Merge branch 'develop' into jg/l1_info_mismatch_logging

.changeset/nervous-years-explain.md

+---
+'@eth-optimism/fault-detector': minor
+---
+
+Updates the fault detector to support Bedrock networks.

CONTRIBUTING.md

@@ -2,6 +2,8 @@
 
 🎈 Thanks for your help improving the project! We are so happy to have you!
 
+**No contribution is too small and all contributions are valued.**
+
 There are plenty of ways to contribute, in particular we appreciate support in the following areas:
 
 - Reporting issues. For security issues see [Security policy](https://github.com/ethereum-optimism/.github/blob/master/SECURITY.md).

bedrock-devnet/README.md

@@ -2,4 +2,4 @@
 
 This is a utility for running a local Bedrock devnet. It is designed to replace the legacy Bash-based devnet runner as part of a progressive migration away from Bash automation.
 
-The easiest way to invoke this script is to run `make devnet-up-deploy` from the root of this repository. Otherwise, to use this script run `python3 main.py --monorepo-path=<path to the monorepo>`. You may need to set `PYTHONPATH` to this directory if you are invoking the script from somewhere other than `bedrock-devnet`.
\ No newline at end of file
+The easiest way to invoke this script is to run `make devnet-up-deploy` from the root of this repository. Otherwise, to use this script run `python3 main.py --monorepo-dir=<path to the monorepo>`. You may need to set `PYTHONPATH` to this directory if you are invoking the script from somewhere other than `bedrock-devnet`.

go.work.sum

@@ -164,6 +164,7 @@ github.com/ethereum-optimism/op-geth v0.0.0-20221104125741-d6c1bb9a110d h1:rDRvY
 github.com/ethereum-optimism/op-geth v0.0.0-20221104125741-d6c1bb9a110d/go.mod h1:/6CsT5Ceen2WPLI/oCA3xMcZ5sWMF/D46SjM/ayY0Oo=
 github.com/ethereum-optimism/op-geth v0.0.0-20221215174217-c69b1f12761e h1:kdpBVWv7Rs/LbM8o8QyJlEBNiA2sw1GEhGyn4pkpesw=
 github.com/ethereum-optimism/op-geth v0.0.0-20221215174217-c69b1f12761e/go.mod h1:p0Yox74PhYlq1HvijrCBCD9A3cI7rXco7hT6KrQr+rY=
+github.com/ethereum-optimism/optimism/op-signer v0.1.1/go.mod h1:HK+9do1IJmDr9aEc44ECweYbCLDfGGYO7PBwTqDNrqI=
 github.com/evanphx/json-patch v4.9.0+incompatible h1:kLcOMZeuLAJvL2BPWLMIj5oaZQobrkAqrL+WFZwQses=
 github.com/fasthttp-contrib/websocket v0.0.0-20160511215533-1f3b11f56072 h1:DddqAaWDpywytcG8w/qoQ5sAN8X12d3Z3koB0C3Rxsc=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=

op-chain-ops/genesis/migration/types.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/ethereum-optimism/optimism/op-bindings/predeploys"
+
 	"github.com/ethereum-optimism/optimism/op-chain-ops/crossdomain"
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/common/hexutil"
@@ -120,6 +122,9 @@ type MigrationData struct {
 func (m *MigrationData) ToWithdrawals() ([]*crossdomain.LegacyWithdrawal, error) {
 	messages := make([]*crossdomain.LegacyWithdrawal, 0)
 	for _, msg := range m.OvmMessages {
+		if msg.Who != predeploys.L2CrossDomainMessengerAddr {
+			continue
+		}
 		wd, err := msg.ToLegacyWithdrawal()
 		if err != nil {
 			return nil, err
@@ -130,6 +135,9 @@ func (m *MigrationData) ToWithdrawals() ([]*crossdomain.LegacyWithdrawal, error)
 		}
 	}
 	for _, msg := range m.EvmMessages {
+		if msg.Who != predeploys.L2CrossDomainMessengerAddr {
+			continue
+		}
 		wd, err := msg.ToLegacyWithdrawal()
 		if err != nil {
 			return nil, err

op-node/eth/account_proof.go

@@ -3,7 +3,6 @@ package eth
 import (
 	"bytes"
 	"fmt"
-	"math/big"
 
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/common/hexutil"
@@ -52,12 +51,16 @@ func (res *AccountResult) Verify(stateRoot common.Hash) error {
 		if err != nil {
 			return fmt.Errorf("failed to verify storage value %d with key %s (path %x) in storage trie %s: %w", i, entry.Key, path, res.StorageHash, err)
 		}
-		if !bytes.Equal(val, val) {
+		comparison, err := rlp.EncodeToBytes(entry.Value.ToInt().Bytes())
+		if err != nil {
+			return fmt.Errorf("failed to encode storage value %d with key %s (path %x) in storage trie %s: %w", i, entry.Key, path, res.StorageHash, err)
+		}
+		if !bytes.Equal(val, comparison) {
 			return fmt.Errorf("value %d in storage proof does not match proven value at key %s (path %x)", i, entry.Key, path)
 		}
 	}
 
-	accountClaimed := []any{uint64(res.Nonce), (*big.Int)(res.Balance).Bytes(), res.StorageHash, res.CodeHash}
+	accountClaimed := []any{uint64(res.Nonce), res.Balance.ToInt().Bytes(), res.StorageHash, res.CodeHash}
 	accountClaimedValue, err := rlp.EncodeToBytes(accountClaimed)
 	if err != nil {
 		return fmt.Errorf("failed to encode account from retrieved values: %w", err)

op-node/eth/account_proof_test.go

@@ -2,42 +2,86 @@ package eth
 
 import (
 	"encoding/json"
+	"math/big"
 	"testing"
 
+	"github.com/ethereum/go-ethereum/common/hexutil"
+
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/stretchr/testify/require"
 )
 
