Merge branch 'develop' into dependabot/npm_and_yarn/glob-10.3.7

go.mod

@@ -210,4 +210,5 @@ require (
 
 replace github.com/ethereum/go-ethereum v1.13.1 => github.com/ethereum-optimism/op-geth v1.101202.0-rc.1.0.20230925151842-7dfe72eb2d63
 
+//replace github.com/ethereum-optimism/superchain-registry/superchain => ../superchain-registry/superchain
 //replace github.com/ethereum/go-ethereum v1.13.1 => ../go-ethereum

op-bindings/artifacts.json

@@ -39,5 +39,6 @@
   "ProtocolVersions",
   "Safe",
   "SafeProxyFactory",
-  "DelayedVetoable"
+  "DelayedVetoable",
+  "ISemver"
 ]

op-bindings/bindings/isemver.go

+// Code generated - DO NOT EDIT.
+// This file is a generated binding and any manual changes will be lost.
+
+package bindings
+
+import (
+	"errors"
+	"math/big"
+	"strings"
+
+	ethereum "github.com/ethereum/go-ethereum"
+	"github.com/ethereum/go-ethereum/accounts/abi"
+	"github.com/ethereum/go-ethereum/accounts/abi/bind"
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/core/types"
+	"github.com/ethereum/go-ethereum/event"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var (
+	_ = errors.New
+	_ = big.NewInt
+	_ = strings.NewReader
+	_ = ethereum.NotFound
+	_ = bind.Bind
+	_ = common.Big1
+	_ = types.BloomLookup
+	_ = event.NewSubscription
+)
+
+// ISemverMetaData contains all meta data concerning the ISemver contract.
+var ISemverMetaData = &bind.MetaData{
+	ABI: "[{\"inputs\":[],\"name\":\"version\",\"outputs\":[{\"internalType\":\"string\",\"name\":\"\",\"type\":\"string\"}],\"stateMutability\":\"view\",\"type\":\"function\"}]",
+}
+
+// ISemverABI is the input ABI used to generate the binding from.
+// Deprecated: Use ISemverMetaData.ABI instead.
+var ISemverABI = ISemverMetaData.ABI
+
+// ISemver is an auto generated Go binding around an Ethereum contract.
+type ISemver struct {
+	ISemverCaller     // Read-only binding to the contract
+	ISemverTransactor // Write-only binding to the contract
+	ISemverFilterer   // Log filterer for contract events
+}
+
+// ISemverCaller is an auto generated read-only Go binding around an Ethereum contract.
+type ISemverCaller struct {
+	contract *bind.BoundContract // Generic contract wrapper for the low level calls
+}
+
+// ISemverTransactor is an auto generated write-only Go binding around an Ethereum contract.
+type ISemverTransactor struct {
+	contract *bind.BoundContract // Generic contract wrapper for the low level calls
+}
+
+// ISemverFilterer is an auto generated log filtering Go binding around an Ethereum contract events.
+type ISemverFilterer struct {
+	contract *bind.BoundContract // Generic contract wrapper for the low level calls
+}
+
+// ISemverSession is an auto generated Go binding around an Ethereum contract,
+// with pre-set call and transact options.
+type ISemverSession struct {
+	Contract     *ISemver          // Generic contract binding to set the session for
+	CallOpts     bind.CallOpts     // Call options to use throughout this session
+	TransactOpts bind.TransactOpts // Transaction auth options to use throughout this session
+}
+
+// ISemverCallerSession is an auto generated read-only Go binding around an Ethereum contract,
+// with pre-set call options.
+type ISemverCallerSession struct {
+	Contract *ISemverCaller // Generic contract caller binding to set the session for
+	CallOpts bind.CallOpts  // Call options to use throughout this session
+}
+
+// ISemverTransactorSession is an auto generated write-only Go binding around an Ethereum contract,
+// with pre-set transact options.
+type ISemverTransactorSession struct {
+	Contract     *ISemverTransactor // Generic contract transactor binding to set the session for
+	TransactOpts bind.TransactOpts  // Transaction auth options to use throughout this session
+}
+
+// ISemverRaw is an auto generated low-level Go binding around an Ethereum contract.
+type ISemverRaw struct {
+	Contract *ISemver // Generic contract binding to access the raw methods on
+}
+
+// ISemverCallerRaw is an auto generated low-level read-only Go binding around an Ethereum contract.
+type ISemverCallerRaw struct {
+	Contract *ISemverCaller // Generic read-only contract binding to access the raw methods on
+}
+
+// ISemverTransactorRaw is an auto generated low-level write-only Go binding around an Ethereum contract.
+type ISemverTransactorRaw struct {
+	Contract *ISemverTransactor // Generic write-only contract binding to access the raw methods on
+}
+
+// NewISemver creates a new instance of ISemver, bound to a specific deployed contract.
+func NewISemver(address common.Address, backend bind.ContractBackend) (*ISemver, error) {
+	contract, err := bindISemver(address, backend, backend, backend)
+	if err != nil {
+		return nil, err
+	}
+	return &ISemver{ISemverCaller: ISemverCaller{contract: contract}, ISemverTransactor: ISemverTransactor{contract: contract}, ISemverFilterer: ISemverFilterer{contract: contract}}, nil
+}
+
+// NewISemverCaller creates a new read-only instance of ISemver, bound to a specific deployed contract.
+func NewISemverCaller(address common.Address, caller bind.ContractCaller) (*ISemverCaller, error) {
+	contract, err := bindISemver(address, caller, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	return &ISemverCaller{contract: contract}, nil
+}
+
+// NewISemverTransactor creates a new write-only instance of ISemver, bound to a specific deployed contract.
+func NewISemverTransactor(address common.Address, transactor bind.ContractTransactor) (*ISemverTransactor, error) {
+	contract, err := bindISemver(address, nil, transactor, nil)
+	if err != nil {
+		return nil, err
+	}
+	return &ISemverTransactor{contract: contract}, nil
+}
+
+// NewISemverFilterer creates a new log filterer instance of ISemver, bound to a specific deployed contract.
+func NewISemverFilterer(address common.Address, filterer bind.ContractFilterer) (*ISemverFilterer, error) {
+	contract, err := bindISemver(address, nil, nil, filterer)
+	if err != nil {
+		return nil, err
+	}
+	return &ISemverFilterer{contract: contract}, nil
+}
+
+// bindISemver binds a generic wrapper to an already deployed contract.
+func bindISemver(address common.Address, caller bind.ContractCaller, transactor bind.ContractTransactor, filterer bind.ContractFilterer) (*bind.BoundContract, error) {
+	parsed, err := abi.JSON(strings.NewReader(ISemverABI))
+	if err != nil {
+		return nil, err
+	}
+	return bind.NewBoundContract(address, parsed, caller, transactor, filterer), nil
+}
+
+// Call invokes the (constant) contract method with params as input values and
+// sets the output to result. The result type might be a single field for simple
+// returns, a slice of interfaces for anonymous returns and a struct for named
+// returns.
+func (_ISemver *ISemverRaw) Call(opts *bind.CallOpts, result *[]interface{}, method string, params ...interface{}) error {
+	return _ISemver.Contract.ISemverCaller.contract.Call(opts, result, method, params...)
+}
+
+// Transfer initiates a plain transaction to move funds to the contract, calling
+// its default method if one is available.
+func (_ISemver *ISemverRaw) Transfer(opts *bind.TransactOpts) (*types.Transaction, error) {
+	return _ISemver.Contract.ISemverTransactor.contract.Transfer(opts)
+}
+
+// Transact invokes the (paid) contract method with params as input values.
+func (_ISemver *ISemverRaw) Transact(opts *bind.TransactOpts, method string, params ...interface{}) (*types.Transaction, error) {
+	return _ISemver.Contract.ISemverTransactor.contract.Transact(opts, method, params...)
+}
+
+// Call invokes the (constant) contract method with params as input values and
+// sets the output to result. The result type might be a single field for simple
+// returns, a slice of interfaces for anonymous returns and a struct for named
+// returns.
+func (_ISemver *ISemverCallerRaw) Call(opts *bind.CallOpts, result *[]interface{}, method string, params ...interface{}) error {
+	return _ISemver.Contract.contract.Call(opts, result, method, params...)
+}
+
+// Transfer initiates a plain transaction to move funds to the contract, calling
+// its default method if one is available.
+func (_ISemver *ISemverTransactorRaw) Transfer(opts *bind.TransactOpts) (*types.Transaction, error) {
+	return _ISemver.Contract.contract.Transfer(opts)
+}
+
+// Transact invokes the (paid) contract method with params as input values.
+func (_ISemver *ISemverTransactorRaw) Transact(opts *bind.TransactOpts, method string, params ...interface{}) (*types.Transaction, error) {
+	return _ISemver.Contract.contract.Transact(opts, method, params...)
+}
+
+// Version is a free data retrieval call binding the contract method 0x54fd4d50.
+//
+// Solidity: function version() view returns(string)
+func (_ISemver *ISemverCaller) Version(opts *bind.CallOpts) (string, error) {
+	var out []interface{}
+	err := _ISemver.contract.Call(opts, &out, "version")
+
+	if err != nil {
+		return *new(string), err
+	}
+
+	out0 := *abi.ConvertType(out[0], new(string)).(*string)
+
+	return out0, err
+
+}
+
+// Version is a free data retrieval call binding the contract method 0x54fd4d50.
+//
+// Solidity: function version() view returns(string)
+func (_ISemver *ISemverSession) Version() (string, error) {
+	return _ISemver.Contract.Version(&_ISemver.CallOpts)
+}
+
+// Version is a free data retrieval call binding the contract method 0x54fd4d50.
+//
+// Solidity: function version() view returns(string)
+func (_ISemver *ISemverCallerSession) Version() (string, error) {
+	return _ISemver.Contract.Version(&_ISemver.CallOpts)
+}

op-bindings/bindings/isemver_more.go

+// Code generated - DO NOT EDIT.
+// This file is a generated binding and any manual changes will be lost.
+
+package bindings
+
+import (
+	"encoding/json"
+
+	"github.com/ethereum-optimism/optimism/op-bindings/solc"
+)
+
+const ISemverStorageLayoutJSON = "{\"storage\":null,\"types\":{}}"
+
+var ISemverStorageLayout = new(solc.StorageLayout)
+
+var ISemverDeployedBin = "0x"
+
+func init() {
+	if err := json.Unmarshal([]byte(ISemverStorageLayoutJSON), ISemverStorageLayout); err != nil {
+		panic(err)
+	}
+
+	layouts["ISemver"] = ISemverStorageLayout
+	deployedBytecodes["ISemver"] = ISemverDeployedBin
+}

op-chain-ops/clients/clients.go

@@ -20,11 +20,16 @@ type Clients struct {
 	L2GethClient *gethclient.Client
 }
 
-// NewClients will create new RPC clients from a CLI context
-func NewClients(ctx *cli.Context) (*Clients, error) {
+// NewClientsFromContext will create new RPC clients from a CLI context
+func NewClientsFromContext(ctx *cli.Context) (*Clients, error) {
+	return NewClients(ctx.String("l1-rpc-url"), ctx.String("l2-rpc-url"))
+}
+
+// NewClients will create new RPC clients from given URLs.
+func NewClients(l1RpcURL, l2RpcURL string) (*Clients, error) {
 	clients := Clients{}
 
-	if l1RpcURL := ctx.String("l1-rpc-url"); l1RpcURL != "" {
+	if l1RpcURL != "" {
 		l1Client, l1RpcClient, l1GethClient, err := newClients(l1RpcURL)
 		if err != nil {
 			return nil, err
@@ -34,7 +39,7 @@ func NewClients(ctx *cli.Context) (*Clients, error) {
 		clients.L1GethClient = l1GethClient
 	}
 
-	if l2RpcURL := ctx.String("l2-rpc-url"); l2RpcURL != "" {
+	if l2RpcURL != "" {
 		l2Client, l2RpcClient, l2GethClient, err := newClients(l2RpcURL)
 		if err != nil {
 			return nil, err

op-chain-ops/cmd/check-l2/main.go

@@ -58,7 +58,7 @@ func main() {
 
 // entrypoint is the entrypoint for the check-l2 script
 func entrypoint(ctx *cli.Context) error {
-	clients, err := clients.NewClients(ctx)
+	clients, err := clients.NewClientsFromContext(ctx)
 	if err != nil {
 		return err
 	}

op-chain-ops/cmd/op-upgrade/README.md

+# op-upgrade
+
+A CLI tool for building Safe bundles that can upgrade many chains
+at the same time. It will output a JSON file that is compatible with
+the Safe UI. It is assumed that the implementations that are being
+upgraded to have already been deployed and their contract addresses
+exist inside of the `superchain-registry` repository. It is also
+assumed that the semantic version file in the `superchain-registry`
+has been updated. The tool will use semantic versioning to determine
+which contract versions should be upgraded to and then build all of
+the calldata.
+
+### Configuration
+
+#### L1 RPC URL
+
+The L1 RPC URL is used to determine which superchain to target. All
+L2s that are not based on top of the L1 chain that corresponds to the
+L1 RPC URL are filtered out from being included. It also is used to
+double check that the data in the `superchain-registry` is correct.
+
+#### Chain IDs
+
+A list of L2 chain IDs can be passed that will be used to filter which
+L2 chains will have upgrades included in the bundle transaction. Omitting
+this argument will result in all chains in the superchain being considered.
+
+#### Deploy Config
+
+The path to the `deploy-config` directory in the contracts package.
+Since multiple L2 networks may be included in the bundle, the `deploy-config`
+directory must be passed and then the particular deploy config files will
+be read out of the directory as needed.
+
+#### Outfile
+
+The file that the bundle shoudl be written to. If omitted, the file
+will be written to stdout.

op-chain-ops/cmd/op-upgrade/main.go

+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"slices"
+
+	"golang.org/x/exp/maps"
+
+	"github.com/ethereum/go-ethereum/ethclient"
+	"github.com/ethereum/go-ethereum/log"
+	"github.com/mattn/go-isatty"
+	"github.com/urfave/cli/v2"
+
+	"github.com/ethereum-optimism/optimism/op-chain-ops/clients"
+	"github.com/ethereum-optimism/optimism/op-chain-ops/genesis"
+	"github.com/ethereum-optimism/optimism/op-chain-ops/safe"
+	"github.com/ethereum-optimism/optimism/op-chain-ops/upgrades"
+
+	"github.com/ethereum-optimism/superchain-registry/superchain"
+)
+
+func main() {
+	log.Root().SetHandler(log.StreamHandler(os.Stderr, log.TerminalFormat(isatty.IsTerminal(os.Stderr.Fd()))))
+
+	app := &cli.App{
+		Name:  "op-upgrade",
+		Usage: "Build transactions useful for upgrading the Superchain",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "l1-rpc-url",
+				Value:   "http://127.0.0.1:8545",
+				Usage:   "L1 RPC URL, the chain ID will be used to determine the superchain",
+				EnvVars: []string{"L1_RPC_URL"},
+			},
+			&cli.Uint64SliceFlag{
+				Name:  "chain-ids",
+				Usage: "L2 Chain IDs corresponding to chains to upgrade. Corresponds to all chains if empty",
+			},
+			&cli.PathFlag{
+				Name:     "deploy-config",
+				Usage:    "The path to the deploy config file",
+				Required: true,
+				EnvVars:  []string{"DEPLOY_CONFIG"},
+			},
+			&cli.PathFlag{
+				Name:    "outfile",
+				Usage:   "The file to write the output to. If not specified, output is written to stdout",
+				EnvVars: []string{"OUTFILE"},
+			},
+		},
+		Action: entrypoint,
+	}
+
+	if err := app.Run(os.Args); err != nil {
+		log.Crit("error op-upgrade", "err", err)
+	}
+}
+
+// entrypoint contains the main logic of the script
+func entrypoint(ctx *cli.Context) error {
+	client, err := ethclient.Dial(ctx.String("l1-rpc-url"))
+	if err != nil {
+		return err
+	}
+
+	// Fetch the L1 chain ID to determine the superchain name
+	l1ChainID, err := client.ChainID(ctx.Context)
+	if err != nil {
+		return err
+	}
+	superchainName, err := toSuperchainName(l1ChainID.Uint64())
+	if err != nil {
+		return err
+	}
+
+	chainIDs := ctx.Uint64Slice("chain-ids")
+	deployConfig := ctx.Path("deploy-config")
+
+	// If no chain IDs are specified, upgrade all chains
+	if len(chainIDs) == 0 {
+		chainIDs = maps.Keys(superchain.OPChains)
+	}
+	slices.Sort(chainIDs)
+
+	targets := make([]*superchain.ChainConfig, 0)
+	for _, chainConfig := range superchain.OPChains {
+		if chainConfig.Superchain == superchainName && slices.Contains(chainIDs, chainConfig.ChainID) {
+			targets = append(targets, chainConfig)
+		}
+	}
+
+	slices.SortFunc(targets, func(i, j *superchain.ChainConfig) int {
+		return int(i.ChainID) - int(j.ChainID)
+	})
+
+	// Create a batch of transactions
+	batch := safe.Batch{}
+
+	for _, chainConfig := range targets {
+		name, err := toDeployConfigName(chainConfig)
+		if err != nil {
+			log.Warn("Skipping unsupported network", "name", chainConfig.Name)
+			continue
+		}
+
+		config, err := genesis.NewDeployConfigWithNetwork(name, deployConfig)
+		if err != nil {
+			return err
+		}
+
+		clients, err := clients.NewClients(ctx.String("l1-rpc-url"), chainConfig.PublicRPC)
+		if err != nil {
+			return err
+		}
+
+		l1ChainID, err := clients.L1Client.ChainID(ctx.Context)
+		if err != nil {
+			return err
+		}
+		l2ChainID, err := clients.L2Client.ChainID(ctx.Context)
+		if err != nil {
+			return err
+		}
+		log.Info(chainConfig.Name, "l1-chain-id", l1ChainID, "l2-chain-id", l2ChainID)
+
+		log.Info("Detecting on chain contracts")
+		// Tracking the individual addresses can be deprecated once the system is upgraded
+		// to the new contracts where the system config has a reference to each address.
+		addresses, ok := superchain.Addresses[l2ChainID.Uint64()]
+		if !ok {
+			return fmt.Errorf("no addresses for chain ID %d", l2ChainID.Uint64())
+		}
+		versions, err := upgrades.GetContractVersions(ctx.Context, addresses, chainConfig, clients.L1Client)
+		if err != nil {
+			return fmt.Errorf("error getting contract versions: %w", err)
+		}
+
+		log.Info("L1CrossDomainMessenger", "version", versions.L1CrossDomainMessenger, "address", addresses.L1CrossDomainMessengerProxy)
+		log.Info("L1ERC721Bridge", "version", versions.L1ERC721Bridge, "address", addresses.L1ERC721BridgeProxy)
+		log.Info("L1StandardBridge", "version", versions.L1StandardBridge, "address", addresses.L1StandardBridgeProxy)
+		log.Info("L2OutputOracle", "version", versions.L2OutputOracle, "address", addresses.L2OutputOracleProxy)
+		log.Info("OptimismMintableERC20Factory", "version", versions.OptimismMintableERC20Factory, "address", addresses.OptimismMintableERC20FactoryProxy)
+		log.Info("OptimismPortal", "version", versions.OptimismPortal, "address", addresses.OptimismPortalProxy)
+		log.Info("SystemConfig", "version", versions.SystemConfig, "address", chainConfig.SystemConfigAddr)
+
+		implementations, ok := superchain.Implementations[l1ChainID.Uint64()]
+		if !ok {
+			return fmt.Errorf("no implementations for chain ID %d", l1ChainID.Uint64())
+		}
+
+		list, err := implementations.Resolve(superchain.SuperchainSemver)
+		if err != nil {
+			return err
+		}
+
+		log.Info("Upgrading to the following versions")
+		log.Info("L1CrossDomainMessenger", "version", list.L1CrossDomainMessenger.Version, "address", list.L1CrossDomainMessenger.Address)
+		log.Info("L1ERC721Bridge", "version", list.L1ERC721Bridge.Version, "address", list.L1ERC721Bridge.Address)
+		log.Info("L1StandardBridge", "version", list.L1StandardBridge.Version, "address", list.L1StandardBridge.Address)
+		log.Info("L2OutputOracle", "version", list.L2OutputOracle.Version, "address", list.L2OutputOracle.Address)
+		log.Info("OptimismMintableERC20Factory", "version", list.OptimismMintableERC20Factory.Version, "address", list.OptimismMintableERC20Factory.Address)
+		log.Info("OptimismPortal", "version", list.OptimismPortal.Version, "address", list.OptimismPortal.Address)
+		log.Info("SystemConfig", "version", list.SystemConfig.Version, "address", list.SystemConfig.Address)
+
+		if err := upgrades.CheckL1(ctx.Context, &list, clients.L1Client); err != nil {
+			return fmt.Errorf("error checking L1: %w", err)
+		}
+
+		if err := upgrades.L1(&batch, list, *addresses, config, chainConfig); err != nil {
+			return err
+		}
+	}
+
+	if outfile := ctx.Path("outfile"); outfile != "" {
+		if err := writeJSON(outfile, batch); err != nil {
+			return err
+		}
+	} else {
+		data, err := json.MarshalIndent(batch, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(data))
+	}
+	return nil
+}
+
+// toDeployConfigName is a temporary function that maps the chain config names
+// to deploy config names. This should be able to be removed in the future
+// with a canonical naming scheme. If an empty string is returned, then
+// it means that the chain is not supported yet.
+func toDeployConfigName(cfg *superchain.ChainConfig) (string, error) {
+	if cfg.Name == "OP-Sepolia" {
+		return "sepolia", nil
+	}
+	if cfg.Name == "OP-Goerli" {
+		return "goerli", nil
+	}
+	if cfg.Name == "PGN" {
+		return "pgn", nil
+	}
+	if cfg.Name == "Zora" {
+		return "zora", nil
+	}
+	if cfg.Name == "OP-Mainnet" {
+		return "mainnet", nil
+	}
+	return "", fmt.Errorf("unsupported chain name %s", cfg.Name)
+}
+
+// toSuperchainName turns a base layer chain id into a superchain
+// network name.
+func toSuperchainName(chainID uint64) (string, error) {
+	if chainID == 1 {
+		return "mainnet", nil
+	}
+	if chainID == 5 {
+		return "goerli", nil
+	}
+	if chainID == 11155111 {
+		return "sepolia", nil
+	}
+	return "", fmt.Errorf("unsupported chain ID %d", chainID)
+}
+
+func writeJSON(outfile string, input interface{}) error {
+	f, err := os.OpenFile(outfile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	enc := json.NewEncoder(f)
+	enc.SetIndent("", "  ")
+	return enc.Encode(input)
+}

op-chain-ops/genesis/config.go

@@ -315,7 +315,7 @@ func (d *DeployConfig) Check() error {
 	}
 	// When the initial resource config is made to be configurable by the DeployConfig, ensure
 	// that this check is updated to use the values from the DeployConfig instead of the defaults.
-	if uint64(d.L2GenesisBlockGasLimit) < uint64(defaultResourceConfig.MaxResourceLimit+defaultResourceConfig.SystemTxMaxGas) {
+	if uint64(d.L2GenesisBlockGasLimit) < uint64(DefaultResourceConfig.MaxResourceLimit+DefaultResourceConfig.SystemTxMaxGas) {
 		return fmt.Errorf("%w: L2 genesis block gas limit is too small", ErrInvalidDeployConfig)
 	}
 	if d.L2GenesisBlockBaseFeePerGas == nil {

op-chain-ops/genesis/layer_one.go

@@ -21,7 +21,7 @@ var (
 	uint128Max = new(big.Int)
 	// The default values for the ResourceConfig, used as part of
 	// an EIP-1559 curve for deposit gas.
-	defaultResourceConfig = bindings.ResourceMeteringResourceConfig{
+	DefaultResourceConfig = bindings.ResourceMeteringResourceConfig{
 		MaxResourceLimit:            20_000_000,
 		ElasticityMultiplier:        10,
 		BaseFeeMaxChangeDenominator: 8,
@@ -37,7 +37,7 @@ func init() {
 		panic("bad uint128Max")
 	}
 	// Set the maximum base fee on the default config.
-	defaultResourceConfig.MaximumBaseFee = uint128Max
+	DefaultResourceConfig.MaximumBaseFee = uint128Max
 }
 
 // BuildL1DeveloperGenesis will create a L1 genesis block after creating

op-chain-ops/genesis/layer_one_test.go

@@ -106,7 +106,7 @@ func TestBuildL1DeveloperGenesis(t *testing.T) {
 	require.NoError(t, err)
 	cfg, err := sysCfg.ResourceConfig(&bind.CallOpts{})
 	require.NoError(t, err)
-	require.Equal(t, cfg, defaultResourceConfig)
+	require.Equal(t, cfg, DefaultResourceConfig)
 	owner, err = sysCfg.Owner(&bind.CallOpts{})
 	require.NoError(t, err)
 	require.Equal(t, owner, config.FinalSystemOwner)

op-chain-ops/upgrades/check.go

+package upgrades
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/ethereum-optimism/optimism/op-bindings/bindings"
+	"github.com/ethereum/go-ethereum/accounts/abi/bind"
+	"github.com/ethereum/go-ethereum/common"
+
+	"github.com/ethereum-optimism/superchain-registry/superchain"
+)
+
+// CheckL1 will check that the versions of the contracts on L1 match the versions
+// in the superchain registry.
+func CheckL1(ctx context.Context, list *superchain.ImplementationList, backend bind.ContractBackend) error {
+	if err := CheckVersionedContract(ctx, list.L1CrossDomainMessenger, backend); err != nil {
+		return fmt.Errorf("L1CrossDomainMessenger: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.L1ERC721Bridge, backend); err != nil {
+		return fmt.Errorf("L1ERC721Bridge: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.L1StandardBridge, backend); err != nil {
+		return fmt.Errorf("L1StandardBridge: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.L2OutputOracle, backend); err != nil {
+		return fmt.Errorf("L2OutputOracle: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.OptimismMintableERC20Factory, backend); err != nil {
+		return fmt.Errorf("OptimismMintableERC20Factory: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.OptimismPortal, backend); err != nil {
+		return fmt.Errorf("OptimismPortal: %w", err)
+	}
+	if err := CheckVersionedContract(ctx, list.SystemConfig, backend); err != nil {
+		return fmt.Errorf("SystemConfig: %w", err)
+	}
+	return nil
+}
+
+// CheckVersionedContract will check that the version of the deployed contract matches
+// the artifact in the superchain registry.
+func CheckVersionedContract(ctx context.Context, contract superchain.VersionedContract, backend bind.ContractBackend) error {
+	addr := common.HexToAddress(contract.Address.String())
+	code, err := backend.CodeAt(ctx, addr, nil)
+	if err != nil {
+		return err
+	}
+	if len(code) == 0 {
+		return fmt.Errorf("no code at %s", addr)
+	}
+	version, err := getVersion(ctx, addr, backend)
+	if err != nil {
+		return err
+	}
+	if !cmpVersion(version, contract.Version) {
+		return fmt.Errorf("version mismatch: expected %s, got %s", contract.Version, version)
+	}
+	return nil
+}
+
+// getContractVersions will fetch the versions of all of the contracts.
+func GetContractVersions(ctx context.Context, addresses *superchain.AddressList, chainConfig *superchain.ChainConfig, backend bind.ContractBackend) (superchain.ContractVersions, error) {
+	var versions superchain.ContractVersions
+	var err error
+
+	versions.L1CrossDomainMessenger, err = getVersion(ctx, common.HexToAddress(addresses.L1CrossDomainMessengerProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("L1CrossDomainMessenger: %w", err)
+	}
+	versions.L1ERC721Bridge, err = getVersion(ctx, common.HexToAddress(addresses.L1ERC721BridgeProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("L1ERC721Bridge: %w", err)
+	}
+	versions.L1StandardBridge, err = getVersion(ctx, common.HexToAddress(addresses.L1StandardBridgeProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("L1StandardBridge: %w", err)
+	}
+	versions.L2OutputOracle, err = getVersion(ctx, common.HexToAddress(addresses.L2OutputOracleProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("L2OutputOracle: %w", err)
+	}
+	versions.OptimismMintableERC20Factory, err = getVersion(ctx, common.HexToAddress(addresses.OptimismMintableERC20FactoryProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("OptimismMintableERC20Factory: %w", err)
+	}
+	versions.OptimismPortal, err = getVersion(ctx, common.HexToAddress(addresses.OptimismPortalProxy.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("OptimismPortal: %w", err)
+	}
+	versions.SystemConfig, err = getVersion(ctx, common.HexToAddress(chainConfig.SystemConfigAddr.String()), backend)
+	if err != nil {
+		return versions, fmt.Errorf("SystemConfig: %w", err)
+	}
+	return versions, err
+}
+
+// getVersion will get the version of a contract at a given address.
+func getVersion(ctx context.Context, addr common.Address, backend bind.ContractBackend) (string, error) {
+	isemver, err := bindings.NewISemver(addr, backend)
+	if err != nil {
+		return "", fmt.Errorf("%s: %w", addr, err)
+	}
+	version, err := isemver.Version(&bind.CallOpts{
+		Context: ctx,
+	})
+	if err != nil {
+		return "", fmt.Errorf("%s: %w", addr, err)
+	}
+	return version, nil
+}
+
+// cmpVersion will compare 2 semver strings, accounting for
+// lack of "v" prefix.
+func cmpVersion(v1, v2 string) bool {
+	if !strings.HasPrefix(v1, "v") {
+		v1 = "v" + v1
+	}
+	if !strings.HasPrefix(v2, "v") {
+		v2 = "v" + v2
+	}
+	return v1 == v2
+}

op-chain-ops/upgrades/l1.go

+package upgrades
+
+import (
+	"fmt"
+	"math/big"
+
+	"github.com/ethereum/go-ethereum/common"
+
+	"github.com/ethereum-optimism/optimism/op-bindings/bindings"
+	"github.com/ethereum-optimism/optimism/op-chain-ops/genesis"
+	"github.com/ethereum-optimism/optimism/op-chain-ops/safe"
+
+	"github.com/ethereum-optimism/superchain-registry/superchain"
+)
+
+// L1 will add calls for upgrading each of the L1 contracts.
+func L1(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	if err := L1CrossDomainMessenger(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := L1ERC721Bridge(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := L1StandardBridge(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := L2OutputOracle(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := OptimismMintableERC20Factory(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := OptimismPortal(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	if err := SystemConfig(batch, implementations, list, config, chainConfig); err != nil {
+		return err
+	}
+	return nil
+}
+
+// L1CrossDomainMessenger will add a call to the batch that upgrades the L1CrossDomainMessenger.
+func L1CrossDomainMessenger(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	l1CrossDomainMessengerABI, err := bindings.L1CrossDomainMessengerMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := l1CrossDomainMessengerABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		common.HexToAddress(list.OptimismPortalProxy.String()),
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.L1CrossDomainMessengerProxy.String()),
+		common.HexToAddress(implementations.L1CrossDomainMessenger.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// L1ERC721Bridge will add a call to the batch that upgrades the L1ERC721Bridge.
+func L1ERC721Bridge(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	l1ERC721BridgeABI, err := bindings.L1ERC721BridgeMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := l1ERC721BridgeABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		common.HexToAddress(list.L1CrossDomainMessengerProxy.String()),
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.L1ERC721BridgeProxy.String()),
+		common.HexToAddress(implementations.L1ERC721Bridge.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// L1StandardBridge will add a call to the batch that upgrades the L1StandardBridge.
+func L1StandardBridge(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	l1StandardBridgeABI, err := bindings.L1StandardBridgeMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := l1StandardBridgeABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		common.HexToAddress(list.L1CrossDomainMessengerProxy.String()),
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.L1StandardBridgeProxy.String()),
+		common.HexToAddress(implementations.L1StandardBridge.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// L2OutputOracle will add a call to the batch that upgrades the L2OutputOracle.
+func L2OutputOracle(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	l2OutputOracleABI, err := bindings.L2OutputOracleMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := l2OutputOracleABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	l2OutputOracleStartingBlockNumber := new(big.Int).SetUint64(config.L2OutputOracleStartingBlockNumber)
+	if config.L2OutputOracleStartingTimestamp < 0 {
+		return fmt.Errorf("L2OutputOracleStartingBlockNumber must be concrete")
+	}
+	l2OutputOraclesStartingTimestamp := new(big.Int).SetInt64(int64(config.L2OutputOracleStartingTimestamp))
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		l2OutputOracleStartingBlockNumber,
+		l2OutputOraclesStartingTimestamp,
+		config.L2OutputOracleProposer,
+		config.L2OutputOracleChallenger,
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.L2OutputOracleProxy.String()),
+		common.HexToAddress(implementations.L2OutputOracle.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// OptimismMintableERC20Factory will add a call to the batch that upgrades the OptimismMintableERC20Factory.
+func OptimismMintableERC20Factory(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	optimismMintableERC20FactoryABI, err := bindings.OptimismMintableERC20FactoryMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := optimismMintableERC20FactoryABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		common.HexToAddress(list.L1StandardBridgeProxy.String()),
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.OptimismMintableERC20FactoryProxy.String()),
+		common.HexToAddress(implementations.OptimismMintableERC20Factory.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// OptimismPortal will add a call to the batch that upgrades the OptimismPortal.
+func OptimismPortal(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	optimismPortalABI, err := bindings.OptimismPortalMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := optimismPortalABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	calldata, err := initialize.Inputs.PackValues([]any{
+		common.HexToAddress(list.L2OutputOracleProxy.String()),
+		config.PortalGuardian,
+		common.HexToAddress(chainConfig.SystemConfigAddr.String()),
+		false,
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(list.OptimismPortalProxy.String()),
+		common.HexToAddress(implementations.OptimismPortal.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// SystemConfig will add a call to the batch that upgrades the SystemConfig.
+func SystemConfig(batch *safe.Batch, implementations superchain.ImplementationList, list superchain.AddressList, config *genesis.DeployConfig, chainConfig *superchain.ChainConfig) error {
+	proxyAdminABI, err := bindings.ProxyAdminMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	systemConfigABI, err := bindings.SystemConfigMetaData.GetAbi()
+	if err != nil {
+		return err
+	}
+
+	initialize, ok := systemConfigABI.Methods["initialize"]
+	if !ok {
+		return fmt.Errorf("no initialize method")
+	}
+
+	gasPriceOracleOverhead := new(big.Int).SetUint64(config.GasPriceOracleOverhead)
+	gasPriceOracleScalar := new(big.Int).SetUint64(config.GasPriceOracleScalar)
+	batcherHash := common.BytesToHash(config.BatchSenderAddress.Bytes())
+	l2GenesisBlockGasLimit := uint64(config.L2GenesisBlockGasLimit)
+	startBlock := new(big.Int).SetUint64(config.SystemConfigStartBlock)
+
+	addresses := bindings.SystemConfigAddresses{
+		L1CrossDomainMessenger:       common.HexToAddress(list.L1CrossDomainMessengerProxy.String()),
+		L1ERC721Bridge:               common.HexToAddress(list.L1ERC721BridgeProxy.String()),
+		L1StandardBridge:             common.HexToAddress(list.L1StandardBridgeProxy.String()),
+		L2OutputOracle:               common.HexToAddress(list.L2OutputOracleProxy.String()),
+		OptimismPortal:               common.HexToAddress(list.OptimismPortalProxy.String()),
+		OptimismMintableERC20Factory: common.HexToAddress(list.OptimismMintableERC20FactoryProxy.String()),
+	}
+
+	// This is more complex
+	calldata, err := initialize.Inputs.PackValues([]any{
+		config.FinalSystemOwner,
+		gasPriceOracleOverhead,
+		gasPriceOracleScalar,
+		batcherHash,
+		l2GenesisBlockGasLimit,
+		config.P2PSequencerAddress,
+		genesis.DefaultResourceConfig,
+		startBlock,
+		config.BatchInboxAddress,
+		addresses,
+	})
+	if err != nil {
+		return err
+	}
+
+	args := []any{
+		common.HexToAddress(chainConfig.SystemConfigAddr.String()),
+		common.HexToAddress(implementations.SystemConfig.Address.String()),
+		calldata,
+	}
+
+	proxyAdmin := common.HexToAddress(list.ProxyAdmin.String())
+	sig := "upgradeAndCall(address,address,bytes)"
+	if err := batch.AddCall(proxyAdmin, common.Big0, sig, args, *proxyAdminABI); err != nil {
+		return err
+	}
+
+	return nil
+}

packages/contracts-bedrock/scripts/Deploy.s.sol

@@ -6,6 +6,10 @@ import { Script } from "forge-std/Script.sol";
 import { console2 as console } from "forge-std/console2.sol";
 import { stdJson } from "forge-std/StdJson.sol";
 
+import { Safe } from "safe-contracts/Safe.sol";
+import { SafeProxyFactory } from "safe-contracts/proxies/SafeProxyFactory.sol";
+import { Enum as SafeOps } from "safe-contracts/common/Enum.sol";
+
 import { Deployer } from "./Deployer.sol";
 import { DeployConfig } from "./DeployConfig.s.sol";
 
@@ -70,6 +74,9 @@ contract Deploy is Deployer {
         deployProxies();
         deployImplementations();
 
+        deploySafe();
+        transferProxyAdminOwnership(); // to the Safe
+
         initializeDisputeGameFactory();
         initializeSystemConfig();
         initializeL1StandardBridge();
@@ -83,7 +90,6 @@ contract Deploy is Deployer {
         setAlphabetFaultGameImplementation();
         setCannonFaultGameImplementation();
 
-        transferProxyAdminOwnership();
         transferDisputeGameFactoryOwnership();
     }
 
@@ -136,7 +142,7 @@ contract Deploy is Deployer {
         deployDisputeGameFactoryProxy();
         deployProtocolVersionsProxy();
 
-        transferAddressManagerOwnership();
+        transferAddressManagerOwnership(); // to the ProxyAdmin
     }
 
     /// @notice Deploy all of the implementations
@@ -155,6 +161,40 @@ contract Deploy is Deployer {
         deployProtocolVersions();
     }
 
+    // @notice Gets the address of the SafeProxyFactory and Safe singleton for use in deploying a new GnosisSafe.
+    function _getSafeFactory() internal returns (SafeProxyFactory safeProxyFactory_, Safe safeSingleton_) {
+        // These are they standard create2 deployed contracts. First we'll check if they are deployed,
+        // if not we'll deploy new ones, though not at these addresses.
+        address safeProxyFactory = 0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2;
+        address safeSingleton = 0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552;
+
+        safeProxyFactory.code.length == 0
+            ? safeProxyFactory_ = new SafeProxyFactory()
+            : safeProxyFactory_ = SafeProxyFactory(safeProxyFactory);
+
+        safeSingleton.code.length == 0 ? safeSingleton_ = new Safe() : safeSingleton_ = Safe(payable(safeSingleton_));
+
+        save("SafeProxyFactory", address(safeProxyFactory_));
+        save("SafeSingleton", address(safeSingleton_));
+    }
+
+    /// @notice Deploy the Safe
+    function deploySafe() public broadcast returns (address addr_) {
+        (SafeProxyFactory safeProxyFactory, Safe safeSingleton) = _getSafeFactory();
+
+        address[] memory signers = new address[](1);
+        signers[0] = msg.sender;
+
+        bytes memory initData = abi.encodeWithSelector(
+            Safe.setup.selector, signers, 1, address(0), hex"", address(0), address(0), 0, address(0)
+        );
+        address safe = address(safeProxyFactory.createProxyWithNonce(address(safeSingleton), initData, block.timestamp));
+
+        save("SystemOwnerSafe", address(safe));
+        console.log("New SystemOwnerSafe deployed at %s", address(safe));
+        addr_ = safe;
+    }
+
     /// @notice Deploy the AddressManager
     function deployAddressManager() public broadcast returns (address addr_) {
         AddressManager manager = new AddressManager();
@@ -517,16 +557,47 @@ contract Deploy is Deployer {
         require(addressManager.owner() == proxyAdmin);
     }
 
+    /// @notice Make a call from the Safe contract to an arbitrary address with arbitrary data
+    function _callViaSafe(address _target, bytes memory _data) internal {
+        Safe safe = Safe(mustGetAddress("SystemOwnerSafe"));
+
+        // This is the signature format used the caller is also the signer.
+        bytes memory signature = abi.encodePacked(uint256(uint160(msg.sender)), bytes32(0), uint8(1));
+
+        safe.execTransaction({
+            to: _target,
+            value: 0,
+            data: _data,
+            operation: SafeOps.Operation.Call,
+            safeTxGas: 0,
+            baseGas: 0,
+            gasPrice: 0,
+            gasToken: address(0),
+            refundReceiver: payable(address(0)),
+            signatures: signature
+        });
+    }
+
+    /// @notice Call from the Safe contract to the Proxy Admin's upgrade and call method
+    function _upgradeAndCallViaSafe(address _proxy, address _implementation, bytes memory _innerCallData) internal {
+        Safe safe = Safe(mustGetAddress("SystemOwnerSafe"));
+        address proxyAdmin = mustGetAddress("ProxyAdmin");
+
+        bytes memory data =
+            abi.encodeCall(ProxyAdmin.upgradeAndCall, (payable(_proxy), _implementation, _innerCallData));
+
+        _callViaSafe({ _target: proxyAdmin, _data: data });
+    }
+
     /// @notice Initialize the DisputeGameFactory
     function initializeDisputeGameFactory() public onlyDevnet broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address disputeGameFactoryProxy = mustGetAddress("DisputeGameFactoryProxy");
         address disputeGameFactory = mustGetAddress("DisputeGameFactory");
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(disputeGameFactoryProxy),
             _implementation: disputeGameFactory,
-            _data: abi.encodeCall(DisputeGameFactory.initialize, (msg.sender))
+            _innerCallData: abi.encodeCall(DisputeGameFactory.initialize, (msg.sender))
         });
 
         string memory version = DisputeGameFactory(disputeGameFactoryProxy).version();
@@ -535,17 +606,16 @@ contract Deploy is Deployer {
 
     /// @notice Initialize the SystemConfig
     function initializeSystemConfig() public broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address systemConfigProxy = mustGetAddress("SystemConfigProxy");
         address systemConfig = mustGetAddress("SystemConfig");
 
         bytes32 batcherHash = bytes32(uint256(uint160(cfg.batchSenderAddress())));
         uint256 startBlock = cfg.systemConfigStartBlock();
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(systemConfigProxy),
             _implementation: systemConfig,
-            _data: abi.encodeCall(
+            _innerCallData: abi.encodeCall(
                 SystemConfig.initialize,
                 (
                     cfg.finalSystemOwner(),
@@ -611,14 +681,19 @@ contract Deploy is Deployer {
 
         uint256 proxyType = uint256(proxyAdmin.proxyType(l1StandardBridgeProxy));
         if (proxyType != uint256(ProxyAdmin.ProxyType.CHUGSPLASH)) {
-            proxyAdmin.setProxyType(l1StandardBridgeProxy, ProxyAdmin.ProxyType.CHUGSPLASH);
+            _callViaSafe({
+                _target: address(proxyAdmin),
+                _data: abi.encodeCall(ProxyAdmin.setProxyType, (l1StandardBridgeProxy, ProxyAdmin.ProxyType.CHUGSPLASH))
+            });
         }
         require(uint256(proxyAdmin.proxyType(l1StandardBridgeProxy)) == uint256(ProxyAdmin.ProxyType.CHUGSPLASH));
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(l1StandardBridgeProxy),
             _implementation: l1StandardBridge,
-            _data: abi.encodeCall(L1StandardBridge.initialize, (L1CrossDomainMessenger(l1CrossDomainMessengerProxy)))
+            _innerCallData: abi.encodeCall(
+                L1StandardBridge.initialize, (L1CrossDomainMessenger(l1CrossDomainMessengerProxy))
+                )
         });
 
         string memory version = L1StandardBridge(payable(l1StandardBridgeProxy)).version();
@@ -638,15 +713,14 @@ contract Deploy is Deployer {
 
     /// @notice Initialize the L1ERC721Bridge
     function initializeL1ERC721Bridge() public broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address l1ERC721BridgeProxy = mustGetAddress("L1ERC721BridgeProxy");
         address l1ERC721Bridge = mustGetAddress("L1ERC721Bridge");
         address l1CrossDomainMessengerProxy = mustGetAddress("L1CrossDomainMessengerProxy");
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(l1ERC721BridgeProxy),
             _implementation: l1ERC721Bridge,
-            _data: abi.encodeCall(L1ERC721Bridge.initialize, (L1CrossDomainMessenger(l1CrossDomainMessengerProxy)))
+            _innerCallData: abi.encodeCall(L1ERC721Bridge.initialize, (L1CrossDomainMessenger(l1CrossDomainMessengerProxy)))
         });
 
         L1ERC721Bridge bridge = L1ERC721Bridge(l1ERC721BridgeProxy);
@@ -659,15 +733,14 @@ contract Deploy is Deployer {
 
     /// @notice Ininitialize the OptimismMintableERC20Factory
     function initializeOptimismMintableERC20Factory() public broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address optimismMintableERC20FactoryProxy = mustGetAddress("OptimismMintableERC20FactoryProxy");
         address optimismMintableERC20Factory = mustGetAddress("OptimismMintableERC20Factory");
         address l1StandardBridgeProxy = mustGetAddress("L1StandardBridgeProxy");
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(optimismMintableERC20FactoryProxy),
             _implementation: optimismMintableERC20Factory,
-            _data: abi.encodeCall(OptimismMintableERC20Factory.initialize, (l1StandardBridgeProxy))
+            _innerCallData: abi.encodeCall(OptimismMintableERC20Factory.initialize, (l1StandardBridgeProxy))
         });
 
         OptimismMintableERC20Factory factory = OptimismMintableERC20Factory(optimismMintableERC20FactoryProxy);
@@ -687,24 +760,32 @@ contract Deploy is Deployer {
 
         uint256 proxyType = uint256(proxyAdmin.proxyType(l1CrossDomainMessengerProxy));
         if (proxyType != uint256(ProxyAdmin.ProxyType.RESOLVED)) {
-            proxyAdmin.setProxyType(l1CrossDomainMessengerProxy, ProxyAdmin.ProxyType.RESOLVED);
+            _callViaSafe({
+                _target: address(proxyAdmin),
+                _data: abi.encodeCall(ProxyAdmin.setProxyType, (l1CrossDomainMessengerProxy, ProxyAdmin.ProxyType.RESOLVED))
+            });
         }
         require(uint256(proxyAdmin.proxyType(l1CrossDomainMessengerProxy)) == uint256(ProxyAdmin.ProxyType.RESOLVED));
 
         string memory contractName = "OVM_L1CrossDomainMessenger";
         string memory implName = proxyAdmin.implementationName(l1CrossDomainMessenger);
         if (keccak256(bytes(contractName)) != keccak256(bytes(implName))) {
-            proxyAdmin.setImplementationName(l1CrossDomainMessengerProxy, contractName);
+            _callViaSafe({
+                _target: address(proxyAdmin),
+                _data: abi.encodeCall(ProxyAdmin.setImplementationName, (l1CrossDomainMessengerProxy, contractName))
+            });
         }
         require(
             keccak256(bytes(proxyAdmin.implementationName(l1CrossDomainMessengerProxy)))
                 == keccak256(bytes(contractName))
         );
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(l1CrossDomainMessengerProxy),
             _implementation: l1CrossDomainMessenger,
-            _data: abi.encodeCall(L1CrossDomainMessenger.initialize, (OptimismPortal(payable(optimismPortalProxy))))
+            _innerCallData: abi.encodeCall(
+                L1CrossDomainMessenger.initialize, (OptimismPortal(payable(optimismPortalProxy)))
+                )
         });
 
         L1CrossDomainMessenger messenger = L1CrossDomainMessenger(l1CrossDomainMessengerProxy);
@@ -719,14 +800,13 @@ contract Deploy is Deployer {
 
     /// @notice Initialize the L2OutputOracle
     function initializeL2OutputOracle() public broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address l2OutputOracleProxy = mustGetAddress("L2OutputOracleProxy");
         address l2OutputOracle = mustGetAddress("L2OutputOracle");
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(l2OutputOracleProxy),
             _implementation: l2OutputOracle,
-            _data: abi.encodeCall(
+            _innerCallData: abi.encodeCall(
                 L2OutputOracle.initialize,
                 (
                     cfg.l2OutputOracleStartingBlockNumber(),
@@ -757,7 +837,6 @@ contract Deploy is Deployer {
 
     /// @notice Initialize the OptimismPortal
     function initializeOptimismPortal() public broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address optimismPortalProxy = mustGetAddress("OptimismPortalProxy");
         address optimismPortal = mustGetAddress("OptimismPortal");
         address l2OutputOracleProxy = mustGetAddress("L2OutputOracleProxy");
@@ -768,10 +847,10 @@ contract Deploy is Deployer {
             console.log("Portal guardian has no code: %s", guardian);
         }
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(optimismPortalProxy),
             _implementation: optimismPortal,
-            _data: abi.encodeCall(
+            _innerCallData: abi.encodeCall(
                 OptimismPortal.initialize,
                 (L2OutputOracle(l2OutputOracleProxy), guardian, SystemConfig(systemConfigProxy), false)
                 )
@@ -788,7 +867,6 @@ contract Deploy is Deployer {
     }
 
     function initializeProtocolVersions() public onlyTestnetOrDevnet broadcast {
-        ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address protocolVersionsProxy = mustGetAddress("ProtocolVersionsProxy");
         address protocolVersions = mustGetAddress("ProtocolVersions");
 
@@ -796,10 +874,10 @@ contract Deploy is Deployer {
         uint256 requiredProtocolVersion = cfg.requiredProtocolVersion();
         uint256 recommendedProtocolVersion = cfg.recommendedProtocolVersion();
 
-        proxyAdmin.upgradeAndCall({
+        _upgradeAndCallViaSafe({
             _proxy: payable(protocolVersionsProxy),
             _implementation: protocolVersions,
-            _data: abi.encodeCall(
+            _innerCallData: abi.encodeCall(
                 ProtocolVersions.initialize,
                 (
                     finalSystemOwner,
@@ -822,10 +900,10 @@ contract Deploy is Deployer {
     function transferProxyAdminOwnership() public broadcast {
         ProxyAdmin proxyAdmin = ProxyAdmin(mustGetAddress("ProxyAdmin"));
         address owner = proxyAdmin.owner();
-        address finalSystemOwner = cfg.finalSystemOwner();
-        if (owner != finalSystemOwner) {
-            proxyAdmin.transferOwnership(finalSystemOwner);
-            console.log("ProxyAdmin ownership transferred to: %s", finalSystemOwner);
+        address safe = mustGetAddress("SystemOwnerSafe");
+        if (owner != safe) {
+            proxyAdmin.transferOwnership(safe);
+            console.log("ProxyAdmin ownership transferred to Safe at: %s", safe);
         }
     }
 
@@ -833,10 +911,11 @@ contract Deploy is Deployer {
     function transferDisputeGameFactoryOwnership() public onlyDevnet broadcast {
         DisputeGameFactory disputeGameFactory = DisputeGameFactory(mustGetAddress("DisputeGameFactoryProxy"));
         address owner = disputeGameFactory.owner();
-        address finalSystemOwner = cfg.finalSystemOwner();
-        if (owner != finalSystemOwner) {
-            disputeGameFactory.transferOwnership(finalSystemOwner);
-            console.log("DisputeGameFactory ownership transferred to: %s", finalSystemOwner);
+
+        address safe = mustGetAddress("SystemOwnerSafe");
+        if (owner != safe) {
+            disputeGameFactory.transferOwnership(safe);
+            console.log("DisputeGameFactory ownership transferred to Safe at: %s", safe);
         }
     }
 

packages/contracts-bedrock/scripts/Deployer.sol

@@ -115,6 +115,10 @@ abstract contract Deployer is Script {
             string memory deploymentName = deployments[i].name;
 
             string memory deployTx = _getDeployTransactionByContractAddress(addr);
+            if (bytes(deployTx).length == 0) {
+                console.log("Deploy Tx not found for %s skipping deployment artifact generation", deploymentName);
+                continue;
+            }
             string memory contractName = _getContractNameFromDeployTransaction(deployTx);
             console.log("Syncing deployment %s: contract %s", deploymentName, contractName);