★ Default bytes32(0) acceptable as valid root

Fluid's assessment for RD-F-154 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[★ CRITICAL] CCIP OffRamp.sol explicitly rejects bytes32(0) merkle roots: 'if (merkleRoot == bytes32(0)) revert InvalidRoot()' (line 850 per code review). This explicitly prevents the Nomad $190M bug class where default-value roots were accepted as valid. Green — CCIP explicitly guards against this pattern.

Sources #

GitHub
CCIP OffRamp — explicit bytes32(0) root rejectioncode-423n4/2024-11-chainlink OffRamp.sol line 850 — if (merkleRoot == bytes32(0)) revert InvalidRoot()retrieved 2026-04-29

Methodology #

Determine whether the bridge inbox accepts a default-value (bytes32(0)) Merkle root as a valid proof root (Nomad bug class).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol fluid factor RD-F-154 score green collected_at 2026-04-29 10:35:01