Draft v29.5

l1-contracts/.env

@@ -59,3 +59,5 @@ DEPLOY_GATEWAY_TX_FILTERER_INPUT=/script-config/deploy-gateway-tx-filterer.toml
 DEPLOY_GATEWAY_TX_FILTERER_OUTPUT=/script-out/deploy-gateway-tx-filterer.toml
 GATEWAY_VOTE_PREPARATION_INPUT=/script-config/gateway-vote-preparation.toml
 GATEWAY_VOTE_PREPARATION_OUTPUT=/script-out/gateway-vote-preparation.toml
+ZK_OS_V28_1_UPGRADE_ECOSYSTEM_INPUT=/script-config/zk-os-v28-1-upgrade-ecosystem.toml
+ZK_OS_V28_1_UPGRADE_ECOSYSTEM_OUTPUT=/script-out/zk-os-v28-1-upgrade-ecosystem.toml

l1-contracts/contracts/bridge/asset-router/AssetRouterBase.sol

@@ -2,11 +2,11 @@
 
 pragma solidity 0.8.28;
 
 import {Ownable2StepUpgradeable} from "@openzeppelin/contracts-upgradeable-v4/access/Ownable2StepUpgradeable.sol";
 import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable-v4/security/PausableUpgradeable.sol";
 
 import {IERC20} from "@openzeppelin/contracts-v4/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts-v4/token/ERC20/utils/SafeERC20.sol";
 
 import {IAssetRouterBase} from "./IAssetRouterBase.sol";
 import {IAssetHandler} from "../interfaces/IAssetHandler.sol";
@@ -25,15 +25,6 @@
 abstract contract AssetRouterBase is IAssetRouterBase, Ownable2StepUpgradeable, PausableUpgradeable {
     using SafeERC20 for IERC20;
 
-    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
-    IBridgehub public immutable override BRIDGE_HUB;
-
-    /// @dev Chain ID of L1 for bridging reasons
-    uint256 public immutable L1_CHAIN_ID;
-
-    /// @dev Chain ID of Era for legacy reasons
-    uint256 public immutable ERA_CHAIN_ID;
-
     /// @dev Maps asset ID to address of corresponding asset handler.
     /// @dev Tracks the address of Asset Handler contracts, where bridged funds are locked for each asset.
     /// @dev P.S. this liquidity was locked directly in SharedBridge before.
@@ -55,20 +46,12 @@
 
     /// @notice Checks that the message sender is the bridgehub.
     modifier onlyBridgehub() {
-        if (msg.sender != address(BRIDGE_HUB)) {
+        if (msg.sender != address(_bridgehub())) {
             revert Unauthorized(msg.sender);
         }
         _;
     }
 
-    /// @dev Contract is expected to be used as proxy implementation.
-    /// @dev Initialize the implementation to prevent Parity hack.
-    constructor(uint256 _l1ChainId, uint256 _eraChainId, IBridgehub _bridgehub) {
-        L1_CHAIN_ID = _l1ChainId;
-        ERA_CHAIN_ID = _eraChainId;
-        BRIDGE_HUB = _bridgehub;
-    }
-
     /// @inheritdoc IAssetRouterBase
     function setAssetHandlerAddressThisChain(
         bytes32 _assetRegistrationData,
@@ -190,4 +173,10 @@
     function unpause() external onlyOwner {
         _unpause();
     }
+
+    function _bridgehub() internal view virtual returns (IBridgehub);
+
+    function _l1ChainId() internal view virtual returns (uint256);
+
+    function _eraChainId() internal view virtual returns (uint256);
 }

l1-contracts/contracts/bridge/asset-router/L1AssetRouter.sol

@@ -2,8 +2,8 @@
 
 pragma solidity 0.8.28;
 
 import {IERC20} from "@openzeppelin/contracts-v4/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts-v4/token/ERC20/utils/SafeERC20.sol";
 
 import {IL1AssetRouter} from "./IL1AssetRouter.sol";
 import {IL2AssetRouter} from "./IL2AssetRouter.sol";
@@ -36,6 +36,12 @@
 contract L1AssetRouter is AssetRouterBase, IL1AssetRouter, ReentrancyGuard {
     using SafeERC20 for IERC20;
 
