{
  "label": "Automated Test Drive. Not a BULWARK rating.",
  "mode": "fork",
  "previewNote": "Phase 1 is an on-chain snapshot at Ethereum block 26419147 and Robinhood block 114822546. Phase 2 and Phase 3 run the six scenarios as signed test-key messages on a Foundry fork at the same block: 8 signatures -> FAILURE, 9 -> SUCCESS; owner impersonation is fork-only. No transaction was sent to mainnet.",
  "snapshotAt": "2026-11-15T08:16:08.229Z",
  "block": 26419147,
  "chain": "Ethereum",
  "thresholdsVersion": "CCIP-2.0-fork-1",
  "signedBy": "Signed by Owner",
  "rateLimitThresholdPct": 10,
  "router": {
    "ethereum": "0x80226fc0Ee2b096224EeAc085Bb9a8cba1146f7D",
    "robinhood": "0x06fC836cf9839B1cd891C440A0a45242DA6Ae1c9"
  },
  "tokens": [
    {
      "symbol": "rsETH",
      "issuer": "Kelp",
      "chain": "Ethereum",
      "address": "0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7",
      "pool": "0x55e5a21B4cCC7FA502434ab1109D4EDe0397AB25",
      "generations": [
        "1.5.1"
      ],
      "overall": "amber",
      "headline": "Pool v1.5.1 across five connected routes; no mandatory CCV. The Ethereum pool holds 12,097 rsETH against 338,073 supply.",
      "checks": {
        "verifier": {
          "light": "amber",
          "value": "Committee 9-of-15 (0x7BcE1A3297604CAFa601f05799b6Ed98e8c01B7F); one default CCV resolver (0x2CaAfd3B...C03b), no lane-mandated CCV. A forged report was rejected on the fork."
        },
        "routeGeneration": {
          "light": "amber",
          "value": "Pool LockReleaseTokenPool 1.5.1; the lane is v2.0.0 but the pool stays generation 1.5.1 on five connected routes."
        },
        "rateLimit": {
          "light": "green",
          "value": "Inbound buckets: 300 rsETH/24h on Mantle, Base, Ink and Linea (aggregate 1,200/day = 9.9% of the 12,097 rsETH locked in the pool); OP Mainnet 42 rsETH cap with a 1 wei/s refill. 30% of supply is 101,422 rsETH, above locked liquidity."
        },
        "admin": {
          "light": "amber",
          "value": "Pool owner Safe 6-of-11 (0xb3696a81...a46d); rate-limit admin Safe 3-of-N; no pool timelock. Committee owner is an RBACTimelock with a 10800s delay."
        },
        "finality": {
          "light": "amber",
          "value": "Committee verifier allows block depth 1 (0x00000001). On the fork, a finality=1 token transfer was accepted by the v1.5.1 pool and released 1 rsETH. Exposure is bounded by the 300 rsETH/24h bucket; there is no separate fast-lane value cap."
        }
      },
      "notes": [
        "Pool type LockReleaseTokenPool 1.5.1; token admin 0xb3696a817D01C8623E66D156B6798291fa10a46d; pool owner 0xb3696a817D01C8623E66D156B6798291fa10a46d.",
        "Source: Chainlink CCIP API /v2/tokens and /v2/lanes; on-chain reads and signed-message fork tests at Ethereum block 26419147.",
        "Connected remote chains: Mantle Mainnet, Base Mainnet, Ink Mainnet, OP Mainnet, Linea Mainnet.",
        "Dynamic fork: 8 signatures -> FAILURE; 9 -> SUCCESS with 1 rsETH released; 300 rsETH release -> SUCCESS; next 1 rsETH -> FAILURE; finality=1 -> SUCCESS (fast-lane finding)."
