Merge pull request #5190 from ethereum-optimism/feat/portal-guardian-config

feat: portal guardian config

op-chain-ops/genesis/config.go

@@ -76,6 +76,8 @@ type DeployConfig struct {
 	ProxyAdminOwner common.Address `json:"proxyAdminOwner"`
 	// Owner of the system on L1
 	FinalSystemOwner common.Address `json:"finalSystemOwner"`
+	// GUARDIAN account in the OptimismPortal
+	PortalGuardian common.Address `json:"portalGuardian"`
 	// L1 recipient of fees accumulated in the BaseFeeVault
 	BaseFeeVaultRecipient common.Address `json:"baseFeeVaultRecipient"`
 	// L1 recipient of fees accumulated in the L1FeeVault
@@ -128,6 +130,9 @@ func (d *DeployConfig) Check() error {
 	if d.FinalizationPeriodSeconds == 0 {
 		return fmt.Errorf("%w: FinalizationPeriodSeconds cannot be 0", ErrInvalidDeployConfig)
 	}
+	if d.PortalGuardian == (common.Address{}) {
+		return fmt.Errorf("%w: PortalGuardian cannot be address(0)", ErrInvalidDeployConfig)
+	}
 	if d.MaxSequencerDrift == 0 {
 		return fmt.Errorf("%w: MaxSequencerDrift cannot be 0", ErrInvalidDeployConfig)
 	}

op-chain-ops/genesis/layer_one.go

@@ -295,7 +295,7 @@ func deployL1Contracts(config *DeployConfig, backend *backends.SimulatedBackend)
 			Name: "OptimismPortal",
 			Args: []interface{}{
 				predeploys.DevL2OutputOracleAddr,
-				config.FinalSystemOwner,
+				config.PortalGuardian,
 				true, // _paused
 			},
 		},

op-chain-ops/genesis/testdata/test-deploy-config-full.json

@@ -19,6 +19,7 @@
   "l1GenesisBlockGasLimit": "0xe4e1c0",
   "l1GenesisBlockDifficulty": "0x1",
   "finalSystemOwner": "0x0000000000000000000000000000000000000111",
+  "portalGuardian": "0x0000000000000000000000000000000000000112",
   "finalizationPeriodSeconds": 2,
   "l1GenesisBlockMixHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
   "l1GenesisBlockCoinbase": "0x0000000000000000000000000000000000000000",

packages/contracts-bedrock/contracts/L1/OptimismPortal.sol

@@ -49,7 +49,7 @@ contract OptimismPortal is Initializable, ResourceMetering, Semver {
     L2OutputOracle public immutable L2_ORACLE;
 
     /**
-     * @notice Address that has the ability to pause and unpause deposits and withdrawals.
+     * @notice Address that has the ability to pause and unpause withdrawals.
      */
     address public immutable GUARDIAN;
 

packages/contracts-bedrock/deploy-config/devnetL1.json

@@ -20,6 +20,7 @@
   "sequencerFeeVaultRecipient": "0xfabb0ac9d68b0b445fb7357272ff202c5651694a",
   "proxyAdminOwner": "0xBcd4042DE499D14e55001CcbB24a551F3b954096",
   "finalSystemOwner": "0xBcd4042DE499D14e55001CcbB24a551F3b954096",
+  "portalGuardian": "0xBcd4042DE499D14e55001CcbB24a551F3b954096",
   "controller": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
   "finalizationPeriodSeconds": 2,
   "deploymentWaitConfirmations": 1,

packages/contracts-bedrock/deploy-config/final-migration-rehearsal.json

 {
   "finalSystemOwner": "0x62790eFcB3a5f3A5D398F95B47930A9Addd83807",
+  "portalGuardian": "0x62790eFcB3a5f3A5D398F95B47930A9Addd83807",
   "controller": "0x2d30335B0b807bBa1682C487BaAFD2Ad6da5D675",
 
   "l1StartingBlockTag": "0x4104895a540d87127ff11eef0d51d8f63ce00a6fc211db751a45a4b3a61a9c83",

packages/contracts-bedrock/deploy-config/getting-started.json

@@ -2,6 +2,7 @@
   "numDeployConfirmations": 1,
 
   "finalSystemOwner": "ADMIN",
+  "portalGuardian": "ADMIN",
   "controller": "ADMIN",
 
