Skip to content

Commit d3774bb

Browse files
jackchumajackchuma
authored
[Sepolia] set up sepolia owner migration to mirror mainnet hierarchy (#288)
* set up sepolia owner migration to mirror mainnet hierarchy * re-deploy new safes
1 parent b2e3a71 commit d3774bb

File tree

10 files changed

+874
-0
lines changed

10 files changed

+874
-0
lines changed

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/.env

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
OP_COMMIT=2073f4059bd806af3e8b76b820aa3fa0b42016d0
2+
BASE_CONTRACTS_COMMIT=cdedd0fe728eb1f9d63eaa4c6e59138cfb3803d3
3+
4+
L1_GNOSIS_SAFE_IMPLEMENTATION=0x90Ff2f4fAB3fB886cC60A1A5D5cAc2E774b5ce03
5+
L1_GNOSIS_COMPATIBILITY_FALLBACK_HANDLER=0x94eFE8be8E8E726cbc2ce0CdA98AE0d55DE2453B
6+
7+
OWNER_SAFE=0x0fe884546476dDd290eC46318785046ef68a0BA9

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/Makefile

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
include ../../Makefile
2+
include ../.env
3+
include .env
4+
5+
ifndef LEDGER_ACCOUNT
6+
override LEDGER_ACCOUNT = 1
7+
endif
8+
9+
.PHONY: deps
10+
deps:
11+
forge install --no-git safe-global/safe-smart-account@186a21a74b327f17fc41217a927dea7064f74604
12+
13+
.PHONY: deploy
14+
deploy:
15+
forge script --rpc-url $(L1_RPC_URL) DeploySafes --account testnet-admin --broadcast -vvvv
16+
17+
.PHONY: sign
18+
sign:
19+
$(GOPATH)/bin/eip712sign --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" -- \
20+
forge script --rpc-url $(L1_RPC_URL) UpdateSigners --sig "sign()"
21+
22+
.PHONY: execute
23+
execute:
24+
forge script --rpc-url $(L1_RPC_URL) UpdateSigners \
25+
--sig "run(bytes)" $(SIGNATURES) \
26+
--ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --broadcast -vvvv