-func TestAccountResult_Verify(t *testing.T) {
-	// Example account result: a SystemConfig storage read, to proof the value of slot 103 (0x67) equals some address,
-	// which would be RLP-encoded when retrieved as value from a trie node.
-	resultData := `
+// Example account result taken from the Goerli SystemConfig proxy:
+// cast proof 0xAe851f927Ee40dE99aaBb7461C00f9622ab91d60 0x65a7ed542fb37fe237fdfbdd70b31598523fe5b32879e307bae27a0bd9581c08 --block 8481106
+// The provided slot is the unsafe block signer.
+const resultData = `
 {
-    "accountProof": [
-      "0xf90211a03d0bbcace6414d254eb5ee34923da6dadda532025554251fccb0f3e401f97f64a00b0060669e7d8bee64b69cd327edd83aec3839bcdc2c51df61a87d26c06a6e6da0c0325f24cc335b26d107c0704a0c88d96aac42cb807f732d45196ba2b3ec6f4fa0be4d5280fb18316c250432acd5272e0558a850e2b17803e2262a0f12ec7293cda0584c838d31e2b8b7b1b61ea86ec96c14de6f8e48b5085ab88f26022e46c434f3a033ce2881dfbf590f36e88d999b52b5f88fa3e2845aa069f354fffc4657269db0a0bc0d89addbe9e9dd1b4570e6403b9540c631d4b018d6a30dee0d6b1416d79f7da0b208a7628b6e33e21638856ae0cf77f0245aab58300a3ea459b049fcbcf7c95aa01d16509886c5fef9deee332e82ca26739b35acfc192c4fd5f31310caf9996304a062a1114d555e0657a953a9e79156ecf6323629961afe756c846a1222c415999aa0e3ae9195242e45330d273187de63ccd74c2ab787dc50e0ff3edbc8ef47cd3b2da0c1b261a54efdfa3596cec84a23784ed051bc346b80dbf0694dc7d39356c212eea04512835bd07815d2bcc00f25ea70dee0f0a770b16d16250f7d5c884b0d440581a0ee25f14adcbd0dc55d15a2148deae12c3ab9c6a001c6e899e22d3e0890999083a01c0c47189ac3d6931aa05fbe3cd4140a1794f68b724b1804f46d2705435f08caa0d9a14e2b4e6778a2405bc7931934b5e97b8e3a2033eedb30409896420a2db44b80",
-      "0xf90211a0e65e35c2066e63b933bd300ad97883dbcf4e2d2df8a540aa3964f5354e2bb8dba0814e82409c1813007af146f3b47f0e0d6da4c2885de8f34f034826bcb4c4c9e7a07d726afe2a20f4928e8715d80bc5aff5fc30c05b1e953372d564cba93d3b45bda02fc8df4a480ea0402f48aa206047ef0acbedf1a7033153c60d5ec4dfb9ee30cca05ecda76647515fb8342434b5a36faec2f17fc729ea369edcf7a42cd235c51fa2a0ab51933d2bde083801bd7fedb17ec22ae5231e508c62d66e9dccbd598c1d98fda0e2af2dc4a1b87147a5e388388ee5d1aafb415498e1011e87df127cc8d57616eca00bb9b95cfda6476e321ca441f523f80cb13519e537679ad6139600b35c91b5b1a0e3aae75bdc65365e2f8bb9c8646a4118d302076e0d9de95fc4425e82680ed912a0124bb32fc404a8647d7192f438a2bca8c52877b02a921b014fe4a192982bcf9ea0da2df7e5f41d6e38cc48fd9d0ca91bc96ff6ffa336b75784b3e23cd8dfddc0b1a0f7fc4a6792cdf964423f705935f0338128d099c83a74c2b76c688ecda8f23ffea009b2347ed0222d713137ad280310fad2ca92f007b5fd3ed1b768a6b52b5040d6a07b5bfe1bbd07575f26d97b9a0e8c67cd11d251f3d8bc823ade462daee2309e4ba02d2e464a4ad06d6dca6cb54e31fb5aac85dc9c5bab420a2c7c1ca986991f4d1da0cd5f723720652dec2a8bbba3bad3f73fb16b83a31d28a707fd0e0f85370eae6380",
-      "0xf90151a04df2503da3b2491b68d13d2735005e451ca9cae77d336061df9250e0d3592e0ca01580374cce4fa8401d9fdeebb037e96c3f9c03873aec0637b43ba809fa8e53a9a0101d14d18ee6c9bf21f8292b155e40462605d15d315337e0f1098479d9ba6d1b80a0d0baf298792955a012fc458a97de8b3b2319911c3a82e427b5424fb544ac1ea080a09b2cc83f7e69b3c46bde63e4805d1aa9a064c0220532de547693122bba9b24458080a0a44850b8b25ced24d074182424ab7aa668b78acaa64e2da1854d04093332153b80a00b513b7944399ac7e2291ab7cdc1b99f0445256cc3f0c3b6b5c2d50eab4f9887a06b979f3c7a2a1d95af02c44d015ac42202cd0df8c19b629f6089a6a2a181d69aa0eb0216e118a1b797b90165cea439923e58bc672b81573ae44156cf38632fa36880a0e16e6a4603316f2fa41cd7d0a8fc9a8dca7ca36763abe39b99ef57b83adf501180",
-      "0xf8689f3b8dff764734b5790096e811fc30835b13a5bea290831c7c6722f325a5f818b846f8448080a0dd6d0b4dba95e79439c501e2109ded26989a53ca4641e1f48bf702e7361637e9a01f958654ab06a152993e7a0ae7b6dbb0d4b19265cc9337b8789fe1353bd9dc35"
-    ],
-    "address": "0x6900000000000000000000000000000000000009",
-    "balance": "0x0",
-    "codeHash": "0x1f958654ab06a152993e7a0ae7b6dbb0d4b19265cc9337b8789fe1353bd9dc35",
-    "nonce": "0x0",
-    "storageHash": "0xdd6d0b4dba95e79439c501e2109ded26989a53ca4641e1f48bf702e7361637e9",
-    "storageProof": [
-      {
-        "key": "0x0000000000000000000000000000000000000000000000000000000000000067",
-        "value": "0x9965507d1a55bcc2695c58ba16fb37d819b0a4dc",
-        "proof": [
-          "0xf8f18080a04fc5f13ab2f9ba0c2da88b0151ab0e7cf4d85d08cca45ccd923c6ab76323eb2880a0f57febb7b16455e051f412a56e54016c676a3d4aa515d2e77a90520dfe36162ea0558f72e6d0e3b401856defa90b07dd0442282592b3ca718e2dc919ea53b8e69280a04f893abcf66ae78abb4ac986ddf78bdf95a7b15079be06cc5756f78d772271eba0c1529c7d0f249fd7060e930515ac4980103920979274f56b07419bf33be4d3d7a0a055722fdc9281d825dfc17c2ae775aba5b283954f5c484fc7e0e5a148131e2ea02833bc13e1f58010a678009d7d5982b892b3ba1432ca6b06f8a849b71491b51e808080808080",
-          "0xf7a03787eeb91fe3101235e4a76063c7023ecb40f923f97916639c598592fa30d6ae95949965507d1a55bcc2695c58ba16fb37d819b0a4dc"
-        ]
-      }
-    ]
-  }
+  "address": "0xae851f927ee40de99aabb7461c00f9622ab91d60",
+  "balance": "0x0",
+  "codeHash": "0x1f958654ab06a152993e7a0ae7b6dbb0d4b19265cc9337b8789fe1353bd9dc35",
+  "nonce": "0x1",
+  "storageHash": "0x88219055c2fef8800e02f071d053a86a4194e70a81b6e45f1fecca7dae0432da",
+  "accountProof": [
+    "0xf90211a063a66cd84a54f8ee248662f1d4637936c430a0f455eeec8c01ee56db898dddfba0be9003fb3e36a55cfea1eda010c0a459f10729db9809e0bd1e3599f46c5ffed1a0a08d018d3cf38b0d0cbff14288699705dfa7cf27dc20fbbaae9351837eff4751a0eed877086740a930f035b75ebb26ce63df0f61baea52bf05f4c7421014debf33a053ea34e49423e790b10d9a36f498f337b3f079ed611d98a3f8550c34212dcbd7a0c370d5b874f70b9fd1c8a2fe98b0ef60c480fbe00566a7d5a5e682d9859398f2a0da820e94aac0b444a8dcfebc7dc9ec942f04f252da25b10faf50b57f969aa1f5a0413e8039c67d8acbe20993ab364c2c477d1ce85e8ae723c33acd506175ce4bffa0f70e5d5d934c53b2302ec3f98bd3f33f39a15fabb8c32e5e7acc97121d7a9cf3a0b41e7073ae943e498681b5d86941401c29b38c93fa347ace6bb15ba74ccbf45ea0a3b0aa548cac9cbbfcfabd980c1ceae8bdc39ad2682fc6e6d9cf0f4bdb273884a04d7932870a3d25163ea28ae5ebe702b841d755541d2af98c5c1c08090327fab1a06e41c3fb6362dd860a098aacf13a81c9d26e9b822c1066ca76cb98607f3e257aa0079ffe59ddb21ccd03bcbf1cc42fc0fb89dcae93ffeed9b82a848828199ab057a0dce67e92c8991df57ecac2237244d12e92f6514db1c5f076718fe40266bbf741a08dd7d3b3b041889f837217761b4e87510428ea41b3aff4e5725fd8efc2d735b980",
+    "0xf90211a0809683f3310d75dff5eb95296aa9ff5d74fbde9f873b9a6b245513887f9c6e91a055450f5338cc2f8f4306912e938df3fe490929614604eeea4c03581b98c8ae8ea04e50b57da8fc16a5d5460892196631737eeb1cc1e995e5c1de9c381ed1fb84d4a07d65e61a50579d689422446c23df10c4c0b5ec41239a910ca86634e2fee75320a091c77e1f72302bdb3985b249dba07d1abaa345296080c369bd84c518669297e1a019a185bedc83ab48c51dffe4c58ab88e30c88976a3b059ab524ef7ab42886d61a0a6c249e070db991141ee1289a5ed212f81673f8cd3f7bf35c27c335cc77d3eeca0c7d7a7f5036c8c3185cd0ca231775047192419b8f7e7b5a462c8e713ab2f4fcda006084fdd6777d076850defc5c6f1336535bbc2ec95a0e3f91fc5ac9761aee770a0c85a82f527990667217fac36ebfb9f4af29a6ff7b0b3d41cdcb256a26ca5f621a06a382d1f5a9bb0b712c89e82b0aaf26cf7c5984255377fd7428457d390330d40a0194f1f730e71559662ea2d9bdc681761eaf54decc7041766b5d7b7e8086d2480a05afe23c9ec57c22d9639f9228aa389e7a70a4e1e3e675856792f4a92fe284478a05bcacd2d3d2ac267d5b0367b56f05e4c808e2a5ecd04a10f1399e313fd41b273a09e62b6f5b7b77a1657ded9f0bef2af7fee11f2bf0518a5cceb5ceae2845c16f0a06d0ee25c5a3acd2b8d3253b856a77187b76f90d60b2356fc77f6e79766410cc580",
+    "0xf90211a0a6b81aae9b8aff6ac275885f6dfa4bc11949e3e8cbfad05714c3233303fa83f5a0e29595c647574b219c3068a768d47347b0e8a272da881aeb4525af051faab847a0441c1549c250c0c1bc0fa1b73e9f9ac9998b5dcef65a57ecd3f748ce02be4251a0353bd042ac0cf9a90a9cc02cc131f5d58f531df8df7ab752f6caa9b6807a506ea07340f489ba55fc8cfde61384c4990f74034f0bc0c7e1d68733284cb5c30d5bbea00ff5d4191ef973be9ae73b3fd9d01f52b54aafa20f147b6a5ca6b9e56a1f9ec4a0e167cd5a249a0dc2afbb9b2aafbd3b6e0160739a99e482d22d722c78fa296772a004202f2695770715d36e9aad418cc005fd8b22b927f1e1383b4e95ca18f41f61a0be38b6340286e0cd2454d90d8ed2f7e26bce5b7774f8adfa8f54a75bc4635d18a0cacc635e487a0d7dd19373bcd0a32e4cea0655f93d61f2940a6063059a044bf7a0bcd8f9ab88356e86cea7cd27454525ade016bccf26f414ad9fa93e0280d40df4a0d5651902739f9dfaff0f1178ea7cba617087234dd0e2895424961fad98605a27a0f76890befb5b3b20695d64b6a7c416709c93032012b46245c5bc00dd104b84f3a00ff372b11e0fb8febd467e060f7ce126e705a07a203a3f6dd93c7e3f36f4608ea0b4ea8133548c9b9d8f62b86aa703f65e3323a92a4b4711f80a734b80814b0825a04db29c4cb760e4831bfe40cdb0f554d74e98da26715c7e6319317c8c9a9c247580",
+    "0xf90211a026ffcc82ed6e3cd13ea30ed185afae29eed7f7fbde7f46010061791b5441b7dfa086b3018a2c001ffd6cc76e58372c49f5a2ba42335789fdcea878d93ceeeeb969a0589ba5e683afa655b17eb6b6c687a657669f772b1a2f78813ea662e8c316c12ea01c604e2e2f9ace5ef281f09c4b6c24c4c4631810f30b5209a433515a628cb5aca0520abee45bbc79e9f9519ffd4ad199b40383cb9718a3e8392d7193f68b1bc251a0b788e74186f121dd5ad31ef6b69d69147ab1841aa5380928fbe11a65ad67af36a0ef80a7fd5edf9901e2d8fa0cd8d9608e9fde114da1bd0f545e107c6771d5b0e7a05e8d9b24b83dbb8ec946cd42ff04bd0588f15866cd95095a8495242616b9ae71a0d623ee5bd0f3b8513ad7c247d1736841878f7210445209cecf36f0bfa5b8a6b9a03d0b62b3dc96b9c72190ff3484699d4892dea93cd16d9811cd58bd614348db11a0b140f98169be15dc1266be9343a1225fe6339f86e309854b03af9d304e75bd76a04ca100367dd9f12a6e80f48a1fabc19d9d36f07960d1911c3a09199a43eb26d2a05e9c627adafc5393a9b5ddc910f6474c56a10366f9d44248d9c0ce2e0c6b9a94a097e533731c36c43d7cf20379f2349ac1cd7a1165fb3588432be8d315801b2e80a0765168ad98f52483060045ae5208451078b2e6876a6f90d40a5c3e3f31cc559ba0479dd4f67d939fa21dd0528703a68c933f8a3d8e504d48f8c9bf7c41e92deecd80",
+    "0xf90211a04232cef0e6c4bbd5969f864233a23762543460900e04868931685e0148ae2d10a05353ae18ba63650d7281fefa6fb545b7314cadafd459eed25c7db4915d834e95a022fe8bbf3b304ea8fa6e0cb69c9a3a05cdcf0c3542a5e389a9518177a1925bdca0377ac9d4284000e1f98327783989043f4a6b59d48f5a80579c71adfd880f651ea049da166e0ceb03cf24a2cc03b3bd5e862eddd540a2c517493125322b3a30e85ba0aa9980b3bf84ce0b360f10ca3b230b5dbc9eecba684ed1add96b23167728574ea0f28a3be0e42f13e78f306970fd3a1aac286b30af8af1f460e50eba1d879d61b8a0c84f2fd48976ee7662adc809abb439ea056b3615b622f2938b597782501a4279a0ca13452ffbe75eedde1d870340997ce269c83f6642eefa2d4e9d6bd21c8fc838a0dd918c25e25823548a6a31edb27b65421b2b77063cdc71b13c43eed15b86b924a01a4d8ab05ce030242b59014d96fe1adca52c3f5d13eb09feefbf6eaf97e6fcfba09187e247644a19fe62860dba6e2317f40fe9907c8101bf9e1b04e4b5dadb8ec4a02c299cdc9b87c7f3b1402627f9bcc488d8655a6cbc5d458155024dc8be90ea7aa0373f215d7bc10a74a8e11ddbd3395e27d55cfab62a433b2c6961c1beee9ff3c8a04ec09787d6040119700a0d38154d4a589e1d62245fcd685768cd265cda5ee576a00086a240676e913c0b969397fbc72191719834bc533ba4601406ea062ea76f9b80",
+    "0xf90151808080a0ae1018f6569474784bbb933125e397f72f160cb86bf9528ba522e2957e6b27b6a07e10da74c2d11b8dda5b0127b4b39a0d7a1f4a1c9f0dc1a05ae1f3fa3346c86ba0884fa49d5faae435667fe982950ccf82aa58a148dffdb99c5eb7da6b01fd9b00a0065e97ea5d45a492c2aa8eade7534551a04e7899f0bcebeeccc42a1cb2292ce3a0c3a2aae48ed7395cc59065eedd5cb40d9a0cb02db9a9afaccd27efd6282464eb808080a0fc9e1fdc7239d8adc047265bb6589ddefac9a63c1c9829ef2b4717a4b9000dd7a0c285558e316f3ea0ceb2ca5681a79e5d3e3d6d6f21054d5056a6e9ad7dcdd6c7a0de8e2f7f5743997eabe69cb1d99ef0aec670da0b31b466bd8e14d24df17542d6a026ad23a1ed5a6f66a4e6e64fa1b3c37c0878975ba0b8872f5d8ae7c215a0f9c5a0f0ac72c6fc609e78ca13cefea04ef39ff7c9c49198a641508bf7d51bc997239180",
+    "0xf851808080808080a0292e7aa7b0fa371f45a26562a180d952f2f3bd3d7a67eb019747b10876cd61a6a0c7f2b75df52f531ca04c4b7c6449bb8be8eae52bf543dfb78383eda4625d922e808080808080808080",
+    "0xf8669d37118893aaaf73153bacee2bbd50b8234ab255361cc8614a5713b77282b846f8440180a088219055c2fef8800e02f071d053a86a4194e70a81b6e45f1fecca7dae0432daa01f958654ab06a152993e7a0ae7b6dbb0d4b19265cc9337b8789fe1353bd9dc35"
+  ],
+  "storageProof": [
+    {
+      "key": "0x65a7ed542fb37fe237fdfbdd70b31598523fe5b32879e307bae27a0bd9581c08",
+      "proof": [
+        "0xf901118080a04fc5f13ab2f9ba0c2da88b0151ab0e7cf4d85d08cca45ccd923c6ab76323eb28a09d1f77882a1c2e804de950478b4fdec793decb817e7bbe24a2afd23eb000d648a0f57febb7b16455e051f412a56e54016c676a3d4aa515d2e77a90520dfe36162ea0dce964c738816bb26d659513b793496cac2279d100812e6441aae3f7ffefce2080a0d5223d0cc181c8c0cd1babb8cd0b4d6433eab19a9fcc7836681589aad346556fa0c61ebce1cecbc190ee1163d0ff9ff456cb1fe3409dc546bf2f9118662e6db892a024513ee2bee3b30d4b4e4b600b5a98db38db03f6db556f492d24ac0ff9d6c98fa019bbead828fb8baf57dfda3a30a0b6da048e31faee39f5a76a99b51f28c6c512808080808080",
+        "0xf7a031a88f3936348d602f3078126bdcd162c575cb17fb9bbfe2dab00b167bd295c39594715b7219d986641df9efd9c7ef01218d528e19ec"
+      ],
+      "value": "0x715b7219d986641df9efd9c7ef01218d528e19ec"
+    }
+  ]
+}
 `
+
+var goodRoot = common.HexToHash("0x070ef87d6d3a8a132dfb45cbbc86daf545a45f1a0263bd28a304e465327f3557")
+
+func TestAccountResult_Verify(t *testing.T) {
+	result := makeResult(t)
+	require.NoError(t, result.Verify(goodRoot), "verifies against good state root")
+	require.NotNil(t, result.Verify(common.HexToHash("0x070ef87d6d3a8a132dfb45cbbc86daf545a45f1a0263bd28a304e465327f3558")), "does not verify against other state root")
+	result = makeResult(t)
+	result.StorageProof[0].Proof[0][0] = 0x00
+	require.NotNil(t, result.Verify(goodRoot), "does not verify against bad proof")
+	result = makeResult(t)
+	result.AccountProof[0][0] = 0x00
+	require.NotNil(t, result.Verify(goodRoot), "does not verify against bad proof")
+}
+
+func FuzzAccountResult_StorageProof(f *testing.F) {
+	f.Fuzz(func(t *testing.T, key []byte, value []byte) {
+		result := makeResult(t)
+		result.StorageProof[0].Key = common.BytesToHash(key)
+		result.StorageProof[0].Value = hexutil.Big(*(new(big.Int).SetBytes(value)))
+		require.NotNil(t, result.Verify(goodRoot), "does not verify against bad proof")
+	})
+}
+
+func FuzzAccountResult_AccountProof(f *testing.F) {
+	f.Fuzz(func(t *testing.T, address []byte, balance []byte, codeHash []byte, nonce uint64, storageHash []byte) {
+		result := makeResult(t)
+		result.Address = common.BytesToAddress(address)
+		bal := hexutil.Big(*new(big.Int).SetBytes(balance))
+		result.Balance = &bal
+		result.CodeHash = common.BytesToHash(codeHash)
+		result.Nonce = hexutil.Uint64(nonce)
+		result.StorageHash = common.BytesToHash(storageHash)
+		require.NotNil(t, result.Verify(goodRoot), "does not verify against bad account proof")
+	})
+}
+
+func makeResult(t *testing.T) AccountResult {
 	var result AccountResult
 	require.NoError(t, json.Unmarshal([]byte(resultData), &result))
-	require.NoError(t, result.Verify(common.HexToHash("0xb3a98a923c23cf25cbe04485f55243b37b29b7e12760bd24368ace23bf370e7a")), "verifies against good state root")
-	require.NotNil(t, result.Verify(common.HexToHash("0xb3a98a923c23cf25cbe04485f55243b37b29b7e12760bd24368ace23bf370e7b")), "does not verify against other state root")
+	return result
 }