      ]
    },
    {
      "symbol": "LBTC",
      "issuer": "Lombard",
      "chain": "Ethereum",
      "address": "0x8236a87084f8B84306f72007F36F2618A5634494",
      "pool": "0x626BdEe51E85A127eb6A08ed79c68a4b7AC80b4A",
      "generations": [
        "2.1.0"
      ],
      "overall": "amber",
      "headline": "Mandatory CCV on every connected route, but the CCV and pool share the same 3-of-5 Safe.",
      "checks": {
        "verifier": {
          "light": "amber",
          "value": "Committee 9-of-15 + mandatory CCV 0xd314336866369adf98EDC14F95Ed05eD87CC74A8 on 12 routes. That CCV is owned by the same Safe 3-of-5 as the pool, so one quorum can change both."
        },
        "routeGeneration": {
          "light": "green",
          "value": "Pool LombardTokenPool 2.1.0; 12 connected routes (BNB Chain Mainnet, Solana, Berachain Mainnet, Etherlink Mainnet, Base Mainnet, Sonic Mainnet, Stable Mainnet, Katana Mainnet, TAC Mainnet, Megaeth Mainnet, Avalanche Mainnet, Monad Mainnet)."
        },
        "rateLimit": {
          "light": "green",
          "value": "Outbound bucket 50 LBTC capacity, 462,963 (8dp)/s = 400 LBTC/24h on Base. Supply 6,099.29 LBTC; 30% is 1,829.79 LBTC, about 4.6 days at the refill rate."
        },
        "admin": {
          "light": "amber",
          "value": "Pool owner Safe 3-of-5 (0x251a604E...4892); no timelock. The same Safe owns the mandatory CCV."
        },
        "finality": {
          "light": "green",
          "value": "Pool allowedFinalityConfig 0x00000000 (finalized only); the verifier allows 0x00000001 but the pool gate keeps pre-finality execution closed."
        }
      },
      "notes": [
        "Pool type LombardTokenPool 2.1.0; token admin 0x055E84e7FE8955E2781010B866f10Ef6E1E77e59; pool owner 0x251a604E8E8f6906d60f8dedC5aAeb8CD38F4892.",
        "Source: Chainlink CCIP API /v2/tokens and /v2/lanes for chain selector 5009297550715157269; on-chain reads at Ethereum block 26419147.",
        "Connected remote chains: BNB Chain Mainnet, Solana, Berachain Mainnet, Etherlink Mainnet, Base Mainnet, Sonic Mainnet, Stable Mainnet, Katana Mainnet, TAC Mainnet, Megaeth Mainnet, Avalanche Mainnet, Monad Mainnet.",
        "Fork measurements: mandatory CCV and pool share Safe 3-of-5; outbound 50 LBTC cap and 400 LBTC/day; supply 6,099.29 LBTC; 30% clears in about 4.6 days."
      ]
    },
    {
      "symbol": "WBTC",
      "issuer": "BitGo",
      "chain": "Ethereum",
      "address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
      "pool": "0xd69C2E9aAfA500F66275740750CE43c16302aa74",
      "generations": [
        "2.0.0"
      ],
      "overall": "red",
      "headline": "Large value, v2.0 siloed pool, no mandatory CCV reported.",
      "checks": {
        "verifier": {
          "light": "amber",
          "value": "Committee 9-of-15; no lane-mandated CCV."
        },
        "routeGeneration": {
          "light": "green",
          "value": "Pool SiloedLockReleaseTokenPool 2.0.0; 2 connected routes (XDC Mainnet, Ronin Mainnet)."
        },
        "rateLimit": {
          "light": "amber",
          "value": "Bucket 5 WBTC cap per route (XDC, Ronin). Supply 116,132.18 WBTC; the pool holds no token balance because the siloed pool uses lockboxes."
        },
        "admin": {
          "light": "red",
          "value": "Pool owner 0x1b75deFBc33b258Dad7cAe37fc8c983D46fbCA26 is an EOA (no code); a single key can change the pool."
        },
        "finality": {
          "light": "green",
          "value": "Finality mode finalized; allowedFinalityConfig 0x00000000."