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/README.md

+153
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Mirror Mainnet Hierarchy
2+
3+
Status: READY TO SIGN
4+
5+
## Description
6+
7+
This task contains two scripts. One for deploying new Gnosis Safe contracts, and one for updating the `ProxyAdminOwner` owners to be a 2-of-2 with 2 new safes as owners. The two new safes have the exact same owners as the current `ProxyAdminOwner`. One safe has the same threshold as the current `ProxyAdminOwner`, the other safe has a threshold of 1.
8+
9+
## Procedure
10+
11+
### 1. Update repo:
12+
13+
```bash
14+
cd contract-deployments
15+
git pull
16+
cd sepolia/2025-03-14-mirror-mainnet-hierarchy
17+
make deps
18+
```
19+
20+
### 2. Setup Ledger
21+
22+
Your Ledger needs to be connected and unlocked. The Ethereum
23+
application needs to be opened on Ledger with the message "Application
24+
is ready".
25+
26+
### 3. Run relevant script(s)
27+
28+
#### 3.1 Deploy new Gnosis Safes
29+
30+
```bash
31+
make deploy
32+
```
33+
34+
This will output the new addresses of the `GnosisSafe` contracts to an `addresses.json` file. You will need to commit this file to the repo before signers can sign.
35+
36+
#### 3.2 Sign the transaction
37+
38+
```bash
39+
make sign
40+
```
41+
42+
You will see a "Simulation link" from the output.
43+
44+
Paste this URL in your browser. A prompt may ask you to choose a
45+
project, any project will do. You can create one if necessary.
46+
47+
Click "Simulate Transaction".
48+
49+
We will be performing 3 validations and extract the domain hash and message hash to approve on your Ledger:
50+
51+
1. Validate integrity of the simulation.
52+
2. Validate correctness of the state diff.
53+
3. Validate and extract domain hash and message hash to approve.
54+
55+
##### 3.2.1 Validate integrity of the simulation.
56+
57+
Make sure you are on the "Overview" tab of the tenderly simulation, to
58+
validate integrity of the simulation, we need to check the following:
59+
60+
1. "Network": Check the network is Sepolia.
61+
2. "Timestamp": Check the simulation is performed on a block with a
62+
recent timestamp (i.e. close to when you run the script).
63+
3. "Sender": Check the address shown is your signer account. If not see the derivation path Note above.
64+
65+
##### 3.2.2. Validate correctness of the state diff.
66+
67+
Now click on the "State" tab, and refer to the [State Validations](./Validation.md) instructions for the transaction you are signing.
68+
Once complete return to this document to complete the signing.
69+
70+
##### 3.2.3. Extract the domain hash and the message hash to approve.
71+
72+
Now that we have verified the transaction performs the right
73+
operation, we need to extract the domain hash and the message hash to
74+
approve.
75+
76+
Go back to the "Overview" tab, and find the
77+
`GnosisSafe.checkSignatures` call. This call's `data` parameter
78+
contains both the domain hash and the message hash that will show up
79+
in your Ledger.
80+
81+
It will be a concatenation of `0x1901`, the domain hash, and the
82+
message hash: `0x1901[domain hash][message hash]`.
83+
84+
Note down this value. You will need to compare it with the ones
85+
displayed on the Ledger screen at signing.
86+
87+
Once the validations are done, it's time to actually sign the
88+
transaction.
89+
90+
> [!WARNING]
91+
> This is the most security critical part of the playbook: make sure the
92+
> domain hash and message hash in the following two places match:
93+
>
94+
> 1. On your Ledger screen.
95+
> 2. In the Tenderly simulation. You should use the same Tenderly
96+
> simulation as the one you used to verify the state diffs, instead
97+
> of opening the new one printed in the console.
98+
>
99+
> There is no need to verify anything printed in the console. There is
100+
> no need to open the new Tenderly simulation link either.
101+
102+
After verification, sign the transaction. You will see the `Data`,
103+
`Signer` and `Signature` printed in the console. Format should be
104+
something like this:
105+
106+
```shell
107+
Data: <DATA>
108+
Signer: <ADDRESS>
109+
Signature: <SIGNATURE>
110+
```
111+
112+
Double check the signer address is the right one.
113+
114+
##### 3.2.4 Send the output to Facilitator(s)
115+
116+
Nothing has occurred onchain - these are offchain signatures which
117+
will be collected by Facilitators for execution. Execution can occur
118+
by anyone once a threshold of signatures are collected, so a
119+
Facilitator will do the final execution for convenience.
120+
121+
Share the `Data`, `Signer` and `Signature` with the Facilitator, and
122+
congrats, you are done!
123+
124+
### [For Facilitator ONLY] How to execute
125+
126+
#### Execute the transaction
127+
128+
1. IMPORTANT: Ensure op-challenger has been updated before executing.
129+
1. Collect outputs from all participating signers.
130+
1. Concatenate all signatures and export it as the `SIGNATURES`
131+
environment variable, i.e. `export
132+
SIGNATURES="[SIGNATURE1][SIGNATURE2]..."`.
133+
1. Run the `make execute` command as described below to execute the transaction.
134+
135+
For example, if the quorum is 2 and you get the following outputs:
136+
137+
```shell
138+
Data: 0xDEADBEEF
139+
Signer: 0xC0FFEE01
140+
Signature: AAAA
141+
```
142+
143+
```shell
144+
Data: 0xDEADBEEF
145+
Signer: 0xC0FFEE02
146+
Signature: BBBB
147+
```
148+
149+
Then you should run:
150+
151+
```bash
152+
SIGNATURES=AAAABBBB make execute
153+
```