op-node/p2p/host.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"sync"
 	"time"
 
+	"github.com/libp2p/go-libp2p/core/network"
+
 	lconf "github.com/libp2p/go-libp2p/config"
 	"github.com/libp2p/go-libp2p/core/connmgr"
 	"github.com/libp2p/go-libp2p/core/host"
@@ -34,6 +37,11 @@ type extraHost struct {
 	host.Host
 	gater   ConnectionGater
 	connMgr connmgr.ConnManager
+	log     log.Logger
+
+	staticPeers []*peer.AddrInfo
+
+	quitC chan struct{}
 }
 
 func (e *extraHost) ConnectionGater() ConnectionGater {
@@ -44,6 +52,73 @@ func (e *extraHost) ConnectionManager() connmgr.ConnManager {
 	return e.connMgr
 }
 
+func (e *extraHost) Close() error {
+	close(e.quitC)
+	return e.Host.Close()
+}
+
+func (e *extraHost) initStaticPeers() {
+	for _, addr := range e.staticPeers {
+		e.Peerstore().AddAddrs(addr.ID, addr.Addrs, time.Hour*24*7)
+		// We protect the peer, so the connection manager doesn't decide to prune it.
+		// We tag it with "static" so other protects/unprotects with different tags don't affect this protection.
+		e.connMgr.Protect(addr.ID, "static")
+		// Try to dial the node in the background
+		go func(addr *peer.AddrInfo) {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
+			defer cancel()
+			if err := e.dialStaticPeer(ctx, addr); err != nil {
+				e.log.Warn("error dialing static peer", "peer", addr.ID, "err", err)
+			}
+		}(addr)
+	}
+}
+
+func (e *extraHost) dialStaticPeer(ctx context.Context, addr *peer.AddrInfo) error {
+	e.log.Info("dialing static peer", "peer", addr.ID, "addrs", addr.Addrs)
+	if _, err := e.Network().DialPeer(ctx, addr.ID); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (e *extraHost) monitorStaticPeers() {
+	tick := time.NewTicker(time.Minute)
+	defer tick.Stop()
+
+	for {
+		select {
+		case <-tick.C:
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
+			var wg sync.WaitGroup
+
+			e.log.Debug("polling static peers", "peers", len(e.staticPeers))
+			for _, addr := range e.staticPeers {
+				connectedness := e.Network().Connectedness(addr.ID)
+				e.log.Trace("static peer connectedness", "peer", addr.ID, "connectedness", connectedness)
+
+				if connectedness == network.Connected {
+					continue
+				}
+
+				wg.Add(1)
+				go func(addr *peer.AddrInfo) {
+					e.log.Warn("static peer disconnected, reconnecting", "peer", addr.ID)
+					if err := e.dialStaticPeer(ctx, addr); err != nil {
+						e.log.Warn("error reconnecting to static peer", "peer", addr.ID, "err", err)
+					}
+					wg.Done()
+				}(addr)
+			}
+
+			wg.Wait()
+			cancel()
+		case <-e.quitC:
+			return
+		}
+	}
+}
+
 var _ ExtraHostFeatures = (*extraHost)(nil)
 
 func (conf *Config) Host(log log.Logger, reporter metrics.Reporter) (host.Host, error) {
@@ -142,26 +217,28 @@ func (conf *Config) Host(log log.Logger, reporter metrics.Reporter) (host.Host,
 	if err != nil {
 		return nil, err
 	}
-	for _, peerAddr := range conf.StaticPeers {
+
+	staticPeers := make([]*peer.AddrInfo, len(conf.StaticPeers))
+	for i, peerAddr := range conf.StaticPeers {
 		addr, err := peer.AddrInfoFromP2pAddr(peerAddr)
 		if err != nil {
 			return nil, fmt.Errorf("bad peer address: %w", err)
 		}
-		h.Peerstore().AddAddrs(addr.ID, addr.Addrs, time.Hour*24*7)
-		// We protect the peer, so the connection manager doesn't decide to prune it.
-		// We tag it with "static" so other protects/unprotects with different tags don't affect this protection.
-		connMngr.Protect(addr.ID, "static")
-		// Try to dial the node in the background
-		go func() {
-			log.Info("Dialing static peer", "peer", addr.ID, "addrs", addr.Addrs)
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
-			defer cancel()
-			if _, err := h.Network().DialPeer(ctx, addr.ID); err != nil {
-				log.Warn("Failed to dial static peer", "peer", addr.ID, "addrs", addr.Addrs)
-			}
-		}()
+		staticPeers[i] = addr
 	}
-	out := &extraHost{Host: h, connMgr: connMngr}
+
+	out := &extraHost{
+		Host:        h,
+		connMgr:     connMngr,
+		log:         log,
+		staticPeers: staticPeers,
+		quitC:       make(chan struct{}),
+	}
+	out.initStaticPeers()
+	if len(conf.StaticPeers) > 0 {
+		go out.monitorStaticPeers()
+	}
+
 	// Only add the connection gater if it offers the full interface we're looking for.
 	if g, ok := connGtr.(ConnectionGater); ok {
 		out.gater = g

op-service/go.mod

@@ -5,8 +5,9 @@ go 1.18
 require (
 	github.com/ethereum-optimism/go-ethereum-hdwallet v0.1.3
 	github.com/ethereum-optimism/optimism/op-node v0.10.12
-	github.com/ethereum-optimism/optimism/op-signer v0.1.0
+	github.com/ethereum-optimism/optimism/op-signer v0.1.1
 	github.com/ethereum/go-ethereum v1.10.26
+	github.com/fsnotify/fsnotify v1.6.0
 	github.com/prometheus/client_golang v1.13.0
 	github.com/stretchr/testify v1.8.1
 	github.com/urfave/cli v1.22.9
@@ -25,9 +26,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/deckarep/golang-set v1.8.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 // indirect
-	github.com/dyson/certman v0.3.0 // indirect
 	github.com/fjl/memsize v0.0.1 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gballet/go-libpcsclite v0.0.0-20191108122812-4678299bea08 // indirect
 	github.com/go-kit/kit v0.10.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect

op-service/go.sum

@@ -123,8 +123,6 @@ github.com/decred/dcrd/lru v1.0.0/go.mod h1:mxKOwFd7lFjN2GZYsiz/ecgqR6kkYAl+0pz0
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dyson/certman v0.3.0 h1:S7WCUim5faT/OiBhiY3u5cMaiC9MNKiA+8PJDXLaIYQ=
-github.com/dyson/certman v0.3.0/go.mod h1:RMWlyA9op6D9SxOBRRX3sxnParehv9gf52WWUJPd1JA=
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
@@ -141,8 +139,8 @@ github.com/ethereum-optimism/op-geth v0.0.0-20221216190603-60b51d600468 h1:7KgjB
 github.com/ethereum-optimism/op-geth v0.0.0-20221216190603-60b51d600468/go.mod h1:p0Yox74PhYlq1HvijrCBCD9A3cI7rXco7hT6KrQr+rY=
 github.com/ethereum-optimism/optimism/op-node v0.10.12 h1:yOxMThwwz1rEDDM0xTjS+6jqJwgKRtrYM6h4Pdf0zno=
 github.com/ethereum-optimism/optimism/op-node v0.10.12/go.mod h1:z+DiFb82Vnn5zM3VEwc2OXK2V/JBg6MLg7ejTbsxye8=
-github.com/ethereum-optimism/optimism/op-signer v0.1.0 h1:wH44Deai43YQWO0pEd44pDm3BahdAtSmrOHKiPvTB8Y=
-github.com/ethereum-optimism/optimism/op-signer v0.1.0/go.mod h1:u8sN6X/c20pP9F1Ey7jH3fi19D08Y+T9ep3PGJfdyi8=
+github.com/ethereum-optimism/optimism/op-signer v0.1.1 h1:Ts6aWd5/nTQ8ZRFZhpOrrcWpnVmdp4fRfff1mvybnGs=
+github.com/ethereum-optimism/optimism/op-signer v0.1.1/go.mod h1:HK+9do1IJmDr9aEc44ECweYbCLDfGGYO7PBwTqDNrqI=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fjl/memsize v0.0.1 h1:+zhkb+dhUgx0/e+M8sF0QqiouvMQUiKR+QYvdxIOKcQ=
 github.com/fjl/memsize v0.0.1/go.mod h1:VvhXpOYNQvB+uIk2RvXzuaQtkQJzzIx6lSBe1xv7hi0=

op-service/rpc/server.go

@@ -183,7 +183,7 @@ func (b *Server) Start() error {
 	errCh := make(chan error, 1)
 	go func() {
 		if b.tls != nil {
-			if err := b.httpServer.ListenAndServeTLS(b.tls.CLIConfig.TLSCert, b.tls.CLIConfig.TLSKey); err != nil {
+			if err := b.httpServer.ListenAndServeTLS("", ""); err != nil {
 				errCh <- err
 			}
 		} else {

