Skip to content

support optional dev environment multiproof contracts (TEE bypass) in… #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robriks merged 3 commits into from
Jun 15, 2026
+101 −24
Merged

support optional dev environment multiproof contracts (TEE bypass) in… #341

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
69b49d2
support optional dev environment multiproof contracts (TEE bypass) in…
robriks Jun 15, 2026
e93f110
use _isDevMultiproof
robriks Jun 15, 2026
8b9750d
add a config for an initial dev TEE signer
robriks Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deploy-config/local-tee.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
"l2OutputOracleStartingBlockNumber": 1,
"l2OutputOracleStartingTimestamp": 1,
"multiproofBlockInterval": 100,
"multiproofConfigHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
"multiproofConfigHash": "0x0000000000000000000000000000000000000000000000000000000000000001",
"multiproofGameType": 621,
"multiproofGenesisBlockNumber": 0,
"multiproofIntermediateBlockInterval": 10,
Expand Down
48 changes: 34 additions & 14 deletions scripts/deploy/SystemDeploy.s.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,8 @@ import { TEEVerifier } from "src/L1/proofs/tee/TEEVerifier.sol";
import { INitroEnclaveVerifier } from "interfaces/L1/proofs/tee/INitroEnclaveVerifier.sol";
import { ISP1Verifier } from "interfaces/L1/proofs/zk/ISP1Verifier.sol";
import { ZKVerifier } from "src/L1/proofs/zk/ZKVerifier.sol";
import { DevTEEProverRegistry } from "test/mocks/MockDevTEEProverRegistry.sol";
import { MockVerifier } from "test/mocks/MockVerifier.sol";
import { Constants } from "src/libraries/Constants.sol";
import { SemverComp } from "src/libraries/SemverComp.sol";
import { GameType, GameTypes, Hash, Proposal } from "src/libraries/bridge/Types.sol";
Expand Down Expand Up @@ -966,9 +968,14 @@ contract SystemDeploy is Script {
GameType gameType = GameType.wrap(uint32(_input.multiproofGameType));

vm.broadcast(msg.sender);
output_.teeProverRegistryImpl = new TEEProverRegistry(
INitroEnclaveVerifier(_input.nitroEnclaveVerifier), _output.disputeGameFactoryProxy
);
if (_isDevMultiproof(_input)) {
output_.teeProverRegistryImpl =
new DevTEEProverRegistry(INitroEnclaveVerifier(address(0)), _output.disputeGameFactoryProxy);
} else {
output_.teeProverRegistryImpl = new TEEProverRegistry(
INitroEnclaveVerifier(_input.nitroEnclaveVerifier), _output.disputeGameFactoryProxy
);
}

output_.teeProverRegistryProxy =
TEEProverRegistry(_deployProxy(_opChainInput, _output.opChainProxyAdmin, "TEEProverRegistry"));
Expand All @@ -990,17 +997,24 @@ contract SystemDeploy is Script {
)
);

INitroEnclaveVerifier nitroVerifier = INitroEnclaveVerifier(_input.nitroEnclaveVerifier);
if (nitroVerifier.proofSubmitter() != address(output_.teeProverRegistryProxy)) {
vm.broadcast(msg.sender);
nitroVerifier.setProofSubmitter(address(output_.teeProverRegistryProxy));
if (!_isDevMultiproof(_input)) {
INitroEnclaveVerifier nitroVerifier = INitroEnclaveVerifier(_input.nitroEnclaveVerifier);
if (nitroVerifier.proofSubmitter() != address(output_.teeProverRegistryProxy)) {
vm.broadcast(msg.sender);
nitroVerifier.setProofSubmitter(address(output_.teeProverRegistryProxy));
}
}

vm.broadcast(msg.sender);
output_.teeVerifier =
IVerifier(address(new TEEVerifier(output_.teeProverRegistryProxy, _output.anchorStateRegistryProxy)));
vm.broadcast(msg.sender);
output_.zkVerifier = IVerifier(address(new ZKVerifier(_input.sp1Verifier, _output.anchorStateRegistryProxy)));
if (_isDevMultiproof(_input)) {
output_.zkVerifier = IVerifier(address(new MockVerifier(_output.anchorStateRegistryProxy)));
} else {
output_.zkVerifier =
IVerifier(address(new ZKVerifier(_input.sp1Verifier, _output.anchorStateRegistryProxy)));
}

output_.aggregateVerifier = _newAggregateVerifier(
AggregateVerifierInput({
Expand Down Expand Up @@ -1084,16 +1098,14 @@ contract SystemDeploy is Script {
return _input.multiproofConfigHash != bytes32(0);
}

function _isDevMultiproof(ImplementationInput memory _input) internal pure returns (bool) {
Comment thread
robriks marked this conversation as resolved.
return _multiproofEnabled(_input) && _input.nitroEnclaveVerifier == address(0);
}

function _assertValidMultiproofInput(ImplementationInput memory _input) internal view {
require(_input.teeImageHash != bytes32(0), "SystemDeploy: teeImageHash not set");
require(_input.zkRangeHash != bytes32(0), "SystemDeploy: zkRangeHash not set");
require(_input.zkAggregationHash != bytes32(0), "SystemDeploy: zkAggregationHash not set");
require(_input.multiproofConfigHash != bytes32(0), "SystemDeploy: multiproofConfigHash not set");
require(_input.multiproofGameType != 0, "SystemDeploy: multiproofGameType not set");
require(_input.nitroEnclaveVerifier != address(0), "SystemDeploy: nitroEnclaveVerifier not set");
require(address(_input.sp1Verifier) != address(0), "SystemDeploy: sp1Verifier not set");
DeployUtils.assertValidContractAddress(_input.nitroEnclaveVerifier);
DeployUtils.assertValidContractAddress(address(_input.sp1Verifier));
require(_input.multiproofBlockInterval != 0, "SystemDeploy: multiproof block interval not set");
require(
_input.multiproofIntermediateBlockInterval != 0, "SystemDeploy: multiproof intermediate interval not set"
Expand All @@ -1104,6 +1116,14 @@ contract SystemDeploy is Script {
);
require(_input.teeProposer != address(0), "SystemDeploy: teeProposer not set");
require(_input.teeChallenger != address(0), "SystemDeploy: teeChallenger not set");

if (!_isDevMultiproof(_input)) {
require(_input.zkRangeHash != bytes32(0), "SystemDeploy: zkRangeHash not set");
require(_input.zkAggregationHash != bytes32(0), "SystemDeploy: zkAggregationHash not set");
require(address(_input.sp1Verifier) != address(0), "SystemDeploy: sp1Verifier not set");
DeployUtils.assertValidContractAddress(_input.nitroEnclaveVerifier);
DeployUtils.assertValidContractAddress(address(_input.sp1Verifier));
}
}

function _assertValidImplementations(Types.Implementations memory _impls) internal view {
Expand Down
66 changes: 56 additions & 10 deletions test/deploy/SystemDeploy.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,12 @@ import { SystemDeploy } from "scripts/deploy/SystemDeploy.s.sol";
import { Types } from "scripts/libraries/Types.sol";
import { SystemDeployAssertions } from "test/deploy/SystemDeployAssertions.sol";

import { IAggregateVerifier } from "interfaces/L1/proofs/IAggregateVerifier.sol";
import { IDelayedWETH } from "interfaces/L1/proofs/IDelayedWETH.sol";
import { IDisputeGame } from "interfaces/L1/proofs/IDisputeGame.sol";
import { IDisputeGameFactory } from "interfaces/L1/proofs/IDisputeGameFactory.sol";
import { ISP1Verifier } from "interfaces/L1/proofs/zk/ISP1Verifier.sol";
import { DevTEEProverRegistry } from "test/mocks/MockDevTEEProverRegistry.sol";
import { TEEProverRegistry } from "src/L1/proofs/tee/TEEProverRegistry.sol";
import { TEEVerifier } from "src/L1/proofs/tee/TEEVerifier.sol";
import { ZKVerifier } from "src/L1/proofs/zk/ZKVerifier.sol";
Expand Down Expand Up @@ -175,6 +180,43 @@ contract SystemDeploy_Test is Test, SystemDeployAssertions {
_assertMultiproofDeployed(reuseOutput, input);
}