        }
      },
      "notes": [
        "Pool type SiloedLockReleaseTokenPool 2.0.0; token admin 0x1b75deFBc33b258Dad7cAe37fc8c983D46fbCA26; pool owner 0x1b75deFBc33b258Dad7cAe37fc8c983D46fbCA26.",
        "Source: Chainlink CCIP API /v2/tokens and /v2/lanes for chain selector 5009297550715157269; on-chain reads at Ethereum block 26419147.",
        "Connected remote chains: XDC Mainnet, Ronin Mainnet.",
        "Supply 116,132.18 WBTC; pool token balance 0 because the siloed pool holds balances in per-chain lockboxes."
      ]
    },
    {
      "symbol": "cbBTC",
      "issuer": "Coinbase",
      "chain": "Robinhood Chain",
      "address": "0xCEC185eB182c47d1bA1EFc84e6959e18cd620Be4",
      "pool": "0x402430ca607c52a99Aa82AB4C726001D4203C9e7",
      "generations": [
        "1.6.1"
      ],
      "overall": "amber",
      "headline": "Robinhood Chain lane is v2.0.0 with a v1.6.1 cbBTC pool; route to Base only.",
      "checks": {
        "verifier": {
          "light": "amber",
          "value": "Committee 9-of-15; no lane-mandated CCV."
        },
        "routeGeneration": {
          "light": "amber",
          "value": "Lane Base → Robinhood is v2.0.0; the cbBTC pool is BurnMintTokenPool 1.6.1, so the token path mixes a v2.0 lane with a legacy pool."
        },
        "rateLimit": {
          "light": "amber",
          "value": "100 cbBTC/day configured; v1.6 bucket state not readable with the v2 ABI."
        },
        "admin": {
          "light": "green",
          "value": "Pool owner 0xf09AFe78d3c7d359b334d7cB88995751F7eC5E13 is a timelock with 3h (10800s) delay."
        },
        "finality": {
          "light": "green",
          "value": "No fast lane reported; v1.6 pool."
        }
      },
      "notes": [
        "Pool type BurnMintTokenPool 1.6.1; token admin 0xf09AFe78d3c7d359b334d7cB88995751F7eC5E13; pool owner 0xf09AFe78d3c7d359b334d7cB88995751F7eC5E13.",
        "Source: Chainlink CCIP API /v2/tokens and /v2/lanes for chain selector 6180753054346818345; on-chain reads at Ethereum block 26419147.",
        "Connected remote chains: Base Mainnet.",
        "The Base → Robinhood lane is v2.0.0 (OffRamp 0x5060De90...), so there is no v1.6 OCR commit/execution lane on this token path; the legacy surface is the 1.6.1 pool."
      ]
    }
  ],
  "scenarios": [
    {
      "id": "frontal-drain",
      "title": "Frontal Drain",
      "test": "testFrontalDrainBelowThreshold + testFrontalDrainAtThreshold",
      "status": "passed",
      "gas": 1425912,
      "light": "green",
      "result": "Fork: 8 signatures -> execution state FAILURE, no rsETH released; 9 signatures -> SUCCESS, 1 rsETH released. Live quorum 9-of-15.",
      "executed": true
    },
    {
      "id": "pole-test",
      "title": "Pole Test",
      "test": "testPoleThresholdChange",
      "status": "passed",
      "gas": 516642,
      "light": "amber",
      "result": "Fork: the timelock lowered the verifier threshold from 9 to 1. The pool owner is a Safe 6-of-11; the rate-limit admin is a 3-of-N Safe. There is no pool timelock.",
      "executed": true
    },
    {
      "id": "side-impact",
      "title": "Side Impact",
      "test": "testLbtcWithoutMandatoryCcv",
      "status": "passed",
      "gas": 610954,
      "light": "amber",
      "result": "Fork: an LBTC message with full committee signatures but without the mandatory CCV -> FAILURE. The mandatory CCV 0xd314...74A8 must sign. The rsETH lane has one default CCV and no alternate.",
      "executed": true
    },
    {
      "id": "rollover",