op-service/tls/certman/certman.go

+// Package certman provides live reloading of the certificate and key
+// files used by the standard library http.Server. It defines a type,
+// certMan, with methods watching and getting the files.
+// Only valid certificate and key pairs are loaded and an optional
+// logger can be passed to certman for logging providing it implements
+// the logger interface.
+package certman
+
+import (
+	"crypto/tls"
+	"fmt"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/ethereum/go-ethereum/log"
+	"github.com/fsnotify/fsnotify"
+)
+
+// A CertMan represents a certificate manager able to watch certificate
+// and key pairs for changes.
+type CertMan struct {
+	mu       sync.RWMutex
+	certFile string
+	keyFile  string
+	keyPair  *tls.Certificate
+	watcher  *fsnotify.Watcher
+	watching chan bool
+	log      log.Logger
+}
+
+// New creates a new certMan. The certFile and the keyFile
+// are both paths to the location of the files. Relative and
+// absolute paths are accepted.
+func New(logger log.Logger, certFile, keyFile string) (*CertMan, error) {
+	var err error
+	certFile, err = filepath.Abs(certFile)
+	if err != nil {
+		return nil, err
+	}
+	keyFile, err = filepath.Abs(keyFile)
+	if err != nil {
+		return nil, err
+	}
+	cm := &CertMan{
+		mu:       sync.RWMutex{},
+		certFile: certFile,
+		keyFile:  keyFile,
+		log:      logger,
+	}
+	return cm, nil
+}
+
+// Watch starts watching for changes to the certificate
+// and key files. On any change the certificate and key
+// are reloaded. If there is an issue the load will fail
+// and the old (if any) certificates and keys will continue
+// to be used.
+func (cm *CertMan) Watch() error {
+	var err error
+	if cm.watcher, err = fsnotify.NewWatcher(); err != nil {
+		return fmt.Errorf("certman: can't create watcher: %w", err)
+	}
+
+	certPath := path.Dir(cm.certFile)
+	keyPath := path.Dir(cm.keyFile)
+
+	if err = cm.watcher.Add(certPath); err != nil {
+		return fmt.Errorf("certman: can't watch %s: %w", certPath, err)
+	}
+	if keyPath != certPath {
+		if err = cm.watcher.Add(keyPath); err != nil {
+			return fmt.Errorf("certman: can't watch %s: %w", certPath, err)
+		}
+	}
+	if err := cm.load(); err != nil {
+		cm.log.Error("certman: can't load cert or key file", "err", err)
+	}
+	cm.log.Info("certman: watching for cert and key change")
+	cm.watching = make(chan bool)
+	go cm.run()
+	return nil
+}
+
+func (cm *CertMan) load() error {
+	keyPair, err := tls.LoadX509KeyPair(cm.certFile, cm.keyFile)
+	if err == nil {
+		cm.mu.Lock()
+		cm.keyPair = &keyPair
+		cm.mu.Unlock()
+		cm.log.Info("certman: certificate and key loaded")
+	}
+	return err
+}
+
+func (cm *CertMan) run() {
+	cm.log.Info("certman: running")
+
+	ticker := time.NewTicker(2 * time.Second)
+	files := []string{cm.certFile, cm.keyFile}
+	reload := time.Time{}
+
+loop:
+	for {
+		select {
+		case <-cm.watching:
+			cm.log.Info("watching triggered; break loop")
+			break loop
+		case <-ticker.C:
+			if !reload.IsZero() && time.Now().After(reload) {
+				reload = time.Time{}
+				cm.log.Info("certman: reloading")
+				if err := cm.load(); err != nil {
+					cm.log.Error("certman: can't load cert or key file", "err", err)
+				}
+			}
+		case event := <-cm.watcher.Events:
+			for _, f := range files {
+				if event.Name == f ||
+					strings.HasSuffix(event.Name, "/..data") { // kubernetes secrets mount
+					// we wait a couple seconds in case the cert and key don't update atomically
+					cm.log.Info(fmt.Sprintf("%s was modified, queue reload", f))
+					reload = time.Now().Add(2 * time.Second)
+				}
+			}
+		case err := <-cm.watcher.Errors:
+			cm.log.Error("certman: error watching files", "err", err)
+		}
+	}
+	cm.log.Info("certman: stopped watching")
+	cm.watcher.Close()
+	ticker.Stop()
+}
+
+// GetCertificate returns the loaded certificate for use by
+// the GetCertificate field in tls.Config.
+func (cm *CertMan) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	cm.mu.RLock()
+	defer cm.mu.RUnlock()
+	return cm.keyPair, nil
+}
+
+// GetClientCertificate returns the loaded certificate for use by
+// the GetClientCertificate field in tls.Config.
+func (cm *CertMan) GetClientCertificate(hello *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+	cm.mu.RLock()
+	defer cm.mu.RUnlock()
+	return cm.keyPair, nil
+}
+
+// Stop tells certMan to stop watching for changes to the
+// certificate and key files.
+func (cm *CertMan) Stop() {
+	cm.watching <- false
+}

op-service/tls/certman/certman_test.go

+// Copyright 2017 Dyson Simmons. All rights reserved.
+// Use of this source code is governed by a MIT
+// license that can be found in the LICENSE file.
+
+package certman_test
+
+import (
+	"crypto/tls"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/ethereum-optimism/optimism/op-service/tls/certman"
+	"github.com/ethereum/go-ethereum/log"
+)
+
+func TestValidPair(t *testing.T) {
+	cm, err := certman.New(log.Root(), "./testdata/server1.crt", "./testdata/server1.key")
+	if err != nil {
+		t.Errorf("could not create certman: %v", err)
+	}
+	if err := cm.Watch(); err != nil {
+		t.Errorf("could not watch files: %v", err)
+	}
+}
+
+func TestInvalidPair(t *testing.T) {
+	cm, err := certman.New(log.Root(), "./testdata/server1.crt", "./testdata/server2.key")
+	if err != nil {
+		t.Errorf("could not create certman: %v", err)
+	}
+	if err := cm.Watch(); err != nil {
+		t.Errorf("could not watch files: %v", err)
+	}
+}
+
+func TestCertificateNotFound(t *testing.T) {
+	cm, err := certman.New(log.Root(), "./testdata/nothere.crt", "./testdata/server2.key")
+	if err != nil {
+		t.Errorf("could not create certman: %v", err)
+	}
+	if err := cm.Watch(); err != nil {
+		if !strings.HasPrefix(err.Error(), "certman: can't watch cert file: ") {
+			t.Errorf("unexpected watch error: %v", err)
+		}
+	}
+}
+
+func TestKeyNotFound(t *testing.T) {
+	cm, err := certman.New(log.Root(), "./testdata/server1.crt", "./testdata/nothere.key")
+	if err != nil {
+		t.Errorf("could not create certman: %v", err)
+	}
+	if err := cm.Watch(); err != nil {
+		if !strings.HasPrefix(err.Error(), "certman: can't watch key file: ") {
+			t.Errorf("unexpected watch error: %v", err)
+		}
+	}
+}
+
+func TestGetCertificate(t *testing.T) {
+	cm, err := certman.New(log.Root(), "./testdata/server1.crt", "./testdata/server1.key")
+	if err != nil {
+		t.Errorf("could not create certman: %v", err)
+	}
+	if err := cm.Watch(); err != nil {
+		t.Errorf("could not watch files: %v", err)
+	}
+	hello := &tls.ClientHelloInfo{}
+	cmCert, err := cm.GetCertificate(hello)
+	if err != nil {
+		t.Error("could not get certman certificate")
+	}
+	expectedCert, _ := tls.LoadX509KeyPair("./testdata/server1.crt", "./testdata/server1.key")
+	if err != nil {
+		t.Errorf("could not load certificate and key files to test: %v", err)
+	}
+	if !reflect.DeepEqual(cmCert.Certificate, expectedCert.Certificate) {
+		t.Errorf("certman certificate doesn't match expected certificate")
+	}
+}

op-service/tls/certman/testdata/README

+Test certificates generated with the following command:
+
+openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -sha256 -keyout server.key -out server.crt
\ No newline at end of file

op-service/tls/certman/testdata/server.crt

+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIJAJiO53P0WQTzMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNV
+BAYTAlhYMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQg
+Q29tcGFueSBMdGQwHhcNMTcwODA0MTAzMzIyWhcNMTgwODA0MTAzMzIyWjBCMQsw
+CQYDVQQGEwJYWDEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZh
+dWx0IENvbXBhbnkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sYk+rsOElxPB5gPH8Vg/RFzdBzDJesI4VCXYcSCl0Ek/lO4AAKjgRssjmZDWWXcZ
+3/Z1UlO4cRZy6zaSllFM07WXX3SQ54iBy3lS6NgBcHiWVfKrtXz/dQrswSPBnGEH
+PVBmd+xHcEv4wqYnYYVtJuIcGY1P/i14h1ogpEW22cnCVYJwqmjxrD4UQ8vSeTf9
+YwVCbKXZ5T+eiNhfQOkCG0rClqvfvZiMgBBlLYvJrc9bELsqIbNGVD4CrkYjZGEc
+ToMrb/wZhqLxlcs/iXKI0/579+9vvc44/pi2MFU0nvhoSnEgopKKPy83SwBogpiH
++mDcVgMiEwbXHUyNAFbz/wIDAQABo1MwUTAdBgNVHQ4EFgQULtTUM8bHdg4jhRT3
+9piSLGyTSsUwHwYDVR0jBBgwFoAULtTUM8bHdg4jhRT39piSLGyTSsUwDwYDVR0T
+AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAchsCFqaRslfgR0r0CoOJsX/H
+gEfqYHaL8/yJtUUqCRgyN5VtP1Cxzet8GVsAJaIKimeUCXshhaq94JQRZqxMFxJD
+sD9nfWVByorkSO9tmq+1FCWRzfau1AFsJxR6J1hpIbRfcfoi9HG4QnoJwULK/2yh
+DEXwnmgsCHTcNnj2U9F2vMLydHEKtmtMNe/S0Z7fHw1qlmqXgXmN5a/KTEPVBQm8
+eM6AhNlzrMqUPc8IiiZ32eAdgR2eAuhLnTCdnHwnHafpep72hSjwoUXsDjWNA/xW
+/lHx4jVL8muLP5G9YHZWzJwMijLqIlnryyyi+IfKAn4ANW/k44Lxm5hmRXh4UA==
+-----END CERTIFICATE-----

op-service/tls/certman/testdata/server.key

+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxiT6uw4SXE8Hm
+A8fxWD9EXN0HMMl6wjhUJdhxIKXQST+U7gAAqOBGyyOZkNZZdxnf9nVSU7hxFnLr
+NpKWUUzTtZdfdJDniIHLeVLo2AFweJZV8qu1fP91CuzBI8GcYQc9UGZ37EdwS/jC
+pidhhW0m4hwZjU/+LXiHWiCkRbbZycJVgnCqaPGsPhRDy9J5N/1jBUJspdnlP56I
+2F9A6QIbSsKWq9+9mIyAEGUti8mtz1sQuyohs0ZUPgKuRiNkYRxOgytv/BmGovGV
+yz+JcojT/nv372+9zjj+mLYwVTSe+GhKcSCikoo/LzdLAGiCmIf6YNxWAyITBtcd
+TI0AVvP/AgMBAAECggEATZpnau8N+xfozsliUa24YgKRnv4FZAKXqrisRq71q/kI
+sOnj2GX5Oxi6o/q6p3q3Nb2+hNERs2UTsJs3MjuxcG1VEKWcXYi+65lJ03vwDSC4
+3jLoObm81IWE/dvKWrfS+Us2rz757y1WPIdyeV9gWfnGPKkXiUyI/ek4kXXjuoiL
+WqYeWlhe2mGVxQs5DfxBigvN0th2yfmeQJTLXpoJkCDmSTS3vnvKJfiH/mflLm/B
+51lgKEziqvu53JmgYmhswsgRnLtyZ4yjksMroJYPKCTA3RbDud+J6SO01ok+hiNy
+QcO/j+1zlFQlWqAE4BSB1IXbW/6ZQAdszPpX9l318QKBgQDaW+nq0FH7djne5838
+sqBO7pHGde2j6To8PuGIoskH86p8X4dgutNiingGnYoqK2qTKVTudkdu2ahwGI3P
+S3dflwcyJwAvTbjc3ATSoez+P0oUC62DQciMfqaCR+WYAoAR8cdHtSoMyMvLVhSs
+1h05AoalTybuT+spscV8hFBdlwKBgQDQI9VxKPt9VwhKf0W6K2IKbNxvHcu0UFvZ
+pCZKdxQLr7tP3+oo9fWn6R0sSX/aV+km9YQsn6keX0e4ayJHNfU6UwzNSMKWQZvs
+JF7OBuZnpZYX/1lSIUDOw8I29kcVtqCHjpgozbFhJSQzJDDcPvRFmkPBI74sgA1z
+xuH7xcc52QKBgDPX7snZfB2ADG1oC/gbUQRskB/Wj/2CuljjdRjDzYcdyzSMWdAV
+i2qyBZ1MeilY9YzLG2cingMrmlpC+ihleooviX3W1Kxmf6Wwd1SrLWGQFT59J00q
+qTryNwZnm5NjxJR+GxpjYQB4DCrS3UXL8FRAzUcia9PZFbRoiMLvh0UxAoGBAIjZ
+prL6cTBeEvN4bw4TDCkynlTo0FDELUASL6LyXFm6t3uzC7DW1ygJm8bMpKWY+5FE
+CB2W9IkluHBG8IjFr3Ejvd0To+1LQgundjYcT02CkAdDOyVG++d2yrF8iAx8wVuf
+o+fgJmprEzwU5ZNKSS2iWj4ZFCcKIs4my9rQlUcxAoGBAMiqpes+Ka3ofb8sxpzj
+xAB2oOub0X93a3xQ4xv5VLDysA7+rv1CDwuYKlOKTjGFwg3CwvbnE2EKkKI9BNgh
+UHAdpVXWOck5ubD5EB6vp7xWvzu6AA4KyhyRJaRL1GdSLFl9JDg5YvHskVxumt+L
+/GgTbnT/P3+JOhCdc0H0XhGq
+-----END PRIVATE KEY-----

