Draft: Adapting contracts for zksync os v30

.github/workflows/slither.yaml

@@ -55,8 +55,9 @@ jobs:
 
       - name: Run Slither for L1 contracts
         working-directory: ./l1-contracts
+        # FIXME? --skip assembly because otherwise IR for DummyVerifierPlonk can't be generated (Slither issue).
         run: |
-          slither --config ./slither.config.json .
+          slither --config ./slither.config.json --skip-assembly .
 
       - name: Run Slither for L2 contracts
         working-directory: ./l2-contracts

docs/l2_system_contracts/system_contracts_bootloader_description.md

@@ -704,11 +704,14 @@ A contract that is responsible for facilitating initialization of a newly create
 
 ### Bridging-related contracts
 
-`L2Bridgehub`, `L2AssetRouter`, `L2NativeTokenVault`, as well as `L2MessageRoot`.
+- [`L2Bridgehub`](../../l1-contracts/contracts/bridgehub/L2Bridgehub.sol)
+- [`L2AssetRouter`](../../l1-contracts/contracts/bridge/asset-router/L2AssetRouter.sol)
+- [`L2NativeTokenVault`](../../l1-contracts/contracts/bridge/ntv/L2NativeTokenVault.sol)
+- [`L2MessageRoot`](../../l1-contracts/contracts/bridgehub/L2MessageRoot.sol)
 
 These contracts are used to facilitate cross-chain communication as well value bridging. You can read more about then in [the asset router spec](../bridging/asset_router/overview.md).
 
-Note, that [L2AssetRouter](../../l1-contracts/contracts/bridge/asset-router/L2AssetRouter.sol) and [L2NativeTokenVault](../../l1-contracts/contracts/bridge/ntv/L2NativeTokenVault.sol) have unique code, the L2Bridgehub and L2MessageRoot share the same source code with their L1 precompiles, i.e. the L2Bridgehub has [this](../../l1-contracts/contracts/bridgehub/Bridgehub.sol) code and L2MessageRoot has [this](../../l1-contracts/contracts/bridgehub/MessageRoot.sol) code.
+Note, that [L2AssetRouter](../../l1-contracts/contracts/bridge/asset-router/L2AssetRouter.sol) and [L2NativeTokenVault](../../l1-contracts/contracts/bridge/ntv/L2NativeTokenVault.sol) have unique code, the L2Bridgehub and L2MessageRoot share the same source code with their L1 precompiles, i.e. the L2Bridgehub has [this](../../l1-contracts/contracts/bridgehub/L2Bridgehub.sol) code and L2MessageRoot has [this](../../l1-contracts/contracts/bridgehub/L2MessageRoot.sol) code.
 
 ### SloadContract
 

l1-contracts/.env

@@ -59,3 +59,5 @@ DEPLOY_GATEWAY_TX_FILTERER_INPUT=/script-config/deploy-gateway-tx-filterer.toml
 DEPLOY_GATEWAY_TX_FILTERER_OUTPUT=/script-out/deploy-gateway-tx-filterer.toml
 GATEWAY_VOTE_PREPARATION_INPUT=/script-config/gateway-vote-preparation.toml
 GATEWAY_VOTE_PREPARATION_OUTPUT=/script-out/gateway-vote-preparation.toml
+ZK_OS_V28_1_UPGRADE_ECOSYSTEM_INPUT=/script-config/zk-os-v28-1-upgrade-ecosystem.toml
+ZK_OS_V28_1_UPGRADE_ECOSYSTEM_OUTPUT=/script-out/zk-os-v28-1-upgrade-ecosystem.toml

l1-contracts/contracts/bridge/asset-router/AssetRouterBase.sol

@@ -2,11 +2,11 @@
 
 pragma solidity 0.8.28;
 
 import {Ownable2StepUpgradeable} from "@openzeppelin/contracts-upgradeable-v4/access/Ownable2StepUpgradeable.sol";
 import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable-v4/security/PausableUpgradeable.sol";
 
 import {IERC20} from "@openzeppelin/contracts-v4/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts-v4/token/ERC20/utils/SafeERC20.sol";
 
 import {IAssetRouterBase} from "./IAssetRouterBase.sol";
 import {IAssetHandler} from "../interfaces/IAssetHandler.sol";
@@ -25,14 +25,15 @@
 abstract contract AssetRouterBase is IAssetRouterBase, Ownable2StepUpgradeable, PausableUpgradeable {
     using SafeERC20 for IERC20;
 
-    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
-    IBridgehub public immutable override BRIDGE_HUB;
+    /*//////////////////////////////////////////////////////////////
+                            IMMUTABLE GETTERS
+    //////////////////////////////////////////////////////////////*/
+
+    function _bridgehub() internal view virtual returns (IBridgehub);
 
-    /// @dev Chain ID of L1 for bridging reasons
-    uint256 public immutable L1_CHAIN_ID;
+    function _l1ChainId() internal view virtual returns (uint256);
 
-    /// @dev Chain ID of Era for legacy reasons
-    uint256 public immutable ERA_CHAIN_ID;
+    function _eraChainId() internal view virtual returns (uint256);
 
     /// @dev Maps asset ID to address of corresponding asset handler.
     /// @dev Tracks the address of Asset Handler contracts, where bridged funds are locked for each asset.
@@ -55,20 +56,12 @@
 
     /// @notice Checks that the message sender is the bridgehub.
     modifier onlyBridgehub() {
-        if (msg.sender != address(BRIDGE_HUB)) {
+        if (msg.sender != address(_bridgehub())) {
             revert Unauthorized(msg.sender);
         }
         _;
     }
 
-    /// @dev Contract is expected to be used as proxy implementation.
-    /// @dev Initialize the implementation to prevent Parity hack.
-    constructor(uint256 _l1ChainId, uint256 _eraChainId, IBridgehub _bridgehub) {
-        L1_CHAIN_ID = _l1ChainId;
-        ERA_CHAIN_ID = _eraChainId;
-        BRIDGE_HUB = _bridgehub;
-    }
-
     /// @inheritdoc IAssetRouterBase
     function setAssetHandlerAddressThisChain(
         bytes32 _assetRegistrationData,

l1-contracts/contracts/bridge/asset-router/L1AssetRouter.sol

@@ -2,8 +2,8 @@
 
 pragma solidity 0.8.28;
 
 import {IERC20} from "@openzeppelin/contracts-v4/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts-v4/token/ERC20/utils/SafeERC20.sol";
 
 import {IL1AssetRouter} from "./IL1AssetRouter.sol";
 import {IL2AssetRouter} from "./IL2AssetRouter.sol";
@@ -36,6 +36,12 @@
 contract L1AssetRouter is AssetRouterBase, IL1AssetRouter, ReentrancyGuard {
     using SafeERC20 for IERC20;
 
+    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
+    IBridgehub public immutable override BRIDGE_HUB;
+
+    /// @dev Chain ID of Era for legacy reasons
+    uint256 public immutable ERA_CHAIN_ID;
+
     /// @dev The address of the WETH token on L1.
     address public immutable override L1_WETH_TOKEN;
 
@@ -94,8 +100,10 @@
         address _l1Nullifier,
         uint256 _eraChainId,
         address _eraDiamondProxy
-    ) reentrancyGuardInitializer AssetRouterBase(block.chainid, _eraChainId, IBridgehub(_bridgehub)) {
+    ) reentrancyGuardInitializer {
         _disableInitializers();
+        BRIDGE_HUB = IBridgehub(_bridgehub);
+        ERA_CHAIN_ID = _eraChainId;
         L1_WETH_TOKEN = _l1WethAddress;
         ERA_DIAMOND_PROXY = _eraDiamondProxy;
         L1_NULLIFIER = IL1Nullifier(_l1Nullifier);
@@ -673,4 +681,20 @@
     function l2BridgeAddress(uint256 _chainId) external view override returns (address) {
         return L1_NULLIFIER.l2BridgeAddress(_chainId);
     }
+
+    function L1_CHAIN_ID() external view override returns (uint256) {
+        return block.chainid;
+    }
+
+    function _bridgehub() internal view override returns (IBridgehub) {
+        return BRIDGE_HUB;
+    }
+
+    function _l1ChainId() internal view override returns (uint256) {
+        return block.chainid;
+    }
+
+    function _eraChainId() internal view override returns (uint256) {
+        return ERA_CHAIN_ID;
+    }
 }

l1-contracts/contracts/bridge/asset-router/L2AssetRouter.sol

@@ -15,7 +15,7 @@ import {IBridgehub} from "../../bridgehub/IBridgehub.sol";
 import {AddressAliasHelper} from "../../vendor/AddressAliasHelper.sol";
 import {ReentrancyGuard} from "../../common/ReentrancyGuard.sol";
 
-import {L2_BRIDGEHUB_ADDR, L2_NATIVE_TOKEN_VAULT_ADDR} from "../../common/l2-helpers/L2ContractAddresses.sol";
+import {L2_BRIDGEHUB_ADDR, L2_COMPLEX_UPGRADER_ADDR, L2_NATIVE_TOKEN_VAULT_ADDR} from "../../common/l2-helpers/L2ContractAddresses.sol";
 import {L2ContractHelper} from "../../common/l2-helpers/L2ContractHelper.sol";
 import {DataEncoding} from "../../common/libraries/DataEncoding.sol";
 import {AmountMustBeGreaterThanZero, AssetIdNotSupported, EmptyAddress, InvalidCaller, TokenNotLegacy} from "../../common/L1ContractErrors.sol";
@@ -24,19 +24,41 @@ import {AmountMustBeGreaterThanZero, AssetIdNotSupported, EmptyAddress, InvalidC
 /// @custom:security-contact [email protected]
 /// @notice The "default" bridge implementation for the ERC20 tokens. Note, that it does not
 /// support any custom token logic, i.e. rebase tokens' functionality is not supported.
+/// @dev Important: L2 contracts are not allowed to have any immutable variables or constructors. This is needed for compatibility with ZKsyncOS.
 contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
-    /// @dev The address of the L2 legacy shared bridge.
-    address public immutable L2_LEGACY_SHARED_BRIDGE;
+    /// @dev Bridgehub smart contract that is used to operate with L2 via asynchronous L2 <-> L1 communication.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    IBridgehub public override BRIDGE_HUB;
 
-    /// @dev The asset id of the base token.
-    bytes32 public immutable BASE_TOKEN_ASSET_ID;
+    /// @dev Chain ID of L1 for bridging reasons.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    uint256 public L1_CHAIN_ID;
+
+    /// @dev Chain ID of Era for legacy reasons.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    uint256 public eraChainId;
 
     /// @dev The address of the L1 asset router counterpart.
-    address public immutable override L1_ASSET_ROUTER;
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    address public L1_ASSET_ROUTER;
+
+    /// @dev The address of the L2 legacy shared bridge.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    address public L2_LEGACY_SHARED_BRIDGE;
+
+    /// @dev The asset id of the base token.
+    /// @dev Note, that while it is a simple storage variable, the name is in capslock for the backward compatibility with
+    /// the old version where it was an immutable.
+    bytes32 public BASE_TOKEN_ASSET_ID;
 
     /// @notice Checks that the message sender is the L1 Asset Router.
     modifier onlyAssetRouterCounterpart(uint256 _originChainId) {
-        if (_originChainId == L1_CHAIN_ID) {
+        if (_originChainId == _l1ChainId()) {
             // Only the L1 Asset Router counterpart can initiate and finalize the deposit.
             if (AddressAliasHelper.undoL1ToL2Alias(msg.sender) != L1_ASSET_ROUTER) {
                 revert InvalidCaller(msg.sender);
@@ -49,7 +71,7 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
 
     /// @notice Checks that the message sender is the L1 Asset Router.
     modifier onlyAssetRouterCounterpartOrSelf(uint256 _chainId) {
-        if (_chainId == L1_CHAIN_ID) {
+        if (_chainId == _l1ChainId()) {
             // Only the L1 Asset Router counterpart can initiate and finalize the deposit.
             if ((AddressAliasHelper.undoL1ToL2Alias(msg.sender) != L1_ASSET_ROUTER) && (msg.sender != address(this))) {
                 revert InvalidCaller(msg.sender);
@@ -75,26 +97,61 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
         _;
     }
 
-    /// @dev Disable the initialization to prevent Parity hack.
-    /// @dev this contract is deployed in the L2GenesisUpgrade, and is meant as direct deployment without a proxy.
-    /// @param _l1AssetRouter The address of the L1 Bridge contract.
-    constructor(
+    /// @dev Only allows calls from the complex upgrader contract on L2.
+    modifier onlyUpgrader() {
+        if (msg.sender != L2_COMPLEX_UPGRADER_ADDR) {
+            revert InvalidCaller(msg.sender);
+        }
+        _;
+    }
+
+    /// @notice Initializes the contract.
+    /// @dev This function is used to initialize the contract with the initial values.
+    /// @param _l1ChainId The chain id of L1.
+    /// @param _eraChainId The chain id of Era.
+    /// @param _l1AssetRouter The address of the L1 asset router.
+    /// @param _legacySharedBridge The address of the L2 legacy shared bridge.
+    /// @param _baseTokenAssetId The asset id of the base token.
+    /// @param _aliasedOwner The address of the owner of the contract.
+    function initL2(
         uint256 _l1ChainId,
         uint256 _eraChainId,
         address _l1AssetRouter,
         address _legacySharedBridge,
         bytes32 _baseTokenAssetId,
         address _aliasedOwner
-    ) AssetRouterBase(_l1ChainId, _eraChainId, IBridgehub(L2_BRIDGEHUB_ADDR)) reentrancyGuardInitializer {
+    ) public reentrancyGuardInitializer onlyUpgrader {
+        _disableInitializers();
+        // solhint-disable-next-line func-named-parameters
+        updateL2(_l1ChainId, _eraChainId, _l1AssetRouter, _legacySharedBridge, _baseTokenAssetId);
+        _setAssetHandler(_baseTokenAssetId, L2_NATIVE_TOKEN_VAULT_ADDR);
+        _transferOwnership(_aliasedOwner);
+    }
+
+    /// @notice Updates the contract.
+    /// @dev This function is used to initialize the new implementation of L2AssetRouter on existing chains during
+    /// the upgrade.
+    /// @param _l1ChainId The chain id of L1.
+    /// @param _eraChainId The chain id of Era.
+    /// @param _l1AssetRouter The address of the L1 asset router.
+    /// @param _legacySharedBridge The address of the L2 legacy shared bridge.
+    /// @param _baseTokenAssetId The asset id of the base token.
+    function updateL2(
+        uint256 _l1ChainId,
+        uint256 _eraChainId,
+        address _l1AssetRouter,
+        address _legacySharedBridge,
+        bytes32 _baseTokenAssetId
+    ) public onlyUpgrader {
         L2_LEGACY_SHARED_BRIDGE = _legacySharedBridge;
         if (_l1AssetRouter == address(0)) {
             revert EmptyAddress();
         }
+        L1_CHAIN_ID = _l1ChainId;
         L1_ASSET_ROUTER = _l1AssetRouter;
-        _setAssetHandler(_baseTokenAssetId, L2_NATIVE_TOKEN_VAULT_ADDR);
         BASE_TOKEN_ASSET_ID = _baseTokenAssetId;
-        _disableInitializers();
-        _transferOwnership(_aliasedOwner);
+        eraChainId = _eraChainId;
+        BRIDGE_HUB = IBridgehub(L2_BRIDGEHUB_ADDR);
     }
 