+    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
+    IBridgehub public immutable override BRIDGE_HUB;
+
+    /// @dev Chain ID of Era for legacy reasons
+    uint256 public immutable ERA_CHAIN_ID;
+
     /// @dev The address of the WETH token on L1.
     address public immutable override L1_WETH_TOKEN;
 
@@ -94,8 +100,10 @@
         address _l1Nullifier,
         uint256 _eraChainId,
         address _eraDiamondProxy
-    ) reentrancyGuardInitializer AssetRouterBase(block.chainid, _eraChainId, IBridgehub(_bridgehub)) {
+    ) reentrancyGuardInitializer {
         _disableInitializers();
+        BRIDGE_HUB = IBridgehub(_bridgehub);
+        ERA_CHAIN_ID = _eraChainId;
         L1_WETH_TOKEN = _l1WethAddress;
         ERA_DIAMOND_PROXY = _eraDiamondProxy;
         L1_NULLIFIER = IL1Nullifier(_l1Nullifier);
@@ -673,4 +681,20 @@
     function l2BridgeAddress(uint256 _chainId) external view override returns (address) {
         return L1_NULLIFIER.l2BridgeAddress(_chainId);
     }
+
+    function L1_CHAIN_ID() external view override returns (uint256) {
+        return block.chainid;
+    }
+
+    function _bridgehub() internal view override returns (IBridgehub) {
+        return BRIDGE_HUB;
+    }
+
+    function _l1ChainId() internal view override returns (uint256) {
+        return block.chainid;
+    }
+
+    function _eraChainId() internal view override returns (uint256) {
+        return ERA_CHAIN_ID;
+    }
 }

l1-contracts/contracts/bridge/asset-router/L2AssetRouter.sol

@@ -15,7 +15,7 @@
 import {AddressAliasHelper} from "../../vendor/AddressAliasHelper.sol";
 import {ReentrancyGuard} from "../../common/ReentrancyGuard.sol";
 
-import {L2_BRIDGEHUB_ADDR, L2_NATIVE_TOKEN_VAULT_ADDR} from "../../common/l2-helpers/L2ContractAddresses.sol";
+import {L2_NATIVE_TOKEN_VAULT_ADDR, L2_COMPLEX_UPGRADER_ADDR} from "../../common/l2-helpers/L2ContractAddresses.sol";
 import {L2ContractHelper} from "../../common/l2-helpers/L2ContractHelper.sol";
 import {DataEncoding} from "../../common/libraries/DataEncoding.sol";
 import {AmountMustBeGreaterThanZero, AssetIdNotSupported, EmptyAddress, InvalidCaller, TokenNotLegacy} from "../../common/L1ContractErrors.sol";
@@ -24,19 +24,41 @@
 /// @custom:security-contact [email protected]
 /// @notice The "default" bridge implementation for the ERC20 tokens. Note, that it does not
 /// support any custom token logic, i.e. rebase tokens' functionality is not supported.
+/// @dev Important: L2 contracts are not allowed to have any immutable variables. This is needed for compatibility with ZKsyncOS.
 contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
-    /// @dev The address of the L2 legacy shared bridge.
-    address public immutable L2_LEGACY_SHARED_BRIDGE;
+    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    IBridgehub public override BRIDGE_HUB;
 
-    /// @dev The asset id of the base token.
-    bytes32 public immutable BASE_TOKEN_ASSET_ID;
+    /// @dev Chain ID of L1 for bridging reasons.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    uint256 public L1_CHAIN_ID;
+
+    /// @dev Chain ID of Era for legacy reasons.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    uint256 public eraChainId;
 