op-service/tls/certman/testdata/server1.crt

+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIJALkZ2SqlmTT6MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNV
+BAYTAlhYMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQg
+Q29tcGFueSBMdGQwHhcNMTcwODA1MTU1MjIyWhcNMTgwODA1MTU1MjIyWjBCMQsw
+CQYDVQQGEwJYWDEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZh
+dWx0IENvbXBhbnkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+p3vZAGYjBC4kPf6jqh6NYCWMVe8Db5IOHYECtGxBVOhS5DnuXPm0LUT9UCoUfPeB
+mU/1LZk41J70tpwl2IHhSIFqbG+fhNlRlUAA9CIHeRa2RVkFxH7I7xt2FhwU2WsX
+vi+GEiOKoZ2mC2cuZ5t8zWKinW+Hd8pL270OboQ980gThfF2ugzoXlyYVa+MrE5z
+wjLa3lQoKkqzo54/gKwK+KycXYoljmf2Q0++sSsDAqZlFIYknfct4+ST4TvGRqSw
+nPxQcJ33MXDpbnGcTBPXqWxXhvocd+QrOF4Rn7fVRLWZqYoFchSnt4R3qsoPuB8q
+WdZn+McT6qqgLUUtRy72PQIDAQABo1MwUTAdBgNVHQ4EFgQU83D1oNnMvjHU5q3E
+KIJUtrHMh94wHwYDVR0jBBgwFoAU83D1oNnMvjHU5q3EKIJUtrHMh94wDwYDVR0T
+AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEADByFIBVqK7b2ZJVqWzQlY7pC
+DbR4bh+z8hwP/VU/JjlR0IdFj1tWLLPq5hmCWScntsmI8AvThCTbZgwogptvbeuA
+n2QRuSb3LMZBtq22XdDTPCdM4CQblinbXR3ePmz2ZpF7xxQMz8/IafeoZaaF2w4l
+PfHrf4ID89dMOq13MAhiSFmKeyElx2iGGnhsGQzhcoTbhDCW/HK3Zr/BN+uFyBgr
+PcV0H+VLOS7/XVnz5wbIiqTfnx0NhzQzw91zY2dXVOvNadD6QpNN5Abwxo9x16TP
+SfqKsjPvxk06wvchNAkopBLsqjLMovgKYMMbolVmFeeZVvNEnY19RoBuneJncA==
+-----END CERTIFICATE-----

op-service/tls/certman/testdata/server1.key

+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCne9kAZiMELiQ9
+/qOqHo1gJYxV7wNvkg4dgQK0bEFU6FLkOe5c+bQtRP1QKhR894GZT/UtmTjUnvS2
+nCXYgeFIgWpsb5+E2VGVQAD0Igd5FrZFWQXEfsjvG3YWHBTZaxe+L4YSI4qhnaYL
+Zy5nm3zNYqKdb4d3ykvbvQ5uhD3zSBOF8Xa6DOheXJhVr4ysTnPCMtreVCgqSrOj
+nj+ArAr4rJxdiiWOZ/ZDT76xKwMCpmUUhiSd9y3j5JPhO8ZGpLCc/FBwnfcxcOlu
+cZxME9epbFeG+hx35Cs4XhGft9VEtZmpigVyFKe3hHeqyg+4HypZ1mf4xxPqqqAt
+RS1HLvY9AgMBAAECggEAGE5R7Mvl0wp7OgAFcn/ilox8dFAumHeC0udRJCv9wzvA
+I90Aab/XVSaI+KRSutwUk9JVy5tL8xdqfkHlACnBLwuRDVGZvebn/xf9y3BQ01Ln
+euLzglPAB2td1NGYeQEgvfoZo/JCgTfmzAraYjDfiNMCtIRmDY1vOuGSAZnxf6e/
+C7LB7XdKdGijUgjvHOv82DUbdt5RD/RL9chvk+i9esdjJIxS3YaSOHclV7FSjRqe
+f5e9MrPKuSdijYHqHOcxX3hztOrLjL7J4gVPRvjGaWbRmdU79m2oFlwfGlLTU+w6
+zlzIu5FqKD375rchkOKw3W8uSyPCRsdnmZxT+CZKIQKBgQDPHiXmGWlTBdcBcgaK
+4PIZltAZbA+5MdDDJPDZp9b5gS8/0mXoqOvvC2PeOkrv96l3nrVoTbfOxxutftjO
+Xh2OfplpNkxABR8WqY7mKaHR4aphlq1QtxcCcOlmAbmo9Eo03Vhir7q913upgEnY
+jzEoX9b41JEJBTR6Mfbfx3b6+QKBgQDPAw2ZuBqiyPmozCDqKnP2yiOJz6wkunqI
+rUkZLizN+U9kByiq/NzoDGo6BNchs2XpVhoIt3ixC/xzzhDUkn7V7ZCn8BkEdj/T
+jgZyupMJ1wNQK9Du3GaYPRnQ1I3OrfA0oOx1ZVoOOKOEDAEAfhzSW8GWicO3305o
+6/4Tq4gCZQKBgQC18vEuS+KX+chgz6/pryVfz3ou6xyA/786v6gKPYUAGTnN4mJ+
+Wm8xx5rLLgCJANPSbw1EfQndUFMDPizuVgW3GYZhxD6F+znNadVMYwRyYcGRC5Jk
+FwPStCiF4TwdrcXG3TB5OZFelv9e74FwCpMPueobHHnxJ65rLpuHCS5/2QKBgBDF
+AYwLUvUO7NKUvrHZgI1kcJ6QWTSceqKpzvsgN3b0FE9ZGR1I4KhXoR9UFw1e2Amf
+9PnxyvAktW24KrrdpzKzTP2dwJkQ7zi3D6SpopGwfk83TXScHB+HC5lULqyogIXy
+51TXQgVW50AiLM6aaMFNt4/3VwiFKXfsbievxJPVAoGADlJV011pkxlF2wZxpvDT
+RGIWCtT3G3GksNPxTkLDsuBnJ38YE0p95MivBP3Q7kdVhfgOzG1AnWMeOUzcdzNM
+hXKW9EcyovPYrHpAcdwMXOj+WuU74l2tHLPJQ5+4zTKAc/4ZJ7TKMjZ21qRjqGHQ
+dxddYOr2kCOIFNreAaKD9Po=
+-----END PRIVATE KEY-----

op-service/tls/certman/testdata/server2.crt

+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIJAJiO53P0WQTzMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNV
+BAYTAlhYMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQg
+Q29tcGFueSBMdGQwHhcNMTcwODA0MTAzMzIyWhcNMTgwODA0MTAzMzIyWjBCMQsw
+CQYDVQQGEwJYWDEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZh
+dWx0IENvbXBhbnkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sYk+rsOElxPB5gPH8Vg/RFzdBzDJesI4VCXYcSCl0Ek/lO4AAKjgRssjmZDWWXcZ
+3/Z1UlO4cRZy6zaSllFM07WXX3SQ54iBy3lS6NgBcHiWVfKrtXz/dQrswSPBnGEH
+PVBmd+xHcEv4wqYnYYVtJuIcGY1P/i14h1ogpEW22cnCVYJwqmjxrD4UQ8vSeTf9
+YwVCbKXZ5T+eiNhfQOkCG0rClqvfvZiMgBBlLYvJrc9bELsqIbNGVD4CrkYjZGEc
+ToMrb/wZhqLxlcs/iXKI0/579+9vvc44/pi2MFU0nvhoSnEgopKKPy83SwBogpiH
++mDcVgMiEwbXHUyNAFbz/wIDAQABo1MwUTAdBgNVHQ4EFgQULtTUM8bHdg4jhRT3
+9piSLGyTSsUwHwYDVR0jBBgwFoAULtTUM8bHdg4jhRT39piSLGyTSsUwDwYDVR0T
+AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAchsCFqaRslfgR0r0CoOJsX/H
+gEfqYHaL8/yJtUUqCRgyN5VtP1Cxzet8GVsAJaIKimeUCXshhaq94JQRZqxMFxJD
+sD9nfWVByorkSO9tmq+1FCWRzfau1AFsJxR6J1hpIbRfcfoi9HG4QnoJwULK/2yh
+DEXwnmgsCHTcNnj2U9F2vMLydHEKtmtMNe/S0Z7fHw1qlmqXgXmN5a/KTEPVBQm8
+eM6AhNlzrMqUPc8IiiZ32eAdgR2eAuhLnTCdnHwnHafpep72hSjwoUXsDjWNA/xW
+/lHx4jVL8muLP5G9YHZWzJwMijLqIlnryyyi+IfKAn4ANW/k44Lxm5hmRXh4UA==
+-----END CERTIFICATE-----

op-service/tls/certman/testdata/server2.key

+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxiT6uw4SXE8Hm
+A8fxWD9EXN0HMMl6wjhUJdhxIKXQST+U7gAAqOBGyyOZkNZZdxnf9nVSU7hxFnLr
+NpKWUUzTtZdfdJDniIHLeVLo2AFweJZV8qu1fP91CuzBI8GcYQc9UGZ37EdwS/jC
+pidhhW0m4hwZjU/+LXiHWiCkRbbZycJVgnCqaPGsPhRDy9J5N/1jBUJspdnlP56I
+2F9A6QIbSsKWq9+9mIyAEGUti8mtz1sQuyohs0ZUPgKuRiNkYRxOgytv/BmGovGV
+yz+JcojT/nv372+9zjj+mLYwVTSe+GhKcSCikoo/LzdLAGiCmIf6YNxWAyITBtcd
+TI0AVvP/AgMBAAECggEATZpnau8N+xfozsliUa24YgKRnv4FZAKXqrisRq71q/kI
+sOnj2GX5Oxi6o/q6p3q3Nb2+hNERs2UTsJs3MjuxcG1VEKWcXYi+65lJ03vwDSC4
+3jLoObm81IWE/dvKWrfS+Us2rz757y1WPIdyeV9gWfnGPKkXiUyI/ek4kXXjuoiL
+WqYeWlhe2mGVxQs5DfxBigvN0th2yfmeQJTLXpoJkCDmSTS3vnvKJfiH/mflLm/B
+51lgKEziqvu53JmgYmhswsgRnLtyZ4yjksMroJYPKCTA3RbDud+J6SO01ok+hiNy
+QcO/j+1zlFQlWqAE4BSB1IXbW/6ZQAdszPpX9l318QKBgQDaW+nq0FH7djne5838
+sqBO7pHGde2j6To8PuGIoskH86p8X4dgutNiingGnYoqK2qTKVTudkdu2ahwGI3P
+S3dflwcyJwAvTbjc3ATSoez+P0oUC62DQciMfqaCR+WYAoAR8cdHtSoMyMvLVhSs
+1h05AoalTybuT+spscV8hFBdlwKBgQDQI9VxKPt9VwhKf0W6K2IKbNxvHcu0UFvZ
+pCZKdxQLr7tP3+oo9fWn6R0sSX/aV+km9YQsn6keX0e4ayJHNfU6UwzNSMKWQZvs
+JF7OBuZnpZYX/1lSIUDOw8I29kcVtqCHjpgozbFhJSQzJDDcPvRFmkPBI74sgA1z
+xuH7xcc52QKBgDPX7snZfB2ADG1oC/gbUQRskB/Wj/2CuljjdRjDzYcdyzSMWdAV
+i2qyBZ1MeilY9YzLG2cingMrmlpC+ihleooviX3W1Kxmf6Wwd1SrLWGQFT59J00q
+qTryNwZnm5NjxJR+GxpjYQB4DCrS3UXL8FRAzUcia9PZFbRoiMLvh0UxAoGBAIjZ
+prL6cTBeEvN4bw4TDCkynlTo0FDELUASL6LyXFm6t3uzC7DW1ygJm8bMpKWY+5FE
+CB2W9IkluHBG8IjFr3Ejvd0To+1LQgundjYcT02CkAdDOyVG++d2yrF8iAx8wVuf
+o+fgJmprEzwU5ZNKSS2iWj4ZFCcKIs4my9rQlUcxAoGBAMiqpes+Ka3ofb8sxpzj
+xAB2oOub0X93a3xQ4xv5VLDysA7+rv1CDwuYKlOKTjGFwg3CwvbnE2EKkKI9BNgh
+UHAdpVXWOck5ubD5EB6vp7xWvzu6AA4KyhyRJaRL1GdSLFl9JDg5YvHskVxumt+L
+/GgTbnT/P3+JOhCdc0H0XhGq
+-----END PRIVATE KEY-----

op-signer/client/client.go

@@ -10,8 +10,8 @@ import (
 	"os"
 	"time"
 
-	"github.com/dyson/certman"
 	optls "github.com/ethereum-optimism/optimism/op-service/tls"
+	"github.com/ethereum-optimism/optimism/op-service/tls/certman"
 	"github.com/ethereum/go-ethereum/common/hexutil"
 	"github.com/ethereum/go-ethereum/core/types"
 	"github.com/ethereum/go-ethereum/log"
@@ -24,11 +24,6 @@ type SignerClient struct {
 	logger log.Logger
 }
 