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/Validation.md

+140
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Validation
2+
3+
This document can be used to validate the state diff resulting from the execution of the AddSigners transaction.
4+
5+
For each contract listed in the state diff, please verify that no contracts or state changes shown in the Tenderly diff are missing from this document. Additionally, please verify that for each contract:
6+
7+
- The following state changes (and none others) are made to that contract. This validates that no unexpected state changes occur.
8+
- All addresses (in section headers and storage values) match the provided name, using the Etherscan and Superchain Registry links provided. This validates the bytecode deployed at the addresses contains the correct logic.
9+
- All key values match the semantic meaning provided, which can be validated using the storage layout links provided.
10+
11+
## State Overrides
12+
13+
### `0x0fe884546476dDd290eC46318785046ef68a0BA9` (`ProxyAdminOwner`)
14+
15+
- **Key**: `0x0000000000000000000000000000000000000000000000000000000000000004` <br/>
16+
**Override**: `0x0000000000000000000000000000000000000000000000000000000000000001` <br/>
17+
**Meaning**: Override the threshold to 1 so the transaction simulation can occur.
18+
19+
## State Changes
20+
21+
### `0x0fe884546476dDd290eC46318785046ef68a0BA9` (`ProxyAdminOwner`)
22+
23+
- **Key**: `0x0000000000000000000000000000000000000000000000000000000000000003` <br/>
24+
**Before**: `0x000000000000000000000000000000000000000000000000000000000000000e` <br/>
25+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000002` <br/>
26+
**Meaning**: Decrease owner count from 14 to 2.
27+
28+
- **Key**: `0x0000000000000000000000000000000000000000000000000000000000000004` <br/>
29+
**Before**: `0x0000000000000000000000000000000000000000000000000000000000000001` <br/>
30+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000002` <br/>
31+
**Meaning**: Update threshold from 1 to 2. This is really decreasing from 3 to 2 but the simulation presents this way because of the state override.
32+
33+
- **Key**: `0x0000000000000000000000000000000000000000000000000000000000000005` <br/>
34+
**Before**: `0x0000000000000000000000000000000000000000000000000000000000000011` <br/>
35+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000012` <br/>
36+
**Meaning**: Nonce increment.
37+
38+
- **Key**: `0x2146980ccf4a7741c01fd860f90d2fab597ba25316f4b73d17092ab48b2eb5ce` <br/>
39+
**Before**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
40+
**After**: `0x000000000000000000000000646132a1667ca7ad00d36616afba1a28116c770a` <br/>
41+
**Meaning**: Adds `0x6af0674791925f767060dd52f7fb20984e8639d8` to the owners linked list pointing to `0x646132a1667ca7ad00d36616afba1a28116c770a`
42+
**Verify**: Verify key with `cast index address 0x6af0674791925f767060dd52f7fb20984e8639d8 2`
43+
44+
- **Key**: `0xda056de0e460c75e5163abc19a3eb1ec6a9ada3e95462ea3fc0925b123fc73d9` <br/>
45+
**Before**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
46+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000001` <br/>
47+
**Meaning**: Adds `0x646132a1667ca7ad00d36616afba1a28116c770a` as the tail of the owners linked list.
48+
**Verify**: Verify key with `cast index address 0x646132a1667ca7ad00d36616afba1a28116c770a 2`
49+
50+
- **Key**: `0x4bf34efa2cf5d17da7425df2ee4f6191d734167ae5ba396b1eaa05b9d92099f6` <br/>
51+
**Before**: `0x000000000000000000000000420c8fe1ddb0593c71487445576c87c17f177179` <br/>
52+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
53+
**Meaning**: Removes `0xee316db0edaee45347dfc498795a01311f085225` from the owners list. Was previously pointing to `0x420c8fE1dDb0593c71487445576c87c17f177179`.
54+
**Verify**: Verify key with `cast index address 0xee316db0edaee45347dfc498795a01311f085225 2`
55+
56+
- **Key**: `0x563d4ddf297b5a92e03dce553dc56572bfee245f134f6db63397742b674f94dd` <br/>
57+
**Before**: `0x000000000000000000000000ee316db0edaee45347dfc498795a01311f085225` <br/>
58+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
