Chainlink CCIP

Approved for: positions on Ethereum. The limits are in the memo below.

Review open since 2026-09-30: A published event names Chainlink CCIP: Chainlink launches CCIP 2.0 with configurable verification and finality. The verdict stands until the review closes.

CCIP is approved with limits as a dependency, with a different research finding from its nearest competitor. CCIP is Chainlink’s cross-chain messaging layer. Like LayerZero, reviewed separately in this registry and rejected, it is infrastructure that other protocols use to build bridges and cross-chain products, not a position that can be allocated to directly. Its tracked TVL likely double-counts value already reflected in downstream integrators pending entity resolution. The key difference from LayerZero is that CCIP runs an independent Risk Management Network on every message by default. It has its own node operators and codebase and can halt cross-chain activity network-wide if it detects a message that the primary oracle network did not independently verify. That directly targets the failure mode that let LayerZero’s April 2026 incident succeed: a single-verifier configuration an integrator chose or defaulted into. CCIP does not let an integration skip this check. The live governance gap is that the multisig signers who control CCIP’s security configuration are not publicly disclosed. This remains a bounded, disclosed risk rather than a reason for rejection.

Review triggers: events that reopen the verdict
• Any confirmed exploit of CCIP’s Committing or Executing DON, or of the Risk Management Network infrastructure
• The Risk Management Network node-operator set is found to overlap with the primary DON operators, breaking the independence claim
• Multisig signer identities remain undisclosed at the next review, escalating a standing transparency gap unresolved past 12 months
• A specific Ketju-relevant integration is found to bypass or under-configure the default Risk Management Network check

Watched nightly. The review opened 2026-09-30 is shown under the verdict above; the memo stands as issued until it closes.

The research file

Mechanism

CCIP uses two separate systems for every message. Chainlink’s existing Decentralized Oracle Networks (the Committing and Executing DONs) transmit and execute cross-chain messages. A separate Risk Management Network independently re-observes each message and can ”curse,” or stop cross-chain activity in an emergency, if it detects a Merkle root containing messages it did not independently verify. Under LayerZero’s DVN model, an integrator opts into extra verifiers, and many default to a single LayerZero-run DVN. By contrast, the RMN check runs by default, and an integration cannot weaken it through poor configuration.

Independence of the Risk Management Network

According to Chainlink’s own technical documentation, the RMN uses a separate set of node operators and shares no nodes with the transactional DONs. A separate internal team built it in Rust, while the primary system uses Go. This creates planned diversity in both personnel and implementation language, rather than a renamed committee that draws on the same infrastructure. This design feature most directly addresses the exact failure mode exploited in the Kelp DAO/LayerZero incident.

Governance

Security-critical CCIP configuration changes go through an on-chain RBACTimelock that uses a ManyChainMultiSig structure, with one signature set covering many chains. Node operators can veto a pending change during the timelock window or fast-track approval for urgent fixes. That is a real, documented way to hold the process to account, but the specific multisig signers are not publicly disclosed. Chainlink calls this standard industry practice, but it remains a real transparency gap that the timelock does not close.

Incident record and dependency framing

This review identified no confirmed CCIP protocol-level exploit through its 2026-08-17 cutoff. Market behavior after the LayerZero incident is a relevant, though secondary, signal. CCIP is reported to have gained more than $2.5B in TVL from protocols migrating away from LayerZero, including Kraken Bitcoin. Like LayerZero, this entry should be treated as a dependency rather than a position that can be exited directly. CCIP itself holds no client funds to withdraw or redeem, so there is no bridge-level exit queue or redemption gate to test. Any Ketju-approved position that routes through a CCIP-secured integration takes on that integration’s own withdrawal and redemption terms. This approval does not cover a position custom-configured to bypass the default RMN path.

Comparison

Compared with LayerZero V2, which this registry rejects, CCIP’s always-on, independently coded RMN provides a stronger default. An integrator cannot skip or weaken verification through poor configuration as the Kelp DAO deployment did. The remaining open weakness is the lack of clear governance, including undisclosed multisig signers, rather than a gap in the verification architecture itself. This is why the registry supports CCIP with stated conditions instead of reaching an adverse research finding.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Chainlink — CCIP’s defense-in-depth security and the Risk Management Network · primary · accessed 2026-08-17
  Supports: RMN independence, separate codebase and team
• Chainlink — CCIP: the secure and decentralized cross-chain standard · primary · accessed 2026-08-17
  Supports: architecture overview
• Chainlink Documentation — CCIP · primary · accessed 2026-08-17
  Supports: governance, timelock references
• Chainlink Documentation — cross-chain token setup with production multisig governance · primary · accessed 2026-08-17
  Supports: ManyChainMultiSig, RBACTimelock, veto quorum
• The Block — Chainlink CCIP gains over $2.5 billion in TVL from protocols migrating from LayerZero · secondary · accessed 2026-08-17
  Supports: migration signal, Kraken Bitcoin

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.