     /// @inheritdoc IL2AssetRouter
@@ -136,15 +193,15 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
         public
         payable
         override(AssetRouterBase, IAssetRouterBase)
-        onlyAssetRouterCounterpartOrSelf(L1_CHAIN_ID)
+        onlyAssetRouterCounterpartOrSelf(_l1ChainId())
         nonReentrant
     {
         if (_assetId == BASE_TOKEN_ASSET_ID) {
             revert AssetIdNotSupported(BASE_TOKEN_ASSET_ID);
         }
-        _finalizeDeposit(L1_CHAIN_ID, _assetId, _transferData, L2_NATIVE_TOKEN_VAULT_ADDR);
+        _finalizeDeposit(_l1ChainId(), _assetId, _transferData, L2_NATIVE_TOKEN_VAULT_ADDR);
 
-        emit DepositFinalizedAssetRouter(L1_CHAIN_ID, _assetId, _transferData);
+        emit DepositFinalizedAssetRouter(_l1ChainId(), _assetId, _transferData);
     }
 
     /// @notice Initiates a withdrawal by burning funds on the contract and sending the message to L1
@@ -177,7 +234,7 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
         bool _alwaysNewMessageFormat
     ) internal returns (bytes32 txHash) {
         bytes memory l1bridgeMintData = _burn({
-            _chainId: L1_CHAIN_ID,
+            _chainId: _l1ChainId(),
             _nextMsgValue: 0,
             _assetId: _assetId,
             _originalCaller: _sender,
@@ -204,7 +261,7 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
             txHash = IL2SharedBridgeLegacy(L2_LEGACY_SHARED_BRIDGE).sendMessageToL1(message);
         }
 
-        emit WithdrawalInitiatedAssetRouter(L1_CHAIN_ID, _sender, _assetId, _assetData);
+        emit WithdrawalInitiatedAssetRouter(_l1ChainId(), _sender, _assetId, _assetData);
     }
 
     /// @notice Encodes the message for l2ToL1log sent during withdraw initialization.
@@ -362,4 +419,16 @@ contract L2AssetRouter is AssetRouterBase, IL2AssetRouter, ReentrancyGuard {
     function l1Bridge() external view returns (address) {
         return L1_ASSET_ROUTER;
     }
+
+    function _bridgehub() internal pure override returns (IBridgehub) {
+        return IBridgehub(L2_BRIDGEHUB_ADDR);
+    }
+
+    function _l1ChainId() internal view override returns (uint256) {
+        return L1_CHAIN_ID;
+    }
+
+    function _eraChainId() internal view override returns (uint256) {
+        return eraChainId;
+    }
 }

l1-contracts/contracts/bridge/interfaces/IL2WrappedBaseToken.sol

@@ -12,4 +12,20 @@ interface IL2WrappedBaseToken {
     function depositTo(address _to) external payable;
 
     function withdrawTo(address _to, uint256 _amount) external;
+
+    /// @notice Initializes a contract token for later use. Expected to be used in the proxy.
+    /// @notice This function is used to integrate the previously deployed WETH token with the bridge.
+    /// @dev Sets up `name`/`symbol`/`decimals` getters.
+    /// @param name_ The name of the token.
+    /// @param symbol_ The symbol of the token.
+    /// @param _l2Bridge Address of the L2 bridge
+    /// @param _l1Address Address of the L1 token that can be deposited to mint this L2 WETH.
+    /// Note: The decimals are hardcoded to 18, the same as on Ether.
+    function initializeV3(
+        string calldata name_,
+        string calldata symbol_,
+        address _l2Bridge,
+        address _l1Address,
+        bytes32 _baseTokenAssetId
+    ) external;
 }