★ Bridge ecrecover checks result ≠ address(0)
Fluid's assessment for RD-F-151 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] For the CCIP path: CCIP OffRamp.sol does NOT use raw ecrecover for message verification. Signature verification is delegated to the RMN remote contract (i_rmnRemote.verify()). This is a contract-level verification, not a raw ecrecover call. Therefore the ecrecover != address(0) vulnerability class (Wormhole pattern) does not apply to CCIP. For the LayerZero OFT path: LayerZero V2 uses DVN-based verification, not raw ecrecover in the standard path. F151 green for CCIP. LayerZero path: verification is DVN-based at the endpoint level, not raw ecrecover; F151 pattern not applicable to LZ V2.
Sources #
- GitHubCCIP OffRamp — RMN verification, not ecrecovercode-423n4/2024-11-chainlink OffRamp.sol line 815 — i_rmnRemote.verify() not ecrecoverretrieved 2026-04-29
Methodology #
Determine whether the bridge verifier code rejects `ecrecover` returns of `address(0)`.
See the full factor methodology and distribution across all protocols →