★ Immutable oracle address
Chainlink CCIP's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL-CANDIDATE, held per PD-017 - NOT counted in 19-star total] YELLOW - partial match. FeeQuoter dataFeedAddress fields are admin-settable (not EVM immutable); DON/RMN sets are configurable via MCMS governance. However, the DON operator set is not trustlessly replaceable (requires MCMS corporate governance), creating an embedded-oracle corporate-liveness dependency. The EVM-immutable-address failure mode does not map cleanly to CCIP (it is not a lending protocol with collateral oracle addresses). Failure mode is DON liveness dependency, not oracle-address-immutability causing collateral mispricing. Score: YELLOW for partial embedded-oracle concern; NOT RED because oracle address is technically replaceable by admin action and CCIP is not a lending protocol.
Sources #
- GitHubChainlink CCIP FeeQuoter.sol - oracle address replaceabilityFeeQuoter.sol - applyTokenTransferFeeConfigUpdates and setTokenPriceFeedConfig functions show dataFeedAddress is admin-settable, not EVM immutableretrieved 2026-05-16
- CCIP Upgradability - Chainlink DocumentationCCIP upgradability docs - MCMS governance enables admin-controlled reconfiguration of oracle/node setsretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →