contracts-bedrock: 2nd preimage resistance

packages/contracts-bedrock/.gas-snapshot

@@ -570,8 +570,8 @@ SequencerFeeVault_Test:test_withdraw_toL1_succeeds() (gas: 171357)
 SetPrevBaseFee_Test:test_setPrevBaseFee_succeeds() (gas: 11549)
 StandardBridge_Stateless_Test:test_isCorrectTokenPair_succeeds() (gas: 49936)
 StandardBridge_Stateless_Test:test_isOptimismMintableERC20_succeeds() (gas: 33072)
-SystemConfig_Initialize_Test:test_initialize_values_succeeds() (gas: 60815)
-SystemConfig_Initialize_TestFail:test_initialize_lowGasLimit_reverts() (gas: 89103)
+SystemConfig_Initialize_Test:test_initialize_values_succeeds() (gas: 61199)
+SystemConfig_Initialize_TestFail:test_initialize_lowGasLimit_reverts() (gas: 89514)
 SystemConfig_Setters_TestFail:test_setBatcherHash_notOwner_reverts() (gas: 15585)
 SystemConfig_Setters_TestFail:test_setGasConfig_notOwner_reverts() (gas: 15577)
 SystemConfig_Setters_TestFail:test_setGasLimit_notOwner_reverts() (gas: 15654)

packages/contracts-bedrock/semver-lock.json

@@ -4,7 +4,7 @@
   "src/L1/L1StandardBridge.sol": "0xa35dc0ab143043063c3bff73c8b065e401c23296a2017258ce8a87f4a4da9416",
   "src/L1/L2OutputOracle.sol": "0x8f32ccb4c5cb63a459a0e79ee412177dc03fd279fdaaf1dac69e8c714902e857",
   "src/L1/OptimismPortal.sol": "0xeaa47a63e8a3bcfdb7dfd3e6c8608369e34e362d9de82f3acf13cbc27c070bf7",
-  "src/L1/SystemConfig.sol": "0x087e16affe6fd6b8a2ef61492cedb7e7f9c71fe6e9cce0e7b1082613262c78e7",
+  "src/L1/SystemConfig.sol": "0xb3a313305b6b813cf2ef0a2a11a94cbd26a14b8e00e6b8fd6c07eff23890e179",
   "src/L2/BaseFeeVault.sol": "0xa596e60762f16192cfa86459fcb9f4da9d8f756106eedac643a1ffeafbbfcc5f",
   "src/L2/GasPriceOracle.sol": "0xc735a8bf01ad8bca194345748537bfd9924909c0342bc133c4a31e2fb8cb9882",
   "src/L2/L1Block.sol": "0x7fbfc8b4da630386636c665570321fdec287b0867dbe0f91c2e7cd5b7697c220",

packages/contracts-bedrock/src/L1/SystemConfig.sol

@@ -42,26 +42,35 @@ contract SystemConfig is OwnableUpgradeable, Semver {
     ///         Storing it at this deterministic storage slot allows for decoupling the storage
     ///         layout from the way that `solc` lays out storage. The `op-node` uses a storage
     ///         proof to fetch this value.
+    ///         NOTE: this value will be migrated to another storage slot in a future version.
+    ///         User input should not be placed in storage in this contract until this migration
+    ///         happens. It is unlikely that keccak second preimage resistance will be broken,
+    ///         but it is better to be safe than sorry.
     bytes32 public constant UNSAFE_BLOCK_SIGNER_SLOT = keccak256("systemconfig.unsafeblocksigner");
 
     /// @notice Storage slot that the L1CrossDomainMessenger address is stored at.
     bytes32 public constant L1_CROSS_DOMAIN_MESSENGER_SLOT =
-        keccak256("systemconfig.l1crossdomainmessenger");
+        bytes32(uint256(keccak256("systemconfig.l1crossdomainmessenger")) - 1);
 
     /// @notice Storage slot that the L1ERC721Bridge address is stored at.
-    bytes32 public constant L1_ERC_721_BRIDGE_SLOT = keccak256("systemconfig.l1erc721bridge");
+    bytes32 public constant L1_ERC_721_BRIDGE_SLOT =
+        bytes32(uint256(keccak256("systemconfig.l1erc721bridge")) - 1);
 
     /// @notice Storage slot that the L1StandardBridge address is stored at.
-    bytes32 public constant L1_STANDARD_BRIDGE_SLOT = keccak256("systemconfig.l1standardbridge");
+    bytes32 public constant L1_STANDARD_BRIDGE_SLOT =
+        bytes32(uint256(keccak256("systemconfig.l1standardbridge")) - 1);
 
     /// @notice Storage slot that the L2OutputOracle address is stored at.
-    bytes32 public constant L2_OUTPUT_ORACLE_SLOT = keccak256("systemconfig.l2outputoracle");
+    bytes32 public constant L2_OUTPUT_ORACLE_SLOT =
+        bytes32(uint256(keccak256("systemconfig.l2outputoracle")) - 1);
 
     /// @notice Storage slot that the OptimismPortal address is stored at.
-    bytes32 public constant OPTIMISM_PORTAL_SLOT = keccak256("systemconfig.optimismportal");
+    bytes32 public constant OPTIMISM_PORTAL_SLOT =
+        bytes32(uint256(keccak256("systemconfig.optimismportal")) - 1);
 
     /// @notice Storage slot that the batch inbox address is stored at.
-    bytes32 public constant BATCH_INBOX_SLOT = keccak256("systemconfig.batchinbox");
+    bytes32 public constant BATCH_INBOX_SLOT =
+        bytes32(uint256(keccak256("systemconfig.batchinbox")) - 1);
 
     /// @notice Fixed L2 gas overhead. Used as part of the L2 fee calculation.
     uint256 public overhead;