-// ethLogger wraps a geth style logger for certman.
-type ethLogger struct{ logger log.Logger }
-
-func (l ethLogger) Printf(format string, v ...interface{}) { l.logger.Info(fmt.Sprintf(format, v...)) }
-
 func NewSignerClient(logger log.Logger, endpoint string, tlsConfig optls.CLIConfig) (*SignerClient, error) {
 	caCert, err := os.ReadFile(tlsConfig.TLSCaCert)
 	if err != nil {
@@ -38,8 +33,7 @@ func NewSignerClient(logger log.Logger, endpoint string, tlsConfig optls.CLIConf
 	caCertPool.AppendCertsFromPEM(caCert)
 
 	// certman watches for newer client certifictes and automatically reloads them
-	cm, err := certman.New(tlsConfig.TLSCert, tlsConfig.TLSKey)
-	cm.Logger(ethLogger{logger: logger})
+	cm, err := certman.New(logger, tlsConfig.TLSCert, tlsConfig.TLSKey)
 	if err != nil {
 		logger.Error("failed to read tls cert or key", "err", err)
 		return nil, err

op-signer/go.mod

@@ -3,8 +3,7 @@ module github.com/ethereum-optimism/optimism/op-signer
 go 1.18
 
 require (
-	github.com/dyson/certman v0.3.0
-	github.com/ethereum-optimism/optimism/op-service v0.10.10
+	github.com/ethereum-optimism/optimism/op-service v0.10.14-0.20230209182028-dceb2b4a70e2
 	github.com/ethereum/go-ethereum v1.10.26
 	github.com/urfave/cli v1.22.9
 )
@@ -18,14 +17,12 @@ require (
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/rivo/uniseg v0.2.1-0.20211004051800-57c86be7915a // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shirou/gopsutil v3.21.11+incompatible // indirect
 	github.com/tklauser/go-sysconf v0.3.10 // indirect
-	github.com/tklauser/numcpus v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.5.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
+	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
 	golang.org/x/sys v0.0.0-20221013171732-95e765b1cc43 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 )

op-signer/go.sum

 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/VictoriaMetrics/fastcache v1.9.0 h1:oMwsS6c8abz98B7ytAewQ7M1ZN/Im/iwKoE1euaFvhs=
+github.com/VictoriaMetrics/fastcache v1.10.0 h1:5hDJnLsKLpnUEToub7ETuRu8RCkb40woBZAUiKonXzY=
+github.com/btcsuite/btcd v0.23.3 h1:4KH/JKy9WiCd+iUS9Mu0Zp7Dnj17TGdKrg9xc/FGj24=
 github.com/btcsuite/btcd/btcec/v2 v2.2.0 h1:fzn1qaOt32TuLjFlkzYSsBC35Q3KUjT1SwPxiMSCF5k=
 github.com/btcsuite/btcd/btcec/v2 v2.2.0/go.mod h1:U7MHm051Al6XmscBQ0BoNydpOTsFAn707034b5nY8zU=
 github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1 h1:q0rUy8C/TYNBQS1+CGKw68tLOFYSNEs0TFnxxnS9+4U=
@@ -13,12 +14,10 @@ github.com/deckarep/golang-set v1.8.0/go.mod h1:5nI87KwE7wgsBU1F4GKAw2Qod7p5kyS3
 github.com/decred/dcrd/crypto/blake256 v1.0.0 h1:/8DMNYp9SGi5f0w7uCm6d6M4OU2rGFK09Y2A4Xv7EE0=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 h1:HbphB4TFFXpv7MNrT52FGrrgVXF1owhMVTHFZIlnvd4=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0/go.mod h1:DZGJHZMqrU4JJqFAWUS2UO1+lbSKsdiOoYi9Zzey7Fc=
-github.com/dyson/certman v0.3.0 h1:S7WCUim5faT/OiBhiY3u5cMaiC9MNKiA+8PJDXLaIYQ=
-github.com/dyson/certman v0.3.0/go.mod h1:RMWlyA9op6D9SxOBRRX3sxnParehv9gf52WWUJPd1JA=
-github.com/ethereum-optimism/op-geth v0.0.0-20221104231810-30db39cae2be h1:8TdM3M7FjZkrYeGGX9nEVtDDlZ5RiuHtc0mbi5bGKyY=
-github.com/ethereum-optimism/op-geth v0.0.0-20221104231810-30db39cae2be/go.mod h1:1g9UmZgEINqvYfXmWOUCRJX9fxegeOHudVkLCRAXO5Y=
-github.com/ethereum-optimism/optimism/op-service v0.10.10 h1:B5mGpATX6zPkDABoh6smCjh6Z5mA2KWh71MD1i6T5ww=
-github.com/ethereum-optimism/optimism/op-service v0.10.10/go.mod h1:wbtHqi1fv00B3agj7a2zdP3OFanEfGZ23zPgGgFCF/c=
+github.com/ethereum-optimism/op-geth v0.0.0-20221216190603-60b51d600468 h1:7KgjBYDji5AKi42eRYI+n8Gs+ZJVilSASL3WBu82c3M=
+github.com/ethereum-optimism/op-geth v0.0.0-20221216190603-60b51d600468/go.mod h1:p0Yox74PhYlq1HvijrCBCD9A3cI7rXco7hT6KrQr+rY=
+github.com/ethereum-optimism/optimism/op-service v0.10.14-0.20230209182028-dceb2b4a70e2 h1:5TsmOuk87DI8QNzvWvQ/pa5+WqPC46tzE4LFy1ylhP8=
+github.com/ethereum-optimism/optimism/op-service v0.10.14-0.20230209182028-dceb2b4a70e2/go.mod h1:+8ZWRn5nW1ROAqOqmVhf+u8g0UKRuegVMSxhRgWJSq4=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
@@ -32,12 +31,10 @@ github.com/holiman/big v0.0.0-20221017200358-a027dc42d04e h1:pIYdhNkDh+YENVNi3gt
 github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/tsdb v0.10.0 h1:If5rVCMTp6W2SiRAQFlbpJNgVlgMEd+U2GZckwK38ic=
-github.com/rivo/uniseg v0.2.1-0.20211004051800-57c86be7915a h1:s7GrsqeorVkFR1vGmQ6WVL9nup0eyQCC+YVUeSQLH/Q=
-github.com/rivo/uniseg v0.2.1-0.20211004051800-57c86be7915a/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.3.4 h1:3Z3Eu6FGHZWSfNKJTOUiPatWwfc7DzJRU04jFUqJODw=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -48,16 +45,18 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs
 github.com/syndtr/goleveldb v1.0.1-0.20220614013038-64ee5596c38a h1:1ur3QoCqvE5fl+nylMaIr9PVV1w343YRDtsy+Rwu7XI=
 github.com/tklauser/go-sysconf v0.3.10 h1:IJ1AZGZRWbY8T5Vfk04D9WOA5WSejdflXxP03OUqALw=
 github.com/tklauser/go-sysconf v0.3.10/go.mod h1:C8XykCvCb+Gn0oNCWPIlcb0RuglQTYaQ2hGm7jmxEFk=
-github.com/tklauser/numcpus v0.4.0 h1:E53Dm1HjH1/R2/aoCtXtPgzmElmn51aOkhCFSuZq//o=
 github.com/tklauser/numcpus v0.4.0/go.mod h1:1+UI3pD8NW14VMwdgJNJ1ESk2UnwhAnz5hMwiKKqXCQ=
+github.com/tklauser/numcpus v0.5.0 h1:ooe7gN0fg6myJ0EKoTAf5hebTZrH52px3New/D9iJ+A=
+github.com/tklauser/numcpus v0.5.0/go.mod h1:OGzpTxpcIMNGYQdit2BYL1pvk/dSOaJWjKoflh+RQjo=
 github.com/urfave/cli v1.22.9 h1:cv3/KhXGBGjEXLC4bH0sLuJ9BewaAbpk5oyMOveu4pw=
 github.com/urfave/cli v1.22.9/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e h1:T8NU3HyQ8ClP4SEE+KbFlg6n0NhuTsN4MyznaarGsZM=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa h1:zuSxTR4o9y82ebqCUJYNGJbGPo6sKVl54f/TVDObg1c=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20221013171732-95e765b1cc43 h1:OK7RB6t2WQX54srQQYSXMW8dF5C6/8+oA/s5QBmmto4=
 golang.org/x/sys v0.0.0-20221013171732-95e765b1cc43/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

packages/contracts-bedrock/.gas-snapshot

@@ -395,3 +395,5 @@ SystemConfig_Setters_TestFail:test_setBatcherHash_notOwner_reverts() (gas: 10545
 SystemConfig_Setters_TestFail:test_setGasConfig_notOwner_reverts() (gas: 10532)
 SystemConfig_Setters_TestFail:test_setGasLimit_notOwner_reverts() (gas: 10636)
 SystemConfig_Setters_TestFail:test_setUnsafeBlockSigner_notOwner_reverts() (gas: 10638)
+TransferOnionTest:test_constructor_succeeds() (gas: 564833)
+TransferOnionTest:test_unwrap_succeeds() (gas: 724936)

packages/contracts-bedrock/contracts/periphery/TransferOnion.sol

+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import { ReentrancyGuard } from "@openzeppelin/contracts/security/ReentrancyGuard.sol";
+import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+
+/**
+ * @title  TransferOnion
+ * @notice TransferOnion is a hash onion for distributing tokens. The shell commits
+ *         to an ordered list of the token transfers and can be permissionlessly
+ *         unwrapped in order. The SENDER must `approve` this contract as
+ *         `transferFrom` is used to move the token balances.
+ */
+contract TransferOnion is ReentrancyGuard {
+    using SafeERC20 for ERC20;
+
+    /**
+     * @notice Struct representing a layer of the onion.
+     */
+    struct Layer {
+        address recipient;
+        uint256 amount;
+        bytes32 shell;
+    }
+
+    /**
+     * @notice Address of the token to distribute.
+     */
+    ERC20 public immutable TOKEN;
+
+    /**
+     * @notice Address of the account to distribute tokens from.
+     */
+    address public immutable SENDER;
+
+    /**
+     * @notice Current shell hash.
+     */
+    bytes32 public shell;
+
+    /**
+     * @param _token  Address of the token to distribute.
+     * @param _sender Address of the sender to distribute from.
+     * @param _shell  Initial shell of the onion.
+     */
+    constructor(
+        ERC20 _token,
+        address _sender,
+        bytes32 _shell
+    ) {
+        TOKEN = _token;
+        SENDER = _sender;
+        shell = _shell;
+    }
+
+    /**
+     * @notice Peels layers from the onion and distributes tokens.
+     *
+     * @param _layers Array of onion layers to peel.
+     */
+    function peel(Layer[] memory _layers) public nonReentrant {
+        bytes32 tempShell = shell;
+        uint256 length = _layers.length;
+        for (uint256 i = 0; i < length; ) {
+            Layer memory layer = _layers[i];
+
+            // Confirm that the onion layer is correct.
+            require(
+                keccak256(abi.encode(layer.recipient, layer.amount, layer.shell)) == tempShell,
+                "TransferOnion: what are you doing in my swamp?"
+            );
+
+            // Update the onion layer.
+            tempShell = layer.shell;
+
+            // Transfer the tokens.
+            TOKEN.safeTransferFrom(SENDER, layer.recipient, layer.amount);
+
+            // Unchecked increment to save some gas.
+            unchecked {
+                ++i;
+            }
+        }
+
+        shell = tempShell;
+    }
+}

