CCIP v2.0.0 SignatureQuorumValidator API Reference

Summary

SignatureQuorumValidator maintains per-source-chain signer sets and signature thresholds, and validates ordered ECDSA signatures against a configured quorum.

Key properties:

• Per-chain signer configuration.
• Threshold-based validation.
• Strictly ordered and unique signature requirement.
• Fork replay hardening via cached chain ID.

Designed for CCV verifier components requiring threshold signature validation.

Contract

chains/evm/contracts/ccvs/components/SignatureQuorumValidator.sol

Import

import {SignatureQuorumValidator} from "chainlink-ccip/chains/evm/contracts/ccvs/components/SignatureQuorumValidator.sol";

Inheritance

• Ownable2StepMsgSender

State

Constants

uint256 internal constant SIGNATURE_LENGTH = 64;
uint256 internal constant SIGNATURE_COMPONENT_LENGTH = 32;
uint8 internal constant V_VALUE = 27;

Immutables

uint256 internal immutable i_chainID;

Captured at deployment to detect forked chains.

Storage

mapping(uint64 => SignerConfig) private s_signerConfigs;
EnumerableSet.UintSet private s_configuredChains;

Constructor

constructor()

Initializes:

i_chainID = block.chainid;

External API

getSignatureConfig

function getSignatureConfig(uint64 sourceChainSelector)
  external
  view
  returns (address[] memory, uint8)

Returns signer set and threshold for the specified source chain.

getAllSignatureConfigs

function getAllSignatureConfigs()
  external
  view
  returns (SignatureConfig[] memory configs)

Returns all configured source chain selectors and signer configurations.

applySignatureConfigs

function applySignatureConfigs(
  uint64[] calldata sourceChainSelectorsToRemove,
  SignatureConfig[] calldata signatureConfigs
) external onlyOwner

Removals processed first, then updates.

Validations:

• threshold != 0
• threshold <= signers.length
• No duplicate signer addresses
• No zero-address signer

Emits SignatureConfigSet.

Internal API

_validateSignatures

function _validateSignatures(
  uint64 sourceChainSelector,
  bytes32 signedHash,
  bytes calldata signatures
) internal view

Validation steps:

1. Reverts SourceNotConfigured if no active configuration.
2. Reverts ForkedChain if block.chainid != i_chainID.
3. Reverts WrongNumberOfSignatures if fewer signatures than threshold.
4. Parses each 64-byte signature (r || s with v = 27).
5. Reverts UnauthorizedSigner if recovered signer not configured.
6. Reverts NonOrderedOrNonUniqueSignatures if signer ordering invalid.

Only first threshold signatures are checked.

Events

event SignatureConfigSet(
  uint64 sourceChainSelector,
  address[] signers,
  uint8 threshold
);

Errors

error InvalidSignatureConfig();
error SourceNotConfigured(uint64 sourceChainSelector);
error ForkedChain(uint256 expected, uint256 actual);
error WrongNumberOfSignatures();
error UnauthorizedSigner();
error NonOrderedOrNonUniqueSignatures();
error SignerCannotBeZeroAddress();

Structs

struct SignerConfig {
  EnumerableSet.AddressSet signers;
  uint8 threshold;
}

struct SignatureConfig {
  uint64 sourceChainSelector;
  uint8 threshold;
  address[] signers;
}

Security model

• Owner controls signer configuration.
• Threshold must be ≤ signer set size.
• Strict ordering requirement prevents duplicates.
• Fork replay protection prevents cross-chain signature reuse.
• Signature format assumes r || s and fixed v = 27.

Related Interfaces & Contracts

• BaseVerifier
• CommitteeVerifier
• IRMNRemote
• IRouter