     /// @dev The address of the L1 asset router counterpart.
-    address public immutable override L1_ASSET_ROUTER;
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    address public L1_ASSET_ROUTER;
+
+    /// @dev The address of the L2 legacy shared bridge.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    address public L2_LEGACY_SHARED_BRIDGE;
+
+    /// @dev The asset id of the base token.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    bytes32 public BASE_TOKEN_ASSET_ID;
 
     /// @notice Checks that the message sender is the L1 Asset Router.
     modifier onlyAssetRouterCounterpart(uint256 _originChainId) {
-        if (_originChainId == L1_CHAIN_ID) {
+        if (_originChainId == _l1ChainId()) {
             // Only the L1 Asset Router counterpart can initiate and finalize the deposit.
             if (AddressAliasHelper.undoL1ToL2Alias(msg.sender) != L1_ASSET_ROUTER) {
                 revert InvalidCaller(msg.sender);
@@ -49,7 +71,7 @@
 
     /// @notice Checks that the message sender is the L1 Asset Router.
     modifier onlyAssetRouterCounterpartOrSelf(uint256 _chainId) {
-        if (_chainId == L1_CHAIN_ID) {
+        if (_chainId == _l1ChainId()) {
             // Only the L1 Asset Router counterpart can initiate and finalize the deposit.
             if ((AddressAliasHelper.undoL1ToL2Alias(msg.sender) != L1_ASSET_ROUTER) && (msg.sender != address(this))) {
                 revert InvalidCaller(msg.sender);
@@ -75,26 +97,59 @@
         _;
     }
 
-    /// @dev Disable the initialization to prevent Parity hack.
-    /// @dev this contract is deployed in the L2GenesisUpgrade, and is meant as direct deployment without a proxy.
-    /// @param _l1AssetRouter The address of the L1 Bridge contract.
-    constructor(
+    modifier onlyUpgrader() {
+        if (msg.sender != L2_COMPLEX_UPGRADER_ADDR) {
+            revert InvalidCaller(msg.sender);
+        }
+        _;
+    }
+
+    /// @notice Initializes the contract
+    /// @dev This function is used to initialize the contract with the initial values.
+    /// @dev This function is called both for new chains.
+    /// @param _l1ChainId The chain id of L1.
+    /// @param _eraChainId The chain id of Era.
+    /// @param _l1AssetRouter The address of the L1 asset router.
+    /// @param _legacySharedBridge The address of the L2 legacy shared bridge.
+    /// @param _baseTokenAssetId The asset id of the base token.
+    /// @param _aliasedOwner The address of the owner of the contract.
+    function initL2(
         uint256 _l1ChainId,
         uint256 _eraChainId,
         address _l1AssetRouter,
         address _legacySharedBridge,
         bytes32 _baseTokenAssetId,
         address _aliasedOwner
-    ) AssetRouterBase(_l1ChainId, _eraChainId, IBridgehub(L2_BRIDGEHUB_ADDR)) reentrancyGuardInitializer {
+    ) public reentrancyGuardInitializer onlyUpgrader {
+        _disableInitializers();
+        updateL2(_l1ChainId, _eraChainId, _l1AssetRouter, _legacySharedBridge, _baseTokenAssetId);
+        _setAssetHandler(_baseTokenAssetId, L2_NATIVE_TOKEN_VAULT_ADDR);
+        _transferOwnership(_aliasedOwner);
+    }
+
+    /// @notice Updates the contract.
+    /// @dev This function is used to initialize the new implementation of L2AssetRouter on existing chains during
+    /// the upgrade.
+    /// @param _l1ChainId The chain id of L1.
+    /// @param _eraChainId The chain id of Era.
+    /// @param _l1AssetRouter The address of the L1 asset router.
+    /// @param _legacySharedBridge The address of the L2 legacy shared bridge.
+    /// @param _baseTokenAssetId The asset id of the base token.
+    function updateL2(
+        uint256 _l1ChainId,
+        uint256 _eraChainId,
+        address _l1AssetRouter,
+        address _legacySharedBridge,
+        bytes32 _baseTokenAssetId
+    ) public onlyUpgrader {
         L2_LEGACY_SHARED_BRIDGE = _legacySharedBridge;
         if (_l1AssetRouter == address(0)) {
             revert EmptyAddress();
         }
+        L1_CHAIN_ID = _l1ChainId;
         L1_ASSET_ROUTER = _l1AssetRouter;
-        _setAssetHandler(_baseTokenAssetId, L2_NATIVE_TOKEN_VAULT_ADDR);
         BASE_TOKEN_ASSET_ID = _baseTokenAssetId;
-        _disableInitializers();
-        _transferOwnership(_aliasedOwner);
+        eraChainId = _eraChainId;
     }
 
