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-006 score yellow collected_at 2026-05-16 01:55:09