59+
**Meaning**: Removes `0xb2d9a52e76841279ef0372c534c539a4f68f8c0b` from the owners list. Was previously pointing to `0xee316db0edaee45347dfc498795a01311f085225`.
60+
**Verify**: Verify key with `cast index address 0xb2d9a52e76841279ef0372c534c539a4f68f8c0b 2`
61+
62+
- **Key**: `0x58d120a0b20e1a9e1a4e5e474f65af5c48d6f00c80f80d95320860a00359ab1a` <br/>
63+
**Before**: `0x0000000000000000000000002fa5d8294575a8fa880a8aec008b860fb6a70e26` <br/>
64+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
65+
**Meaning**: Removes `0xa8c40cc18581ff25c0d2605631514cca6590c503` from the owners list. Was previously pointing to `0x2fa5d8294575a8fa880a8aec008b860fb6a70e26`.
66+
**Verify**: Verify key with `cast index address 0xa8c40cc18581ff25c0d2605631514cca6590c503 2`
67+
68+
- **Key**: `0x7a83097f5b56a04accdbc8d4b0501bec3106db0d2c2ea1a63e7cbbf0fa91372d` <br/>
69+
**Before**: `0x000000000000000000000000b2d9a52e76841279ef0372c534c539a4f68f8c0b` <br/>
70+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
71+
**Meaning**: Removes `0x9986ccaf9e3de0ffef82a0f7fa3a06d5afe07252` from the owners list. Was previously pointing to `0xb2d9a52e76841279ef0372c534c539a4f68f8c0b`.
72+
**Verify**: Verify key with `cast index address 0x9986ccaf9e3de0ffef82a0f7fa3a06d5afe07252 2`
73+
74+
- **Key**: `0x7be060a34deb1d91639bcd2c9d7b1a34999e25875869cc3a83bb8d21aae3abe8` <br/>
75+
**Before**: `0x00000000000000000000000079dc63ba7b5d9817a0f0840cd5373292e86735e4` <br/>
76+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
77+
**Meaning**: Removes `0x2fa5d8294575a8fa880a8aec008b860fb6a70e26` from the owners list. Was previously pointing to `0x79dc63ba7b5d9817a0f0840cd5373292e86735e4`.
78+
**Verify**: Verify key with `cast index address 0x2fa5d8294575a8fa880a8aec008b860fb6a70e26 2`
79+
80+
- **Key**: `0xa17f6b5d5c5960e10cb741113b64d7f023e3513339475444585747297bf07208` <br/>
81+
**Before**: `0x0000000000000000000000009b43cc2ef6fa521127ade09e20efd6abbc5bf799` <br/>
82+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
83+
**Meaning**: Removes `0x4ffd98b5eea905ec25aa3daf180552f67873ed78` from the owners list. Was previously pointing to `0x9b43cc2ef6fa521127ade09e20efd6abbc5bf799`.
84+
**Verify**: Verify key with `cast index address 0x4ffd98b5eea905ec25aa3daf180552f67873ed78 2`
85+
86+
- **Key**: `0xa4a7a27737970be72bc7ea3d1499d5a7ca677dcfe71298e98f16342b46fd6324` <br/>
87+
**Before**: `0x000000000000000000000000b04e501237d9a941b130172868201dee9b965c38` <br/>
88+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
89+
**Meaning**: Removes `0x066a2b1419ccf2e1e672a03f14cc1d1146e717a0` from the owners list. Was previously pointing to `0xb04e501237d9a941b130172868201dee9b965c38`.
90+
**Verify**: Verify key with `cast index address 0x066a2b1419ccf2e1e672a03f14cc1d1146e717a0 2`
91+
92+
- **Key**: `0xa90dbf3509e5dacce4ce51b1e0056ed396086cef191332ab4a46abeba6c00648` <br/>
93+
**Before**: `0x000000000000000000000000066a2b1419ccf2e1e672a03f14cc1d1146e717a0` <br/>
94+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
95+
**Meaning**: Removes `0x79dc63ba7b5d9817a0f0840cd5373292e86735e4` from the owners list. Was previously pointing to `0x066a2b1419ccf2e1e672a03f14cc1d1146e717a0`.
96+
**Verify**: Verify key with `cast index address 0x79dc63ba7b5d9817a0f0840cd5373292e86735e4 2`
97+
98+
- **Key**: `0xc737cf9e0b995a0b7c95319fd1b2a1daedbcafc9b244731b97e04bbf2a8067f3` <br/>
99+
**Before**: `0x0000000000000000000000009986ccaf9e3de0ffef82a0f7fa3a06d5afe07252` <br/>
100+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
101+
**Meaning**: Removes `0x7f10098bd53519c739ca8a404afe127647d94774` from the owners list. Was previously pointing to `0x9986ccaf9e3de0ffef82a0f7fa3a06d5afe07252`.
102+
**Verify**: Verify key with `cast index address 0x7f10098bd53519c739ca8a404afe127647d94774 2`
103+
104+
- **Key**: `0xcd8fdd39f0d4ab3740418f660069bb6ed71bb4dd40a37a6eb4fee616a1dc1b08` <br/>
105+
**Before**: `0x0000000000000000000000004ffd98b5eea905ec25aa3daf180552f67873ed78` <br/>
106+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
107+
**Meaning**: Removes `0xb04e501237d9a941b130172868201dee9b965c38` from the owners list. Was previously pointing to `0x4ffd98b5eea905ec25aa3daf180552f67873ed78`.
108+
**Verify**: Verify key with `cast index address 0xb04e501237d9a941b130172868201dee9b965c38 2`
109+
110+
- **Key**: `0xd5a3955556fe832b0d9dee1f7edb84880eee53ea4dc4e838bfa6bebc90480c2a` <br/>
111+
**Before**: `0x000000000000000000000000644d0f5c2c55a4679b4bfe057b87ba203af9ac0d` <br/>
112+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
113+
**Meaning**: Removes `0x9b43cc2ef6fa521127ade09e20efd6abbc5bf799` from the owners list. Was previously pointing to `0x644d0f5c2c55a4679b4bfe057b87ba203af9ac0d`.
114+
**Verify**: Verify key with `cast index address 0x9b43cc2ef6fa521127ade09e20efd6abbc5bf799 2`
115+
116+
- **Key**: `0xdbe1c9b8b04b880813d25a9c5e89056031fb59c22374b4ee4da23606ff9ee5f5` <br/>
117+
**Before**: `0x000000000000000000000000aa2489debf1ef02ab83ba6cde4419e662de9254e` <br/>
118+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
119+
**Meaning**: Removes `0x644d0f5c2c55a4679b4bfe057b87ba203af9ac0d` from the owners list. Was previously pointing to `0xaa2489debf1ef02ab83ba6cde4419e662de9254e`.
120+
**Verify**: Verify key with `cast index address 0x644d0f5c2c55a4679b4bfe057b87ba203af9ac0d 2`
121+
122+
- **Key**: `0xdd723b4c2a66aea3d2ac26f837bd1e7dea4ce6cca7e4fa76af2185076784453f` <br/>
123+
**Before**: `0x000000000000000000000000a8c40cc18581ff25c0d2605631514cca6590c503` <br/>
124+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
125+
**Meaning**: Removes `0x420c8fe1ddb0593c71487445576c87c17f177179` from the owners list. Was previously pointing to `0xa8c40cc18581ff25c0d2605631514cca6590c503`.
126+
**Verify**: Verify key with `cast index address 0x420c8fe1ddb0593c71487445576c87c17f177179 2`
127+
128+
- **Key**: `0xe475b9e5509f43031ff937d793c47553513dacb8de5b10e556e7da05bd6d6e54` <br/>
129+
**Before**: `0x0000000000000000000000000000000000000000000000000000000000000001` <br/>
130+
**After**: `0x0000000000000000000000000000000000000000000000000000000000000000` <br/>
131+
**Meaning**: Removes `0xaa2489debf1ef02ab83ba6cde4419e662de9254e` from the owners list. Was previously pointing to `0x0000000000000000000000000000000000000001` which marks the tail of the list.
132+
**Verify**: Verify key with `cast index address 0xaa2489debf1ef02ab83ba6cde4419e662de9254e 2`
133+
134+
- **Key**: `0xe90b7bceb6e7df5418fb78d8ee546e97c83a08bbccc01a0644d599ccd2a7c2e0` <br/>
135+
**Before**: `0x0000000000000000000000007f10098bd53519c739ca8a404afe127647d94774` <br/>
136+
**After**: `0x0000000000000000000000006af0674791925f767060dd52f7fb20984e8639d8` <br/>
137+
**Meaning**: Updates head of owners linked list from `0x7f10098BD53519c739cA8A404afE127647D94774` to `0x6af0674791925f767060dd52f7fb20984e8639d8`
138+
**Verify**: Verify key with `cast index address 0x0000000000000000000000000000000000000001 2`
139+
140+
You should also see nonce updates for the address you're signing with.

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/addresses.json

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"SafeA": "0x646132a1667ca7ad00d36616afba1a28116c770a",
3+
"SafeB": "0x6af0674791925f767060dd52f7fb20984e8639d8"
4+
}

‎sepolia/2025-03-14-mirror-mainnet-hierarchy/foundry.toml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[profile.default]
2+
src = 'src'
3+
out = 'out'
4+
libs = ['lib']
5+
broadcast = 'records'
6+
fs_permissions = [{ access = "read-write", path = "./" }]
7+
optimizer = true
8+
optimizer_runs = 999999
9+
via-ir = false
10+
remappings = [
11+
'@eth-optimism-bedrock/=lib/optimism/packages/contracts-bedrock/',
12+
'@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts',
13+
'@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts',
14+
'@rari-capital/solmate/=lib/solmate/',
15+
'@base-contracts/=lib/base-contracts',
16+
'solady/=lib/solady/src/',
17+
]
18+
19+
# See more config options https://github.com/foundry-rs/foundry/tree/master/config

0 commit comments

Comments
 (0)