   "l1StartingBlockTag": "BLOCKHASH",

packages/contracts-bedrock/deploy-config/goerli-forked.json

 {
   "finalSystemOwner": "0x62790eFcB3a5f3A5D398F95B47930A9Addd83807",
+  "portalGuardian": "0x62790eFcB3a5f3A5D398F95B47930A9Addd83807",
   "controller": "0x2d30335B0b807bBa1682C487BaAFD2Ad6da5D675",
 
   "l1StartingBlockTag": "0x4104895a540d87127ff11eef0d51d8f63ce00a6fc211db751a45a4b3a61a9c83",

packages/contracts-bedrock/deploy-config/goerli.json

@@ -2,6 +2,7 @@
   "numDeployConfirmations": 1,
 
   "finalSystemOwner": "0xBc1233d0C3e6B5d53Ab455cF65A6623F6dCd7e4f",
+  "portalGuardian": "0xBc1233d0C3e6B5d53Ab455cF65A6623F6dCd7e4f",
   "controller": "0xBc1233d0C3e6B5d53Ab455cF65A6623F6dCd7e4f",
 
   "l1StartingBlockTag": "0x6ffc1bf3754c01f6bb9fe057c1578b87a8571ce2e9be5ca14bace6eccfd336c7",

packages/contracts-bedrock/deploy-config/hardhat.json

 {
   "finalSystemOwner": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+  "portalGuardian": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
   "controller": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
 
   "l1StartingBlockTag": "earliest",

packages/contracts-bedrock/deploy-config/internal-devnet.json

 {
   "finalSystemOwner": "0x858F0751ef8B4067f0d2668C076BDB50a8549fbF",
+  "portalGuardian": "0x858F0751ef8B4067f0d2668C076BDB50a8549fbF",
   "controller": "0x2d30335B0b807bBa1682C487BaAFD2Ad6da5D675",
 
   "l1StartingBlockTag": "0x19c7e6b18fe156e45f4cfef707294fd8f079fa9c30a7b7cd6ec1ce3682ec6a2e",

packages/contracts-bedrock/deploy/013-OptimismPortalImpl.ts

@@ -17,13 +17,11 @@ const deployFn: DeployFunction = async (hre) => {
     'L2OutputOracleProxy'
   )
 
-  const finalSystemOwner = hre.deployConfig.finalSystemOwner
-  const finalSystemOwnerCode = await hre.ethers.provider.getCode(
-    finalSystemOwner
-  )
-  if (finalSystemOwnerCode === '0x') {
+  const portalGuardian = hre.deployConfig.portalGuardian
+  const portalGuardianCode = await hre.ethers.provider.getCode(portalGuardian)
+  if (portalGuardianCode === '0x') {
     console.log(
-      `WARNING: setting OptimismPortal.GUARDIAN to ${finalSystemOwner} and it has no code`
+      `WARNING: setting OptimismPortal.GUARDIAN to ${portalGuardian} and it has no code`
     )
     if (!isLiveDeployer) {
       throw new Error(
@@ -35,13 +33,13 @@ const deployFn: DeployFunction = async (hre) => {
   // Deploy the OptimismPortal implementation as paused to
   // ensure that users do not interact with it and instead
   // interact with the proxied contract.
-  // The `finalSystemOwner` is set at the GUARDIAN.
+  // The `portalGuardian` is set at the GUARDIAN.
   await deploy({
     hre,
     name: 'OptimismPortal',
     args: [
       L2OutputOracleProxy.address,
-      finalSystemOwner,
+      portalGuardian,
       true, // paused
     ],
     postDeployAction: async (contract) => {
@@ -53,7 +51,7 @@ const deployFn: DeployFunction = async (hre) => {
       await assertContractVariable(
         contract,
         'GUARDIAN',
-        hre.deployConfig.finalSystemOwner
+        hre.deployConfig.portalGuardian
       )
     },
   })

packages/contracts-bedrock/src/deploy-config.ts

@@ -14,6 +14,12 @@ interface RequiredDeployConfig {
    */
   finalSystemOwner?: string
 
+  /**
+   * Address that is deployed as the GUARDIAN in the OptimismPortal. Has the
+   * ability to pause withdrawals.
+   */
+  portalGuardian: string
+
   /**
    * Address that will own the entire system on L1 during the deployment process. This address will
    * not own the system after the deployment is complete, ownership will be transferred to the
@@ -181,6 +187,9 @@ export const deployConfigSpec: {
   finalSystemOwner: {
     type: 'address',
   },
+  portalGuardian: {
+    type: 'address',
+  },
   controller: {
     type: 'address',
   },