release: v3.2.0

.env-sample

@@ -2,9 +2,13 @@ L1_PRIV_KEY="0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
 CONFIG_NETWORK_NAME="custom"
 DEPLOYED_CONTRACTS_DIR="./scripts/files/"
 DISABLE_VERIFICATION=true
+FACTORY_OWNER=0x000000000000000000000000000000000000dead
+
+CREATE2_FACTORY=0x4e59b44847b379578588920cA78FbF26c0B4956C
 
 # to use the 'custom' hardhat network, set the following variables
 CUSTOM_RPC_URL="http://127.0.0.1:8545"
+CUSTOM_PRIVKEY="0x"
 CUSTOM_ETHERSCAN_API_KEY=
 CUSTOM_CHAINID=1337
 CUSTOM_ETHERSCAN_API_URL=

.github/workflows/contract-tests.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: stable
+          version: v1.3.6
           cache: false
 
       - name: Setup node/yarn
@@ -51,7 +51,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: stable
+          version: v1.3.6
           cache: false
 
       - name: Setup nodejs
@@ -64,7 +64,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: stable
+          version: v1.3.6
           cache: false
 
       - name: Check Contracts Format
@@ -79,6 +79,9 @@ jobs:
       - name: Lint Test Scripts
         run: yarn lint:test
 
+      - name: Compare bytecodes
+        run: yarn test:bytecodes
+
       - name: Build
         run: yarn build:all
 
@@ -118,6 +121,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Upload 4bytes
+        continue-on-error: true
         run: yarn upload-4bytes
 
   test-4844:
@@ -131,7 +135,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: stable
+          version: v1.3.6
           cache: false
 
       - uses: OffchainLabs/actions/run-nitro-test-node@main
@@ -169,7 +173,7 @@ jobs:
           no-token-bridge: true
           no-l3-token-bridge: true
           nitro-contracts-branch: '${{ github.event.pull_request.head.sha || github.sha }}'
-          nitro-testnode-ref: v3-support
+          nitro-testnode-ref: geth-allow-pre155
 
       - name: Setup node/yarn
         uses: actions/setup-node@v3
@@ -202,7 +206,7 @@ jobs:
           no-token-bridge: true
           no-l3-token-bridge: true
           nitro-contracts-branch: '${{ github.event.pull_request.head.sha || github.sha }}'
-          nitro-testnode-ref: v3-support
+          nitro-testnode-ref: geth-allow-pre155
 
       - name: Setup node/yarn
         uses: actions/setup-node@v3
@@ -234,7 +238,7 @@ jobs:
           args: --l3-fee-token --l3-fee-token-pricer --l3-fee-token-decimals 6
           no-token-bridge: true
           no-l3-token-bridge: true
-          nitro-testnode-ref: v3-support
+          nitro-testnode-ref: geth-allow-pre155
           nitro-contracts-branch: '${{ github.event.pull_request.head.sha || github.sha }}'
 
       - name: Setup node/yarn
@@ -264,7 +268,7 @@ jobs:
   #     - name: Install Foundry
   #       uses: foundry-rs/foundry-toolchain@v1
   #       with:
-  #         version: stable
+  #         version: v1.3.6
   #         cache: false
 
   #     - name: Setup node/yarn

audit-ci.jsonc

@@ -16,21 +16,19 @@
     "GHSA-wprv-93r4-jj2p",
     // Open Zeppelin: Base64 encoding may read from potentially dirty memory
     "GHSA-9vx6-7xxf-x967",
-    // semver vulnerable to Regular Expression Denial of Service
-    "GHSA-c2qf-rxjj-qqgw",
     // Server-Side Request Forgery in axios
     "GHSA-8hc4-vh64-cxmj",
-    // Regular Expression Denial of Service (ReDoS) in micromatch
-    "GHSA-952p-6rrq-rcjv",
     // cookie accepts cookie name, path, and domain with out of bounds characters
     "GHSA-pxg6-pf52-xh8x",
-    // Regular Expression Denial of Service (ReDoS) in cross-spawn
-    "GHSA-3xgq-45jj-v275",
     // axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
     "GHSA-jr5f-v2jv-69x6",
-    // Homograph attack allows Unicode lookalike characters to bypass validation
-    "GHSA-xq7p-g2vc-g82p",
-    // brace-expansion Regular Expression Denial of Service vulnerability
-    "GHSA-v6h2-p8h4-qcjw"
+    // tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
+    "GHSA-52f5-9888-hmc6",
+    // Axios is vulnerable to DoS attack through lack of data size check
+    "GHSA-4hjh-wcwx-xvwj",
+    // form-data uses unsafe random function in form-data for choosing boundary
+    "GHSA-fjxv-7rqg-78g4",
+    // js-yaml has prototype pollution in merge (<<)
+    "GHSA-mh29-5h37-fv8m"
   ]
 }

