Merge branch 'kl/sync-layer-reorg' of ssh://github.com/matter-labs/er…

…a-contracts into gw-audit-2-sls

.github/workflows/codespell.yaml

@@ -12,25 +12,26 @@ name: Codespell
 on: pull_request
 
 jobs:
- codespell:
- runs-on: ubuntu-latest
-
- steps:
- - name: Checkout the repository
- uses: actions/checkout@v4
-
- - name: pip cache
- uses: actions/cache@v4
- with:
- path: ~/.cache/pip
- key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
- restore-keys: ${{ runner.os }}-pip-
-
- - name: Install prerequisites
- run: sudo pip install -r ./.codespell/requirements.txt
-
- - name: Spell check
- run: codespell --config=./.codespell/.codespellrc
+ # TODO: fix codespell CI
+ # codespell:
+ # runs-on: ubuntu-latest
+
+ # steps:
+ # - name: Checkout the repository
+ # uses: actions/checkout@v4
+
+ # - name: pip cache
+ # uses: actions/cache@v4
+ # with:
+ # path: ~/.cache/pip
+ # key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+ # restore-keys: ${{ runner.os }}-pip-
+
+ # - name: Install prerequisites
+ # run: sudo pip install -r ./.codespell/requirements.txt
+
+ # - name: Spell check
+ # run: codespell --config=./.codespell/.codespellrc
 
  typos:
  runs-on: ubuntu-latest

.github/workflows/l1-contracts-ci.yaml

@@ -22,6 +22,9 @@ jobs:
  node-version: 18.18.0
  cache: yarn
 
+ - name: Use Foundry
+ uses: foundry-rs/foundry-toolchain@v1
+
  - name: Install dependencies
  run: yarn
 
@@ -39,19 +42,22 @@ jobs:
  - name: Build l1 artifacts
  run: yarn l1 build
 
+ - name: Build da-contracts artifacts
+ run: yarn da build:foundry
+
  - name: Create cache
  uses: actions/cache/save@v3
  with:
  key: artifacts-l1-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/artifacts
  l1-contracts/artifacts-zk
  l1-contracts/cache
  l1-contracts/typechain
  l2-contracts/artifacts-zk
  l2-contracts/cache-zk
  l2-contracts/typechain
- l1-contracts/lib
 
  lint:
  runs-on: ubuntu-latest
@@ -100,14 +106,14 @@ jobs:
  fail-on-cache-miss: true
  key: artifacts-l1-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/artifacts
  l1-contracts/artifacts-zk
  l1-contracts/cache
  l1-contracts/typechain
  l2-contracts/artifacts-zk
  l2-contracts/cache-zk
  l2-contracts/typechain
- l1-contracts/lib
 
  - name: Run tests
  working-directory: ./l1-contracts
@@ -141,14 +147,14 @@ jobs:
  fail-on-cache-miss: true
  key: artifacts-l1-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/artifacts
  l1-contracts/artifacts-zk
  l1-contracts/cache
  l1-contracts/typechain
  l2-contracts/artifacts-zk
  l2-contracts/cache-zk
  l2-contracts/typechain
- l1-contracts/lib
 
  - name: Install foundry zksync
  run: |
@@ -191,14 +197,14 @@ jobs:
  fail-on-cache-miss: true
  key: artifacts-l1-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/artifacts
  l1-contracts/artifacts-zk
  l1-contracts/cache
  l1-contracts/typechain
  l2-contracts/artifacts-zk
  l2-contracts/cache-zk
  l2-contracts/typechain
- l1-contracts/lib
 
  - name: Build L2 contracts
  run: yarn l2 build
@@ -258,49 +264,50 @@ jobs:
  fail-on-cache-miss: true
  key: artifacts-l1-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/artifacts
  l1-contracts/artifacts-zk
  l1-contracts/cache
  l1-contracts/typechain
  l2-contracts/artifacts-zk
  l2-contracts/cache-zk
  l2-contracts/typechain
- l1-contracts/lib
 
  - name: Run coverage
  run: FOUNDRY_PROFILE=default yarn test:foundry && FOUNDRY_PROFILE=default yarn coverage:foundry --report summary --report lcov
 
