★ Default bytes32(0) acceptable as valid root

Pendle Finance's assessment for RD-F-154 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[★ CRITICAL — GREEN] Pendle's bridge architecture does not use a Merkle-root-based bridge design. No bytes32 root acceptance pattern in PendleMsgReceiveEndpointUpg.sol. The mustOriginateFromSendEndpoint modifier checks address and chain ID (not a root). Nomad-class default-root bug does not apply to this architecture. This ★ factor does not fire.

Sources #

GitHub
PendleMsgReceiveEndpointUpg.solPendleMsgReceiveEndpointUpg.sol — no root-based validationretrieved 2026-04-29

Methodology #

Determine whether the bridge inbox accepts a default-value (bytes32(0)) Merkle root as a valid proof root (Nomad bug class).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol pendle factor RD-F-154 score green collected_at 2026-04-28 21:09:40