Fallback behavior on oracle failure

Chainlink CCIP's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

FeeQuoter has designed fallback: Keystone stale -> AggregatorV3. However AggregatorV3 staleness deliberately unchecked per code comment: 'data feed staleness is unchecked in the FeeQuoter to decouple it from data feed delay issues'. Token transfer validity path has no oracle fallback - if DON + RMN both fail, transfers halt. Fee errors do not cause fund loss.

Sources #

URL
Chainlink CCIP Architecture Explainer - LlamariskLlamarisk CCIP research - DON failure mode: messages halt, manual execution possibleretrieved 2026-05-16
GitHub
Chainlink CCIP FeeQuoter.sol - fallback oracle behaviorFeeQuoter.sol - explicit code comment: 'data feed staleness is unchecked in the FeeQuoter to decouple it from data feed delay issues'; fallback logic from Keystone to AggregatorV3retrieved 2026-05-16

Methodology #

Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-051 score yellow collected_at 2026-05-16 01:55:09