packages/contracts-bedrock/contracts/test/TransferOnion.t.sol

+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import { Test } from "forge-std/Test.sol";
+import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import { TransferOnion } from "../periphery/TransferOnion.sol";
+
+/**
+ * @title  TransferOnionTest
+ * @notice Test coverage of TransferOnion
+ */
+contract TransferOnionTest is Test {
+    /**
+     * @notice TransferOnion
+     */
+    TransferOnion internal onion;
+
+    /**
+     * @notice token constructor arg
+     */
+    address internal _token;
+
+    /**
+     * @notice sender constructor arg
+     */
+    address internal _sender;
+
+    /**
+     * @notice Sets up addresses, deploys contracts and funds the owner.
+     */
+    function setUp() public {
+        ERC20 token = new ERC20("Token", "TKN");
+        _token = address(token);
+        _sender = makeAddr("sender");
+    }
+
+    /**
+     * @notice Deploy the TransferOnion with a dummy shell
+     */
+    function _deploy() public {
+        _deploy(bytes32(0));
+    }
+
+    /**
+     * @notice Deploy the TransferOnion with a specific shell
+     */
+    function _deploy(bytes32 _shell) public {
+        onion = new TransferOnion({ _token: ERC20(_token), _sender: _sender, _shell: _shell });
+    }
+
+    /**
+     * @notice Build the onion data
+     */
+    function _onionize(TransferOnion.Layer[] memory _layers)
+        public
+        pure
+        returns (bytes32, TransferOnion.Layer[] memory)
+    {
+        uint256 length = _layers.length;
+        bytes32 hash = bytes32(0);
+        for (uint256 i; i < length; i++) {
+            TransferOnion.Layer memory layer = _layers[i];
+            _layers[i].shell = hash;
+            hash = keccak256(abi.encode(layer.recipient, layer.amount, hash));
+        }
+        return (hash, _layers);
+    }
+
+    /**
+     * @notice The constructor sets the variables as expected
+     */
+    function test_constructor_succeeds() external {
+        _deploy();
+
+        assertEq(address(onion.TOKEN()), _token);
+        assertEq(onion.SENDER(), _sender);
+        assertEq(onion.shell(), bytes32(0));
+    }
+
+    /**
+     * @notice unwrap
+     */
+    function test_unwrap_succeeds() external {
+        // Commit to transferring tiny amounts of tokens
+        TransferOnion.Layer[] memory _layers = new TransferOnion.Layer[](2);
+        _layers[0] = TransferOnion.Layer(address(1), 1, bytes32(0));
+        _layers[1] = TransferOnion.Layer(address(2), 2, bytes32(0));
+
+        // Build the onion shell
+        (bytes32 shell, TransferOnion.Layer[] memory layers) = _onionize(_layers);
+        _deploy(shell);
+
+        assertEq(onion.shell(), shell);
+
+        address token = address(onion.TOKEN());
+        address sender = onion.SENDER();
+
+        // give 3 units of token to sender
+        deal(token, onion.SENDER(), 3);
+        vm.prank(sender);
+        ERC20(token).approve(address(onion), 3);
+
+        // To build the inputs, to `peel`, need to reverse the list
+        TransferOnion.Layer[] memory inputs = new TransferOnion.Layer[](2);
+        int256 length = int256(layers.length);
+        for (int256 i = length - 1; i >= 0; i--) {
+            uint256 ui = uint256(i);
+            uint256 revidx = uint256(length) - ui - 1;
+            TransferOnion.Layer memory layer = layers[ui];
+            inputs[revidx] = layer;
+        }
+
+        // The accounts have no balance
+        assertEq(ERC20(_token).balanceOf(address(1)), 0);
+        assertEq(ERC20(_token).balanceOf(address(2)), 0);
+
+        onion.peel(inputs);
+
+        // Now the accounts have the expected balance
+        assertEq(ERC20(_token).balanceOf(address(1)), 1);
+        assertEq(ERC20(_token).balanceOf(address(2)), 2);
+    }
+}

packages/data-transport-layer/.depcheckrc

 ignores: [
   "@babel/eslint-parser",
+  "@types/level",
   "@typescript-eslint/parser",
   "eslint-plugin-import",
   "eslint-plugin-unicorn",

packages/data-transport-layer/package.json

@@ -52,7 +52,7 @@
     "ethers": "^5.7.0",
     "express": "^4.17.1",
     "express-prom-bundle": "^6.3.6",
-    "level": "^6.0.1",
+    "level6": "npm:level@^6.0.1",
     "levelup": "^4.4.0"
   },
   "devDependencies": {

packages/data-transport-layer/src/services/main/service.ts

 /* Imports: External */
 import { BaseService, LegacyMetrics } from '@eth-optimism/common-ts'
 import { LevelUp } from 'levelup'
-import level from 'level'
+import level from 'level6'
 import { Counter } from 'prom-client'
 
 /* Imports: Internal */

packages/fault-detector/src/helpers.ts

-import { Contract } from 'ethers'
+import { Contract, BigNumber } from 'ethers'
+
+export interface OutputOracle<TSubmissionEventArgs> {
+  contract: Contract
+  filter: any
+  getTotalElements: () => Promise<BigNumber>
+  getEventIndex: (args: TSubmissionEventArgs) => BigNumber
+}
 
 /**
  * Partial event interface, meant to reduce the size of the event cache to avoid
@@ -41,27 +48,32 @@ const getCache = (
 }
 
 /**
- * Updates the event cache for the SCC.
+ * Updates the event cache for a contract and event.
  *
- * @param scc The State Commitment Chain contract.
+ * @param contract Contract to update cache for.
+ * @param filter Event filter to use.
  */
-export const updateStateBatchEventCache = async (
-  scc: Contract
+export const updateOracleCache = async <TSubmissionEventArgs>(
+  oracle: OutputOracle<TSubmissionEventArgs>
 ): Promise<void> => {
-  const cache = getCache(scc.address)
+  const cache = getCache(oracle.contract.address)
   let currentBlock = cache.highestBlock
-  const endingBlock = await scc.provider.getBlockNumber()
+  const endingBlock = await oracle.contract.provider.getBlockNumber()
   let step = endingBlock - currentBlock
   let failures = 0
   while (currentBlock < endingBlock) {
     try {
-      const events = await scc.queryFilter(
-        scc.filters.StateBatchAppended(),
+      const events = await oracle.contract.queryFilter(
+        oracle.filter,
         currentBlock,
         currentBlock + step
       )
+
+      // Throw the events into the cache.
       for (const event of events) {
-        cache.eventCache[event.args._batchIndex.toNumber()] = {
+        cache.eventCache[
+          oracle.getEventIndex(event.args as TSubmissionEventArgs).toNumber()
+        ] = {
           blockNumber: event.blockNumber,
           transactionHash: event.transactionHash,
           args: event.args,
@@ -97,15 +109,15 @@ export const updateStateBatchEventCache = async (
 /**
  * Finds the Event that corresponds to a given state batch by index.
  *
- * @param scc StateCommitmentChain contract.
+ * @param oracle Output oracle contract
  * @param index State batch index to search for.
  * @returns Event corresponding to the batch.
  */
-export const findEventForStateBatch = async (
-  scc: Contract,
+export const findEventForStateBatch = async <TSubmissionEventArgs>(
+  oracle: OutputOracle<TSubmissionEventArgs>,
   index: number
 ): Promise<PartialEvent> => {
-  const cache = getCache(scc.address)
+  const cache = getCache(oracle.contract.address)
 
   // Try to find the event in cache first.
   if (cache.eventCache[index]) {
@@ -113,7 +125,7 @@ export const findEventForStateBatch = async (
   }
 
   // Update the event cache if we don't have the event.
-  await updateStateBatchEventCache(scc)
+  await updateOracleCache(oracle)
 
   // Event better be in cache now!
   if (cache.eventCache[index] === undefined) {
@@ -126,23 +138,23 @@ export const findEventForStateBatch = async (
 /**
  * Finds the first state batch index that has not yet passed the fault proof window.
  *
- * @param scc StateCommitmentChain contract.
+ * @param oracle Output oracle contract.
  * @returns Starting state root batch index.
  */
-export const findFirstUnfinalizedStateBatchIndex = async (
-  scc: Contract
+export const findFirstUnfinalizedStateBatchIndex = async <TSubmissionEventArgs>(
+  oracle: OutputOracle<TSubmissionEventArgs>,
+  fpw: number
 ): Promise<number> => {
-  const fpw = (await scc.FRAUD_PROOF_WINDOW()).toNumber()
-  const latestBlock = await scc.provider.getBlock('latest')
-  const totalBatches = (await scc.getTotalBatches()).toNumber()
+  const latestBlock = await oracle.contract.provider.getBlock('latest')
+  const totalBatches = (await oracle.getTotalElements()).toNumber()
 
   // Perform a binary search to find the next batch that will pass the challenge period.
   let lo = 0
   let hi = totalBatches
   while (lo !== hi) {
     const mid = Math.floor((lo + hi) / 2)
-    const event = await findEventForStateBatch(scc, mid)
-    const block = await scc.provider.getBlock(event.blockNumber)
+    const event = await findEventForStateBatch(oracle, mid)
+    const block = await oracle.contract.provider.getBlock(event.blockNumber)
 
     if (block.timestamp + fpw < latestBlock.timestamp) {
       lo = mid + 1

packages/fault-detector/src/service.ts

@@ -9,21 +9,23 @@ import {
 import { getChainId, sleep, toRpcHexString } from '@eth-optimism/core-utils'
 import { CrossChainMessenger } from '@eth-optimism/sdk'
 import { Provider } from '@ethersproject/abstract-provider'
-import { Contract, ethers, Transaction } from 'ethers'
+import { ethers, Transaction } from 'ethers'
 import dateformat from 'dateformat'
 
 import { version } from '../package.json'
 import {
   findFirstUnfinalizedStateBatchIndex,
   findEventForStateBatch,
-  updateStateBatchEventCache,
   PartialEvent,
+  OutputOracle,
+  updateOracleCache,
 } from './helpers'
 
 type Options = {
   l1RpcProvider: Provider
   l2RpcProvider: Provider
   startBatchIndex: number
+  bedrock: boolean
 }
 
 type Metrics = {
@@ -34,7 +36,7 @@ type Metrics = {
 
 type State = {
   fpw: number
-  scc: Contract
+  oo: OutputOracle<any>
   messenger: CrossChainMessenger
   highestCheckedBatchIndex: number
   diverged: boolean
@@ -65,6 +67,12 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
           desc: 'Batch index to start checking from',
           public: true,
         },
+        bedrock: {
+          validator: validators.bool,
+          default: false,
+          desc: 'Whether or not the service is running against a Bedrock chain',
+          public: true,
+        },
       },
       metricsSpec: {
         highestBatchIndex: {
@@ -103,24 +111,42 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
       l2SignerOrProvider: this.options.l2RpcProvider,
       l1ChainId: await getChainId(this.options.l1RpcProvider),
       l2ChainId: await getChainId(this.options.l2RpcProvider),
+      bedrock: this.options.bedrock,
     })
 
     // Not diverged by default.
     this.state.diverged = false
 
     // We use this a lot, a bit cleaner to pull out to the top level of the state object.
-    this.state.scc = this.state.messenger.contracts.l1.StateCommitmentChain
-    this.state.fpw = (await this.state.scc.FRAUD_PROOF_WINDOW()).toNumber()
+    this.state.fpw = await this.state.messenger.getChallengePeriodSeconds()
+    if (this.options.bedrock) {
+      const oo = this.state.messenger.contracts.l1.L2OutputOracle
+      this.state.oo = {
+        contract: oo,
+        filter: oo.filters.OutputProposed(),
+        getTotalElements: async () => oo.latestOutputIndex(),
+        getEventIndex: (args) => args.l2OutputIndex,
+      }
+    } else {
+      const oo = this.state.messenger.contracts.l1.StateCommitmentChain
+      this.state.oo = {
+        contract: oo,
+        filter: oo.filters.StateBatchAppended(),
+        getTotalElements: async () => oo.getTotalBatches(),
+        getEventIndex: (args) => args._batchIndex,
+      }
+    }
 
     // Populate the event cache.
     this.logger.info(`warming event cache, this might take a while...`)
-    await updateStateBatchEventCache(this.state.scc)
+    await updateOracleCache(this.state.oo)
 
     // Figure out where to start syncing from.
     if (this.options.startBatchIndex === -1) {
       this.logger.info(`finding appropriate starting height`)
       const firstUnfinalized = await findFirstUnfinalizedStateBatchIndex(
-        this.state.scc
+        this.state.oo,
+        this.state.fpw
       )
 
       // We may not have an unfinalized batches in the case where no batches have been submitted
@@ -129,7 +155,7 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
       if (firstUnfinalized === undefined) {
         this.logger.info(`no unfinalized batches found, starting from latest`)
         this.state.highestCheckedBatchIndex = (
-          await this.state.scc.getTotalBatches()
+          await this.state.oo.getTotalElements()
         ).toNumber()
       } else {
         this.state.highestCheckedBatchIndex = firstUnfinalized
@@ -141,6 +167,14 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
     this.logger.info(`starting height`, {
       startBatchIndex: this.state.highestCheckedBatchIndex,
     })
+
+    // Set the initial metrics.
+    this.metrics.highestBatchIndex.set(
+      {
+        type: 'checked',
+      },
+      this.state.highestCheckedBatchIndex
+    )
   }
 
   async routes(router: ExpressRouter): Promise<void> {
@@ -154,7 +188,7 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
   async main(): Promise<void> {
     let latestBatchIndex: number
     try {
-      latestBatchIndex = (await this.state.scc.getTotalBatches()).toNumber()
+      latestBatchIndex = (await this.state.oo.getTotalElements()).toNumber()
     } catch (err) {
       this.logger.error(`got error when connecting to node`, {
         error: err,
@@ -189,7 +223,7 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
     let event: PartialEvent
     try {
       event = await findEventForStateBatch(
-        this.state.scc,
+        this.state.oo,
         this.state.highestCheckedBatchIndex
       )
     } catch (err) {
@@ -206,34 +240,6 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
       return
     }
 