     /// @inheritdoc IL2AssetRouter
@@ -136,15 +191,15 @@
         public
         payable
         override(AssetRouterBase, IAssetRouterBase)
-        onlyAssetRouterCounterpartOrSelf(L1_CHAIN_ID)
+        onlyAssetRouterCounterpartOrSelf(_l1ChainId())
         nonReentrant
     {
         if (_assetId == BASE_TOKEN_ASSET_ID) {
             revert AssetIdNotSupported(BASE_TOKEN_ASSET_ID);
         }
-        _finalizeDeposit(L1_CHAIN_ID, _assetId, _transferData, L2_NATIVE_TOKEN_VAULT_ADDR);
+        _finalizeDeposit(_l1ChainId(), _assetId, _transferData, L2_NATIVE_TOKEN_VAULT_ADDR);
 
-        emit DepositFinalizedAssetRouter(L1_CHAIN_ID, _assetId, _transferData);
+        emit DepositFinalizedAssetRouter(_l1ChainId(), _assetId, _transferData);
     }
 
     /// @notice Initiates a withdrawal by burning funds on the contract and sending the message to L1
@@ -177,7 +232,7 @@
         bool _alwaysNewMessageFormat
     ) internal returns (bytes32 txHash) {
         bytes memory l1bridgeMintData = _burn({
-            _chainId: L1_CHAIN_ID,
+            _chainId: _l1ChainId(),
             _nextMsgValue: 0,
             _assetId: _assetId,
             _originalCaller: _sender,
@@ -204,7 +259,7 @@
             txHash = IL2SharedBridgeLegacy(L2_LEGACY_SHARED_BRIDGE).sendMessageToL1(message);
         }
 
-        emit WithdrawalInitiatedAssetRouter(L1_CHAIN_ID, _sender, _assetId, _assetData);
+        emit WithdrawalInitiatedAssetRouter(_l1ChainId(), _sender, _assetId, _assetData);
     }
 
     /// @notice Encodes the message for l2ToL1log sent during withdraw initialization.
@@ -362,4 +417,16 @@
     function l1Bridge() external view returns (address) {
         return L1_ASSET_ROUTER;
     }
+
+    function _bridgehub() internal view override returns (IBridgehub) {
+        return BRIDGE_HUB;
+    }
+
+    function _l1ChainId() internal view override returns (uint256) {
+        return L1_CHAIN_ID;
+    }
+
+    function _eraChainId() internal view override returns (uint256) {
+        return eraChainId;
+    }
 }

l1-contracts/contracts/bridge/interfaces/IL2WrappedBaseToken.sol

@@ -12,4 +12,20 @@ interface IL2WrappedBaseToken {
     function depositTo(address _to) external payable;
 
     function withdrawTo(address _to, uint256 _amount) external;
+
+    /// @notice Initializes a contract token for later use. Expected to be used in the proxy.
+    /// @notice This function is used to integrate the previously deployed WETH token with the bridge.
+    /// @dev Sets up `name`/`symbol`/`decimals` getters.
+    /// @param name_ The name of the token.
+    /// @param symbol_ The symbol of the token.
+    /// @param _l2Bridge Address of the L2 bridge
+    /// @param _l1Address Address of the L1 token that can be deposited to mint this L2 WETH.
+    /// Note: The decimals are hardcoded to 18, the same as on Ether.
+    function initializeV3(
+        string calldata name_,
+        string calldata symbol_,
+        address _l2Bridge,
+        address _l1Address,
+        bytes32 _baseTokenAssetId
+    ) external;
 }

