★ Default bytes32(0) acceptable as valid root

Wormhole's assessment for RD-F-154 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Default-value (bytes32(0)) acceptable as valid root | GREEN — Wormhole does not use a Merkle root acceptance model. VAA trust is derived from ECDSA signatures against a known guardian key set (ecrecover with address(0) check). There is no `committedRoot` storage slot analogous to Nomad's `Replica` contract. The double-hash of the VAA body (`keccak256(keccak256(body))`) is the signed message — it is computed from the message content, not loaded from storage. Even if a zero-hash were somehow su...

Sources #

Curator note
Extracted from 03-oracle-deps.md — RD-F-154; no URL citedretrieved 2026-04-28

Methodology #

Determine whether the bridge inbox accepts a default-value (bytes32(0)) Merkle root as a valid proof root (Nomad bug class).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol wormhole factor RD-F-154 score gray collected_at 2026-04-28 01:38:43