      "title": "Rollover",
      "test": "testRolloverRateLimit",
      "status": "passed",
      "gas": 1242588,
      "light": "amber",
      "result": "Fork: a 300 rsETH release -> SUCCESS; the next 1 rsETH release at the same bucket -> FAILURE. Buckets are per source chain; OP is 42 rsETH with a 1 wei/s refill.",
      "executed": true
    },
    {
      "id": "rear-impact",
      "title": "Rear Impact",
      "test": "testRearImpactLiquidity",
      "status": "passed",
      "gas": 25682,
      "light": "amber",
      "result": "Fork: locked 12,097 rsETH is below 30% of supply (101,422). At 4 x 300/day the locked balance drains in 10 days; 30% of supply cannot return from this pool.",
      "executed": true
    },
    {
      "id": "fast-lane",
      "title": "Fast Lane",
      "test": "testFastLaneBeforeFinality",
      "status": "passed",
      "gas": 801939,
      "light": "amber",
      "result": "Fork: a finality=1 message was accepted by the v1.5.1 pool and released 1 rsETH. Exposure is bounded by the 300 rsETH/24h bucket; there is no separate fast-lane value cap.",
      "executed": true
    }
  ],
  "evidence": {
    "phase1": [
      "/results/CCIP-rsETH.json",
      "/results/CCIP-LBTC.json",
      "/results/CCIP-WBTC.json",
      "/results/CCIP-cbBTC.json"
    ],
    "phase2": "/results/CR-1007-exec.json",
    "phase3": "/results/CR-1007-lbtc-exec.json",
    "thresholds": "/results/thresholds.json",
    "liveRead": "/results/CCIP-live-read.json",
    "committee": "/results/CCIP-committee.json",
    "lane": "/results/CCIP-lane.json",
    "addressMap": "/results/CCIP-address-map.json",
    "ci": "/results/CCIP-ci.json",
    "notice": "/results/CCIP-notice.json",
    "fork": "/results/CCIP-fork.json",
    "signoff": "/results/CR-1007-signoff.json"
  },
  "source": "Chainlink CCIP API + eth_call reads for committee, lane, pool, rate-limit and owner type",
  "robinhoodBlock": 114822546,
  "committee": {
    "verifier": "0x7BcE1A3297604CAFa601f05799b6Ed98e8c01B7F",
    "resolver": "0x2CaAfd3B4Cf606220580c885Bd2B448FB93dC03b",
    "signerCount": 15,
    "threshold": 9,
    "owner": "0x44835bBBA9D40DEDa9b64858095EcFB2693c9449",
    "ownerTimelockSeconds": 10800,
    "source": "CommitteeVerifier.getSignatureConfig(6180753054346818345) + eth_call",
    "allowedFinality": "0x00000001",
    "note": "The verifier allows block depth 1. LBTC pool finality remains 0x00000000; the rsETH legacy pool has no finality getter."
  },
  "lane": {
    "ethereumToRobinhood": {
      "version": "2.0.0",
      "onRamp": "0xc3423F3FB30857D9C14717b119884b1B63d250b7",
      "offRamp": "0x5060De90b723a7Eb705742Ff1a22a908b1D8b626",
      "defaultCCV": "0x2CaAfd3B4Cf606220580c885Bd2B448FB93dC03b",
      "laneMandatedCCVs": []
    },
    "robinhoodToEthereum": {
      "version": "2.0.0",
      "onRamp": "0xE86CeddDAEfa1999AaE234C056B51877BFfBD73f",
      "offRamp": "0x408428bca0e24A25ac8baAc1b70f64AF257717c3",
      "defaultCCV": "0x2CaAfd3B4Cf606220580c885Bd2B448FB93dC03b",
      "laneMandatedCCVs": []
    },
    "rmnRemote": "0x411dE17f12D1A34ecC7F45f49844626267c75e81",
    "rmnCursedSubjects": 17,
    "rmnCursedForCheckedSelectors": false,
    "note": "ARM proxy returns 17 legacy curse subjects; none matches the six selectors used here. Chainlink docs say RMN is not active as a second checker in the current CCIP deployment.",
    "owners": {
      "ethereumOffRamp": {
        "address": "0x408428bca0e24A25ac8baAc1b70f64AF257717c3",
        "owner": "0x44835bBBA9D40DEDa9b64858095EcFB2693c9449",
        "type": "RBACTimelock",