- # To ignore coverage for certain directories modify the paths in this step as needed. The
- # below default ignores coverage results for the test and script directories. Alternatively,
- # to include coverage in all directories, comment out this step. Note that because this
- # filtering applies to the lcov file, the summary table generated in the previous step will
- # still include all files and directories.
- # The `--rc lcov_branch_coverage=1` part keeps branch info in the filtered report, since lcov
- # defaults to removing branch info.
- - name: Filter directories
- run: |
- sudo apt update && sudo apt install -y lcov
- lcov --remove lcov.info 'test/*' 'contracts/dev-contracts/*' '../lib/forge-std/*' '../lib/murky/*' 'lib/*' '../lib/*' 'lib/' --output-file lcov.info --rc lcov_branch_coverage=1
-
- # This step posts a detailed coverage report as a comment and deletes previous comments on
- # each push. The below step is used to fail coverage if the specified coverage threshold is
- # not met. The below step can post a comment (when it's `github-token` is specified) but it's
- # not as useful, and this action cannot fail CI based on a minimum coverage threshold, which
- # is why we use both in this way.
- - name: Post coverage report
- if: github.event_name == 'pull_request' # This action fails when ran outside of a pull request.
- uses: romeovs/[email protected]
- with:
- delete-old-comments: true
- lcov-file: ./l1-contracts/lcov.info
- github-token: ${{ secrets.GITHUB_TOKEN }} # Adds a coverage summary comment to the PR.
-
- - name: Verify minimum coverage
- uses: zgosalvez/github-actions-report-lcov@v2
- with:
- coverage-files: ./l1-contracts/lcov.info
- working-directory: l1-contracts
- minimum-coverage: 85 # Set coverage threshold.
+ # TODO: fix filtering directories
+ # # To ignore coverage for certain directories modify the paths in this step as needed. The
+ # # below default ignores coverage results for the test and script directories. Alternatively,
+ # # to include coverage in all directories, comment out this step. Note that because this
+ # # filtering applies to the lcov file, the summary table generated in the previous step will
+ # # still include all files and directories.
+ # # The `--rc lcov_branch_coverage=1` part keeps branch info in the filtered report, since lcov
+ # # defaults to removing branch info.
+ # - name: Filter directories
+ # run: |
+ # sudo apt update && sudo apt install -y lcov
+ # lcov --remove lcov.info 'test/*' 'contracts/dev-contracts/*' '../lib/forge-std/*' '../lib/murky/*' 'lib/*' '../lib/*' 'lib/' 'deploy-scripts/*' --output-file lcov.info --rc lcov_branch_coverage=1
+
+ # # This step posts a detailed coverage report as a comment and deletes previous comments on
+ # # each push. The below step is used to fail coverage if the specified coverage threshold is
+ # # not met. The below step can post a comment (when it's `github-token` is specified) but it's
+ # # not as useful, and this action cannot fail CI based on a minimum coverage threshold, which
+ # # is why we use both in this way.
+ # - name: Post coverage report
+ # if: github.event_name == 'pull_request' # This action fails when ran outside of a pull request.
+ # uses: romeovs/[email protected]
+ # with:
+ # delete-old-comments: true
+ # lcov-file: ./l1-contracts/lcov.info
+ # github-token: ${{ secrets.GITHUB_TOKEN }} # Adds a coverage summary comment to the PR.
+
+ # - name: Verify minimum coverage
+ # uses: zgosalvez/github-actions-report-lcov@v2
+ # with:
+ # coverage-files: ./l1-contracts/lcov.info
+ # working-directory: l1-contracts
+ # minimum-coverage: 85 # Set coverage threshold.
 
  gas-report:
  needs: [build, lint]

.github/workflows/l1-contracts-foundry-ci.yaml

@@ -41,11 +41,15 @@ jobs:
  - name: Build l2 artifacts
  run: yarn l2 build
 
+ - name: Build da-contracts artifacts
+ run: yarn da build:foundry
+
  - name: Create cache
  uses: actions/cache/save@v3
  with:
  key: artifacts-l1-contracts-foudry-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/cache
  l1-contracts/out
  l1-contracts/artifacts-zk
@@ -72,6 +76,7 @@ jobs:
  fail-on-cache-miss: true
  key: artifacts-l1-contracts-foudry-${{ github.sha }}
  path: |
+ da-contracts/out
  l1-contracts/cache
  l1-contracts/out
  l1-contracts/artifacts-zk

.gitignore

@@ -31,4 +31,7 @@ l1-contracts/test/foundry/l1/integration/deploy-scripts/script-out/*.toml
 !l1-contracts/script-out/.gitkeep
 *.timestamp
 l1-contracts/test/foundry/l1/integration/deploy-scripts/script-out/*
+l1-contracts/test/foundry/l1/integration/deploy-scripts/script-config/config-deploy-zk-chain-*.toml
+l1-contracts/test/foundry/integration/deploy-scripts/script-out/*
+l1-contracts/test/foundry/l1/integration/upgrade-envs/script-out/*.toml
 l1-contracts/zkout/*