deploy/OneStepProverHostIoCreator.js

@@ -5,7 +5,7 @@ module.exports = async hre => {
 
   await deploy('OneStepProverHostIo', {
     from: deployer,
-    args: [],
+    args: [ethers.constants.AddressZero],
   })
 }
 

docs/deployment.md

@@ -0,0 +1,173 @@
+# How to deploy the RollupCreator factory contract and create new rollup chains?
+
+> [!IMPORTANT]
+> The recommended way of creating new Arbitrum chains is through the Arbitrum Orbit SDK. Instructions are available in our [documentation portal](https://docs.arbitrum.io/launch-arbitrum-chain/arbitrum-chain-sdk-introduction). These instructions are targetted to readers who are familiar with the Nitro stack and the creation of Arbitrum chains.
+
+This short guide includes instructions to deploy the `RollupCreator` factory contract, as well as create new rollup chains using it.
+
+## 1. Setup project
+
+Clone this repository
+
+```shell
+git clone https://github.com/offchainlabs/nitro-contracts
+cd nitro-contracts
+```
+
+Checkout the appropriate release (e.g. `develop` or `v3.1.1`)
+
+```shell
+git checkout develop
+```
+
+Install dependencies and build
+
+```shell
+yarn install
+yarn build:all
+```
+
+Make a copy of the .env-sample file
+
+```shell
+cp .env-sample .env
+```
+
+Choose the network that you're going to deploy the contracts to. If it's not present in [../hardhat.config.ts](../hardhat.config.ts), use the `custom` network.
+
+Then set the environment variables needed.
+
+To set the RPC and deployer private key to use, follow these instructions
+
+```shell
+# For any L1 network (mainnet, sepolia, holesky) we use an Infura endpoint, so set the key here
+# For Arbitrum and Base networks, we use the public RPC
+INFURA_KEY=
+
+# For any mainnet network (mainnet, arb1, arbnova, base), use `MAINNET_PRIVKEY`
+# For any testnet network (sepolia, holesky, arbsepolia, basesepolia), use `DEVNET_PRIVKEY`
+MAINNET_PRIVKEY=
+DEVNET_PRIVKEY=
+
+# For any other network
+CUSTOM_RPC_URL=
+CUSTOM_PRIVKEY=
+```
+
+_Note: the additional env variables needed for each step are specified in the appropriate section._
+
+## 2. Deploy the RollupCreator factory
+
+Set the following environment variable:
+
+```shell
+# Owner of the RollupCreator factory contract, with ability to modify the templates after the first deployment
+# (usually don't need to modify this value)
+FACTORY_OWNER="0x000000000000000000000000000000000000dead"
+```
+
+Optionally, set these extra variables:
+
+```shell
+# When deploying on L1, use 117964; When deploying on L2, use 104857
+# (defaults to 117964)
+MAX_DATA_SIZE=117964
+
+# Whether or not to verify the contracts deployed
+# (defaults to false, i.e., verify the contracts)
+DISABLE_VERIFICATION=true
+```
+
+_Note: if you choose to verify the contracts, follow the instructions in the section "Verification of contracts" below, to set the appropriate api key_
+
+Finally deploy the RollupCreator factory contract and the templates, using the `--network` flag to specify hardhat network to use.
+
+> [!NOTE]  
+> The deployment script uses Create2 to deploy all contracts. If Arachnid's proxy is not deployed in the chain, you must deploy it first (follow instructions in its [github repository](https://github.com/Arachnid/deterministic-deployment-proxy/) to do so). If the proxy is deployed in a different address, you can specify it with the environment variable `CREATE2_FACTORY`.
+
+```shell
+yarn run deploy-factory --network (arbSepolia | arb1 | custom | ...)
+```
+
+The script will output all deployed addresses. Write down the address of the RollupCreator contract created, as you'll need it in the next step.
+
+## 3. Create new rollup chains
+
+Set the following environment variables:
+
+```shell
+# Address of the RollupCreator factory contract
+ROLLUP_CREATOR_ADDRESS="0x"
+# Address of the stake token to use for validation through the Rollup contract
+# (this is usually set to the WETH token)
+STAKE_TOKEN_ADDRESS="0x"
+```
+
+Additionally, if you're going to deploy a custom gas token chain, set the following variables:
+
+```shell
+# Address of the token contract in the parent chain, to use as the native gas token of your chain
+FEE_TOKEN_ADDRESS="0x"
+# Address of the fee token pricer to use for the fee token
+# (see instructions in https://docs.arbitrum.io/launch-arbitrum-chain/configure-your-chain/common-configurations/use-a-custom-gas-token-rollup to understand how pricers work)
+FEE_TOKEN_PRICER_ADDRESS="0x"
+```
+
+Optionally, set this extra variable:
+
+```shell
+# Whether or not to verify the contracts deployed
+# (defaults to false, i.e., verify the contracts)
+DISABLE_VERIFICATION=true
+```
+
+_Note: if you choose to verify the contracts, follow the instructions in the section "Verification of contracts" below, to set the appropriate api key_
+
+Then, make a copy of the `config.example.ts` file to configure the initial parameters of your chain.
+
+```shell
+cp scripts/config.example.ts scripts/config.ts
+```
+
+Modify the initial parameters of your chain. Make sure all addresses are set to wallets that you own.
+
+Finally, use the appropriate command to create your rollup chain, depending on the gas token of your chain.
+
+If you'll use ETH as the gas token of your chain, call the following command, using the `--network` flag to specify hardhat network to use.
+
+```shell
+yarn run deploy-eth-rollup --network (arbSepolia | arb1 | custom | ...)
+```
+
+If you'll use a custom gas token for your chain, call the following command, using the `--network` flag to specify hardhat network to use.
+
+```shell
+yarn run deploy-erc20-rollup --network (arbSepolia | arb1 | custom | ...)
+```
+
+The script will output all deployed addresses and the block at which the transaction executed.
+
+## Verification of contracts
+
+If you choose to verify the deployed contracts, you'll also need to set the key to use Etherscan's API (or the appropriate network's block explorer).
+
+```shell
+# For deployments on an L1
+ETHERSCAN_API_KEY=
+
+# For deployments on Arbitrum One and Arbitrum Sepolia
+ARBISCAN_API_KEY=
+
+# For deployments on Base or Base Sepolia
+BASESCAN_API_KEY=
+
+# For deployments on other networks
+CUSTOM_ETHERSCAN_API_KEY=
+CUSTOM_CHAINID=
+CUSTOM_ETHERSCAN_API_URL=
+CUSTOM_ETHERSCAN_BROWSER_URL=
+```
+
+## TokenBridge deployment
+
+To deploy a token bridge for your chain, follow the instructions in the [token-bridge-contracts](https://github.com/OffchainLabs/token-bridge-contracts/blob/main/docs/deployment.md) repository.