l1-contracts/contracts/bridge/ntv/L1NativeTokenVault.sol

@@ -17,6 +17,7 @@ import {IL1AssetHandler} from "../interfaces/IL1AssetHandler.sol";
 import {IL1Nullifier} from "../interfaces/IL1Nullifier.sol";
 import {IBridgedStandardToken} from "../interfaces/IBridgedStandardToken.sol";
 import {IL1AssetRouter} from "../asset-router/IL1AssetRouter.sol";
+import {IAssetRouterBase} from "../asset-router/IAssetRouterBase.sol";
 
 import {ETH_TOKEN_ADDRESS} from "../../common/Config.sol";
 import {L2_NATIVE_TOKEN_VAULT_ADDR} from "../../common/l2-helpers/L2ContractAddresses.sol";
@@ -32,6 +33,15 @@ import {ClaimFailedDepositFailed, WrongAmountTransferred, WrongCounterpart, Zero
 contract L1NativeTokenVault is IL1NativeTokenVault, IL1AssetHandler, NativeTokenVault {
     using SafeERC20 for IERC20;
 
+    /// @dev The address of the WETH token.
+    address public immutable override WETH_TOKEN;
+
+    /// @dev L1 Shared Bridge smart contract that handles communication with its counterparts on L2s
+    IAssetRouterBase public immutable override ASSET_ROUTER;
+
+    /// @dev The assetId of the base token.
+    bytes32 public immutable BASE_TOKEN_ASSET_ID;
+
     /// @dev L1 nullifier contract that handles legacy functions & finalize withdrawal, confirm l2 tx mappings
     IL1Nullifier public immutable override L1_NULLIFIER;
 
@@ -45,18 +55,10 @@ contract L1NativeTokenVault is IL1NativeTokenVault, IL1AssetHandler, NativeToken
     /// @param _l1WethAddress Address of WETH on deployed chain
     /// @param _l1AssetRouter Address of Asset Router on L1.
     /// @param _l1Nullifier Address of the nullifier contract, which handles transaction progress between L1 and ZK chains.
-    constructor(
-        address _l1WethAddress,
-        address _l1AssetRouter,
-        IL1Nullifier _l1Nullifier
-    )
-        NativeTokenVault(
-            _l1WethAddress,
-            _l1AssetRouter,
-            DataEncoding.encodeNTVAssetId(block.chainid, ETH_TOKEN_ADDRESS),
-            block.chainid
-        )
-    {
+    constructor(address _l1WethAddress, address _l1AssetRouter, IL1Nullifier _l1Nullifier) {
+        WETH_TOKEN = _l1WethAddress;
+        ASSET_ROUTER = IAssetRouterBase(_l1AssetRouter);
+        BASE_TOKEN_ASSET_ID = DataEncoding.encodeNTVAssetId(block.chainid, ETH_TOKEN_ADDRESS);
         L1_NULLIFIER = _l1Nullifier;
     }
 
@@ -314,4 +316,24 @@ contract L1NativeTokenVault is IL1NativeTokenVault, IL1AssetHandler, NativeToken
     function _hasInfiniteBalance(bool _isNative, bytes32 _assetId, uint256 _chainId) private view returns (bool) {
         return !_isNative && originChainId[_assetId] == _chainId;
     }
+
+    function L1_CHAIN_ID() public view override returns (uint256) {
+        return block.chainid;
+    }
+
+    function _wethToken() internal view override returns (address) {
+        return WETH_TOKEN;
+    }
+
+    function _assetRouter() internal view override returns (IAssetRouterBase) {
+        return ASSET_ROUTER;
+    }
+
+    function _baseTokenAssetId() internal view override returns (bytes32) {
+        return BASE_TOKEN_ASSET_ID;
+    }
+
+    function _l1ChainId() internal view override returns (uint256) {
+        return block.chainid;
+    }
 }