        "delaySeconds": 10800
      },
      "ethereumOnRamp": {
        "address": "0xc3423F3FB30857D9C14717b119884b1B63d250b7",
        "owner": "0x44835bBBA9D40DEDa9b64858095EcFB2693c9449",
        "type": "RBACTimelock",
        "delaySeconds": 10800
      },
      "robinhoodOffRamp": {
        "address": "0x5060De90b723a7Eb705742Ff1a22a908b1D8b626",
        "owner": "0xf09AFe78d3c7d359b334d7cB88995751F7eC5E13",
        "type": "timelock",
        "delaySeconds": 10800,
        "readAt": "latest"
      },
      "robinhoodOnRamp": {
        "address": "0xE86CeddDAEfa1999AaE234C056B51877BFfBD73f",
        "owner": "0xf09AFe78d3c7d359b334d7cB88995751F7eC5E13",
        "type": "timelock",
        "delaySeconds": 10800,
        "readAt": "latest"
      }
    }
  },
  "fork": {
    "block": 26419147,
    "chain": "Ethereum",
    "rpc": "https://mainnet.gateway.tenderly.co",
    "executedAt": "2026-11-15T10:42:00.000Z",
    "command": "FOUNDRY_PROFILE=dynamic forge test --match-contract 'CcipDynamicTest|CcipDynamicScenariosTest' -vv; FOUNDRY_PROFILE=default forge test --match-contract CcipForkTest -vv",
    "tests": {
      "total": 19,
      "passed": 19,
      "failed": 0
    },
    "limits": "Read-only calls plus owner impersonation on an isolated Ethereum fork at block 26419147. No transaction was sent to mainnet. Forged reports were rejected; no signed-message replay was performed."
  },
  "scenariosLbtc": [
    {
      "id": "frontal-drain",
      "title": "Frontal Drain",
      "test": "testLbtcWithoutMandatoryCcv",
      "status": "passed",
      "gas": 610954,
      "light": "green",
      "result": "Fork: an LBTC message with full committee signatures but without the mandatory CCV -> FAILURE. The mandatory CCV 0xd314...74A8 is required on the inbound path.",
      "executed": true
    },
    {
      "id": "pole-test",
      "title": "Pole Test",
      "test": "testPoleThresholdChange",
      "status": "passed",
      "gas": 516642,
      "light": "amber",
      "result": "Fork: the LBTC pool and mandatory CCV share the same Safe 3-of-5. The Safe enabled 1-block finality on the fork; there is no timelock.",
      "executed": true
    },
    {
      "id": "side-impact",
      "title": "Side Impact",
      "test": "testSideImpactMandatoryCcvPresent",
      "status": "passed",
      "gas": 610680,
      "light": "amber",
      "result": "Fork: a committee-only LBTC message -> FAILURE. The mandatory CCV is the only path; there is no alternate CCV.",
      "executed": true
    },
    {
      "id": "rollover",
      "title": "Rollover",
      "test": "testRolloverRateLimit",
      "status": "passed",
      "gas": 1242588,
      "light": "green",
      "result": "Fork: the outbound bucket is 50 LBTC capacity with a 400 LBTC/24h refill. Supply is 6,099.29 LBTC.",
      "executed": true
    },
    {
      "id": "rear-impact",
      "title": "Rear Impact",
      "test": "testRearImpactLiquidity",
      "status": "passed",
      "gas": 25682,
      "light": "green",
      "result": "Fork: 30% of supply is 1,829.79 LBTC; at 400 LBTC/day the queue is about 4.6 days. Pool balance is zero because this is a burn/mint pool.",
      "executed": true
    },
    {
      "id": "fast-lane",
      "title": "Fast Lane",
      "test": "testLbtcWithoutMandatoryCcv",
      "status": "passed",
      "gas": 610954,
      "light": "green",
      "result": "Fork: the pool allowedFinalityConfig is 0x00000000 and the verifier allows 0x00000001; the pool gate keeps pre-finality execution closed.",
      "executed": true
    }
  ]
}