.solhintignore

@@ -17,6 +17,7 @@ l1-contracts-foundry/lib
 # l2-contracts
 l2-contracts/cache-zk
 l2-contracts/node_modules
+l2-contracts/contracts/dev-contracts
 l2-contracts/test
 
 # system-contracts

da-contracts/package.json

@@ -54,7 +54,7 @@
  },
  "scripts": {
  "build": "hardhat compile ",
- "build-l1": "harhdat compile",
+ "build:foundry": "forge build",
  "clean": "hardhat clean",
  "clean:foundry": "forge clean",
  "verify": "hardhat run --network env scripts/verify.ts"

l1-contracts/.env

@@ -44,3 +44,4 @@ TOKENS_CONFIG=/script-config/config-deploy-erc20.toml
 ZK_CHAIN_CONFIG=/script-config/register-zk-chain.toml
 ZK_CHAIN_OUTPUT=/script-out/output-deploy-zk-chain-era.toml
 FORCE_DEPLOYMENTS_CONFIG=/script-config/generate-force-deployments-data.toml
+GATEWAY_PREPARATION_L1_CONFIG=/script-config/gateway-preparation-l1.toml

l1-contracts/contracts/bridge/BridgedStandardERC20.sol

@@ -10,6 +10,7 @@ import {IBridgedStandardToken} from "./interfaces/IBridgedStandardToken.sol";
 import {Unauthorized, NonSequentialVersion, ZeroAddress} from "../common/L1ContractErrors.sol";
 import {L2_NATIVE_TOKEN_VAULT_ADDR} from "../common/L2ContractAddresses.sol";
 import {DataEncoding} from "../common/libraries/DataEncoding.sol";
+import {INativeTokenVault} from "../bridge/ntv/INativeTokenVault.sol";
 
 /// @author Matter Labs
 /// @custom:security-contact [email protected]
@@ -43,13 +44,20 @@ contract BridgedStandardERC20 is ERC20PermitUpgradeable, IBridgedStandardToken,
  /// @dev Address of the native token vault that is used as trustee who can mint/burn tokens
  address public nativeTokenVault;
 
+ /// @dev The assetId of the token.
+ bytes32 public assetId;
+
  /// @dev This also sets the native token vault to the default value if it is not set.
  /// It is not set only on the L2s for legacy tokens.
  modifier onlyNTV() {
  address ntv = nativeTokenVault;
  if (ntv == address(0)) {
  ntv = L2_NATIVE_TOKEN_VAULT_ADDR;
  nativeTokenVault = L2_NATIVE_TOKEN_VAULT_ADDR;
+ assetId = DataEncoding.encodeNTVAssetId(
+ INativeTokenVault(L2_NATIVE_TOKEN_VAULT_ADDR).L1_CHAIN_ID(),
+ originToken
+ );
  }
  if (msg.sender != ntv) {
  revert Unauthorized(msg.sender);
@@ -74,14 +82,20 @@ contract BridgedStandardERC20 is ERC20PermitUpgradeable, IBridgedStandardToken,
 
  /// @notice Initializes a contract token for later use. Expected to be used in the proxy.
  /// @dev Stores the L1 address of the bridge and set `name`/`symbol`/`decimals` getters that L1 token has.
+ /// @param _assetId The assetId of the token.
  /// @param _originToken Address of the origin token that can be deposited to mint this bridged token
  /// @param _data The additional data that the L1 bridge provide for initialization.
  /// In this case, it is packed `name`/`symbol`/`decimals` of the L1 token.
- function bridgeInitialize(address _originToken, bytes calldata _data) external initializer {
+ function bridgeInitialize(
+ bytes32 _assetId,
+ address _originToken,
+ bytes calldata _data
+ ) external initializer {
  if (_originToken == address(0)) {
  revert ZeroAddress();
  }
  originToken = _originToken;
+ assetId = _assetId;
 
  nativeTokenVault = msg.sender;
 

l1-contracts/contracts/bridge/L1ERC20Bridge.sol

@@ -140,7 +140,7 @@ contract L1ERC20Bridge is IL1ERC20Bridge, ReentrancyGuard {
  chainId: ERA_CHAIN_ID,
  l2BatchNumber: _l2BatchNumber,
  l2MessageIndex: _l2MessageIndex,
- l2Sender: l2Bridge,
+ l2Sender: L1_NULLIFIER.l2BridgeAddress(ERA_CHAIN_ID),
  l2TxNumberInBatch: _l2TxNumberInBatch,
  message: _message,
  merkleProof: _merkleProof