foundry.toml

@@ -7,7 +7,9 @@ cache_path = 'forge-cache/sol'
 optimizer = true
 optimizer_runs = 2000
 via_ir = false
-evm_version = 'cancun'
+evm_version = 'london'
+solc_version = '0.8.17'
+bytecode_hash = 'none'
 remappings = ['ds-test/=lib/forge-std/lib/ds-test/src/',
               'forge-std/=lib/forge-std/src/',
               '@openzeppelin/contracts-upgradeable/=node_modules/@openzeppelin/contracts-upgradeable/', 
@@ -16,6 +18,23 @@ remappings = ['ds-test/=lib/forge-std/lib/ds-test/src/',
               '@uniswap/v2-core/=node_modules/@uniswap/v2-core/contracts',
               '@uniswap/lib/=node_modules/@uniswap/lib/contracts']
 fs_permissions = [{ access = "read", path = "./"}]
+additional_compiler_profiles = [
+    { name = "20_runs", optimizer_runs = 20 },
+    { name = "200_runs", optimizer_runs = 200 },
+    { name = "default", optimizer_runs = 2000 }
+]
+compilation_restrictions = [
+    { paths = "src/rollup/RollupUserLogic.sol", optimizer_runs = 20 },
+    { paths = "src/rollup/RollupAdminLogic.sol", optimizer_runs = 20 },
+    { paths = "src/challengeV2/EdgeChallengeManager.sol", optimizer_runs = 200 },
+]
+skip = ['test/*']
+
+[profile.test]
+optimizer = false
+additional_compiler_profiles = []
+compilation_restrictions = []
+skip = []
 
 [profile.yul]
 src = 'yul'
@@ -24,6 +43,10 @@ libs = ['node_modules', 'lib']
 cache_path = 'forge-cache/yul'
 remappings = []
 auto_detect_remappings = false
+skip = ['*.sol', 'test/*']
+
+[lint]
+lint_on_build = false
 
 [fmt]
 line_length = 100