Bridge binds message to srcChainId

Chainlink CCIP's assessment for RD-F-152 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

OCR3 commit reports include source chain selector as part of per-chain Merkle root trees. OffRamp s_roots mapping indexed by [sourceChainSelector][merkleRoot]. Messages bound to origin chain, preventing cross-chain replay via chain-selector mismatch.

Sources #

Docs
CCIP Architecture Overview - Chainlink DocumentationCCIP architecture overview - per-source-chain Merkle roots in CommitReportretrieved 2026-05-16
GitHub
Chainlink CCIP OffRamp.sol (2024-11 Code4rena audit scope)OffRamp.sol: s_roots[sourceChainSelector][merkleRoot] = block.timestamp; chain selector binding enforced in commit and execute pathsretrieved 2026-05-16

Methodology #

Determine whether the bridge message struct includes `srcChainId` and the verifier enforces per-chain separation.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-152 score green collected_at 2026-05-16 01:55:09