-    let batchTransaction: Transaction
-    try {
-      batchTransaction = await this.options.l1RpcProvider.getTransaction(
-        event.transactionHash
-      )
-    } catch (err) {
-      this.logger.error(`got error when connecting to node`, {
-        error: err,
-        node: 'l1',
-        section: 'getTransaction',
-      })
-      this.metrics.nodeConnectionFailures.inc({
-        layer: 'l1',
-        section: 'getTransaction',
-      })
-      await sleep(15000)
-      return
-    }
-
-    const [stateRoots] = this.state.scc.interface.decodeFunctionData(
-      'appendStateBatch',
-      batchTransaction.data
-    )
-
-    const batchStart = event.args._prevTotalElements.toNumber() + 1
-    const batchSize = event.args._batchSize.toNumber()
-    const batchEnd = batchStart + batchSize
-
     let latestBlock: number
     try {
       latestBlock = await this.options.l2RpcProvider.getBlockNumber()
@@ -251,55 +257,80 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
       return
     }
 
-    if (latestBlock < batchEnd) {
-      this.logger.info(`node is behind, waiting for sync`, {
-        batchEnd,
-        latestBlock,
-      })
-      return
-    }
+    if (this.options.bedrock) {
+      if (latestBlock < event.args.l2BlockNumber.toNumber()) {
+        this.logger.info(`node is behind, waiting for sync`, {
+          batchEnd: event.args.l2BlockNumber.toNumber(),
+          latestBlock,
+        })
+        return
+      }
 
-    // `getBlockRange` has a limit of 1000 blocks, so we have to break this request out into
-    // multiple requests of maximum 1000 blocks in the case that batchSize > 1000.
-    let blocks: any[] = []
-    for (let i = 0; i < batchSize; i += 1000) {
-      let newBlocks: any[]
+      let targetBlock: any
       try {
-        newBlocks = await (
+        targetBlock = await (
           this.options.l2RpcProvider as ethers.providers.JsonRpcProvider
-        ).send('eth_getBlockRange', [
-          toRpcHexString(batchStart + i),
-          toRpcHexString(batchStart + i + Math.min(batchSize - i, 1000) - 1),
+        ).send('eth_getBlockByNumber', [
+          toRpcHexString(event.args.l2BlockNumber.toNumber()),
           false,
         ])
       } catch (err) {
         this.logger.error(`got error when connecting to node`, {
           error: err,
           node: 'l2',
-          section: 'getBlockRange',
+          section: 'getBlock',
         })
         this.metrics.nodeConnectionFailures.inc({
           layer: 'l2',
-          section: 'getBlockRange',
+          section: 'getBlock',
         })
         await sleep(15000)
         return
       }
 
-      blocks = blocks.concat(newBlocks)
-    }
+      let messagePasserProofResponse: any
+      try {
+        messagePasserProofResponse = await (
+          this.options.l2RpcProvider as ethers.providers.JsonRpcProvider
+        ).send('eth_getProof', [
+          this.state.messenger.contracts.l2.BedrockMessagePasser.address,
+          [],
+          toRpcHexString(event.args.l2BlockNumber.toNumber()),
+        ])
+      } catch (err) {
+        this.logger.error(`got error when connecting to node`, {
+          error: err,
+          node: 'l2',
+          section: 'getProof',
+        })
+        this.metrics.nodeConnectionFailures.inc({
+          layer: 'l2',
+          section: 'getProof',
+        })
+        await sleep(15000)
+        return
+      }
+
+      const outputRoot = ethers.utils.solidityKeccak256(
+        ['uint256', 'bytes32', 'bytes32', 'bytes32'],
+        [
+          0,
+          targetBlock.stateRoot,
+          messagePasserProofResponse.storageHash,
+          targetBlock.hash,
+        ]
+      )
 
-    for (const [i, stateRoot] of stateRoots.entries()) {
-      if (blocks[i].stateRoot !== stateRoot) {
+      if (outputRoot !== event.args.outputRoot) {
         this.state.diverged = true
         this.metrics.isCurrentlyMismatched.set(1)
         this.logger.error(`state root mismatch`, {
-          blockNumber: blocks[i].number,
-          expectedStateRoot: blocks[i].stateRoot,
-          actualStateRoot: stateRoot,
+          blockNumber: targetBlock.number,
+          expectedStateRoot: event.args.outputRoot,
+          actualStateRoot: outputRoot,
           finalizationTime: dateformat(
             new Date(
-              (ethers.BigNumber.from(blocks[i].timestamp).toNumber() +
+              (ethers.BigNumber.from(targetBlock.timestamp).toNumber() +
                 this.state.fpw) *
                 1000
             ),
@@ -308,8 +339,99 @@ export class FaultDetector extends BaseServiceV2<Options, Metrics, State> {
         })
         return
       }
+    } else {
+      let batchTransaction: Transaction
+      try {
+        batchTransaction = await this.options.l1RpcProvider.getTransaction(
+          event.transactionHash
+        )
+      } catch (err) {
+        this.logger.error(`got error when connecting to node`, {
+          error: err,
+          node: 'l1',
+          section: 'getTransaction',
+        })
+        this.metrics.nodeConnectionFailures.inc({
+          layer: 'l1',
+          section: 'getTransaction',
+        })
+        await sleep(15000)
+        return
+      }
+
+      const [stateRoots] = this.state.oo.contract.interface.decodeFunctionData(
+        'appendStateBatch',
+        batchTransaction.data
+      )
+
+      const batchStart = event.args._prevTotalElements.toNumber() + 1
+      const batchSize = event.args._batchSize.toNumber()
+      const batchEnd = batchStart + batchSize
+
+      if (latestBlock < batchEnd) {
+        this.logger.info(`node is behind, waiting for sync`, {
+          batchEnd,
+          latestBlock,
+        })
+        return
+      }
+
+      // `getBlockRange` has a limit of 1000 blocks, so we have to break this request out into
+      // multiple requests of maximum 1000 blocks in the case that batchSize > 1000.
+      let blocks: any[] = []
+      for (let i = 0; i < batchSize; i += 1000) {
+        let newBlocks: any[]
+        try {
+          newBlocks = await (
+            this.options.l2RpcProvider as ethers.providers.JsonRpcProvider
+          ).send('eth_getBlockRange', [
+            toRpcHexString(batchStart + i),
+            toRpcHexString(batchStart + i + Math.min(batchSize - i, 1000) - 1),
+            false,
+          ])
+        } catch (err) {
+          this.logger.error(`got error when connecting to node`, {
+            error: err,
+            node: 'l2',
+            section: 'getBlockRange',
+          })
+          this.metrics.nodeConnectionFailures.inc({
+            layer: 'l2',
+            section: 'getBlockRange',
+          })
+          await sleep(15000)
+          return
+        }
+
+        blocks = blocks.concat(newBlocks)
+      }
+
+      for (const [i, stateRoot] of stateRoots.entries()) {
+        if (blocks[i].stateRoot !== stateRoot) {
+          this.state.diverged = true
+          this.metrics.isCurrentlyMismatched.set(1)
+          this.logger.error(`state root mismatch`, {
+            blockNumber: blocks[i].number,
+            expectedStateRoot: blocks[i].stateRoot,
+            actualStateRoot: stateRoot,
+            finalizationTime: dateformat(
+              new Date(
+                (ethers.BigNumber.from(blocks[i].timestamp).toNumber() +
+                  this.state.fpw) *
+                  1000
+              ),
+              'mmmm dS, yyyy, h:MM:ss TT'
+            ),
+          })
+          return
+        }
+      }
     }
 
+    this.logger.info(`checked batch ok`, {
+      batchIndex: this.state.highestCheckedBatchIndex,
+    })
+
     this.state.highestCheckedBatchIndex++
     this.metrics.highestBatchIndex.set(
       {

packages/fault-detector/test/helpers.spec.ts

@@ -12,6 +12,7 @@ import { expect } from './setup'
 import {
   findEventForStateBatch,
   findFirstUnfinalizedStateBatchIndex,
+  OutputOracle,
 } from '../src'
 
 describe('helpers', () => {
@@ -28,6 +29,7 @@ describe('helpers', () => {
   let AddressManager: Contract
   let ChainStorageContainer: Contract
   let StateCommitmentChain: Contract
+  let oracle: OutputOracle<any>
   beforeEach(async () => {
     // Set up fakes
     FakeBondManager = await smock.fake(getContractInterface('BondManager'))
@@ -67,6 +69,13 @@ describe('helpers', () => {
     // Set up mock returns
     FakeCanonicalTransactionChain.getTotalElements.returns(1000000000) // just needs to be large
     FakeBondManager.isCollateralized.returns(true)
+
+    oracle = {
+      contract: StateCommitmentChain,
+      filter: StateCommitmentChain.filters.StateBatchAppended(),
+      getTotalElements: async () => StateCommitmentChain.getTotalBatches(),
+      getEventIndex: (args: any) => args._batchIndex,
+    }
   })
 
   describe('findEventForStateBatch', () => {
@@ -79,7 +88,7 @@ describe('helpers', () => {
       })
 
       it('should return the event', async () => {
-        const event = await findEventForStateBatch(StateCommitmentChain, 0)
+        const event = await findEventForStateBatch(oracle, 0)
 
         expect(event.args._batchIndex).to.equal(0)
       })
@@ -88,7 +97,7 @@ describe('helpers', () => {
     describe('when the event does not exist', () => {
       it('should throw an error', async () => {
         await expect(
-          findEventForStateBatch(StateCommitmentChain, 0)
+          findEventForStateBatch(oracle, 0)
         ).to.eventually.be.rejectedWith('unable to find event for batch')
       })
     })
@@ -119,7 +128,8 @@ describe('helpers', () => {
 
       it('should find the first batch older than the FPW', async () => {
         const first = await findFirstUnfinalizedStateBatchIndex(
-          StateCommitmentChain
+          oracle,
+          challengeWindowSeconds
         )
 
         expect(first).to.equal(1)
@@ -144,7 +154,8 @@ describe('helpers', () => {
 
       it('should return zero', async () => {
         const first = await findFirstUnfinalizedStateBatchIndex(
-          StateCommitmentChain
+          oracle,
+          challengeWindowSeconds
         )
 
         expect(first).to.equal(0)
@@ -177,7 +188,8 @@ describe('helpers', () => {
 
       it('should return undefined', async () => {
         const first = await findFirstUnfinalizedStateBatchIndex(
-          StateCommitmentChain
+          oracle,
+          challengeWindowSeconds
         )
 
         expect(first).to.equal(undefined)

specs/withdrawals.md

@@ -133,8 +133,8 @@ The Optimism Portal serves as both the entry and exit point to the Optimism L2.
 the [DepositFeed](./deposits.md#deposit-contract) contract, and in addition provides the following interface for
 withdrawals:
 
-- [`WithdrawalTransaction` type](https://github.com/ethereum-optimism/optimism/blob/6c6d142d7bb95faa11066aab5d8aed7187abfe38/packages/contracts-bedrock/contracts/libraries/Types.sol#L76-L83)
-- [`OutputRootProof` type](https://github.com/ethereum-optimism/optimism/blob/6c6d142d7bb95faa11066aab5d8aed7187abfe38/packages/contracts-bedrock/contracts/libraries/Types.sol#L33-L38)
+- [`WithdrawalTransaction` type]
+- [`OutputRootProof` type]
 
 ```js
 interface OptimismPortal {
@@ -217,3 +217,6 @@ contracts if desired.
 | `FINALIZATION_PERIOD` | `604_800` | seconds |
 
 This `FINALIZATION_PERIOD` value is equivalent to 7 days.
+
+[`WithdrawalTransaction` type]: https://github.com/ethereum-optimism/optimism/blob/6c6d142d7bb95faa11066aab5d8aed7187abfe38/packages/contracts-bedrock/contracts/libraries/Types.sol#L76-L83
+[`OutputRootProof` type]: https://github.com/ethereum-optimism/optimism/blob/6c6d142d7bb95faa11066aab5d8aed7187abfe38/packages/contracts-bedrock/contracts/libraries/Types.sol#L33-L38

yarn.lock

@@ -12090,7 +12090,7 @@ level-ws@^2.0.0:
     readable-stream "^3.1.0"
     xtend "^4.0.1"
 
-level@^6.0.1:
+"level6@npm:level@^6.0.1":
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/level/-/level-6.0.1.tgz#dc34c5edb81846a6de5079eac15706334b0d7cd6"
   integrity sha512-psRSqJZCsC/irNhfHzrVZbmPYXDcEYhA5TVNwr+V92jF44rbf86hqGp8fiT702FyiArScYIlPSBTDUASCVNSpw==