function test_deploy_devMultiproof_succeeds() public {
SystemDeploy.DeployInput memory input = _defaultDeployInput();
input.implementationsInput.nitroEnclaveVerifier = address(0);
input.implementationsInput.sp1Verifier = ISP1Verifier(address(0));
input.implementationsInput.zkRangeHash = bytes32(0);
input.implementationsInput.zkAggregationHash = bytes32(0);
input.implementationsInput.proofMaturityDelaySeconds = 0;
input.implementationsInput.withdrawalDelaySeconds = 0;
input.implementationsInput.disputeGameFinalityDelaySeconds = 0;
input.implementationsInput.slowFinalizationDelay = 0;
input.implementationsInput.fastFinalizationDelay = 0;

SystemDeploy.DeployOutput memory output = systemDeploy.deploy(input);

_assertMultiproofDeployed(output, input);

address teeProverRegistryProxyAddr = address(output.opChain.teeProverRegistryProxy);
DevTEEProverRegistry devRegistry = DevTEEProverRegistry(teeProverRegistryProxyAddr);
vm.prank(owner);
devRegistry.addDevSigner(makeAddr("devSigner"), bytes32(uint256(1)));
assertTrue(devRegistry.isRegisteredSigner(makeAddr("devSigner")), "dev signer registered");

IAggregateVerifier aggVerifier = IAggregateVerifier(address(output.opChain.aggregateVerifier));
assertEq(
address(aggVerifier.DELAYED_WETH()),
address(output.opChain.delayedWETHProxy),
"aggregate verifier uses real DelayedWETH"
);

assertEq(address(output.opChain.nitroEnclaveVerifier), address(0), "no nitro verifier in dev mode");
assertEq(address(output.opChain.sp1Verifier), address(0), "no sp1 verifier in dev mode");

IDisputeGameFactory factory = IDisputeGameFactory(address(output.opChain.disputeGameFactoryProxy));
GameType gameType = GameType.wrap(uint32(input.implementationsInput.multiproofGameType));
assertNotEq(address(factory.gameImpls(gameType)), address(0), "game type registered on factory");
}

function _defaultDeployInput() internal view returns (SystemDeploy.DeployInput memory input_) {
input_.saveArtifacts = false;
input_.superchainInput = SystemDeploy.SuperchainInput({
Expand Down Expand Up @@ -250,11 +292,13 @@ contract SystemDeploy_Test is Test, SystemDeployAssertions {
assertEq(teeProverRegistry.manager(), _input.opChainInput.roles.opChainProxyAdminOwner, "tee registry manager");
assertTrue(teeProverRegistry.isValidProposer(_input.implementationsInput.teeProposer), "tee proposer");
assertTrue(teeProverRegistry.isValidProposer(_input.implementationsInput.teeChallenger), "tee challenger");
assertEq(
MockNitroEnclaveVerifier(_input.implementationsInput.nitroEnclaveVerifier).proofSubmitter(),
teeProverRegistryProxyAddr,
"nitro proof submitter"
);
if (_input.implementationsInput.nitroEnclaveVerifier != address(0)) {
assertEq(
MockNitroEnclaveVerifier(_input.implementationsInput.nitroEnclaveVerifier).proofSubmitter(),
teeProverRegistryProxyAddr,
"nitro proof submitter"
);
}
assertEq(
address(teeProverRegistry.DISPUTE_GAME_FACTORY()),
address(_output.opChain.disputeGameFactoryProxy),
Expand All @@ -266,11 +310,13 @@ contract SystemDeploy_Test is Test, SystemDeployAssertions {
teeProverRegistryProxyAddr,
"tee verifier registry"
);
assertEq(
address(ZKVerifier(zkVerifierAddr).SP1_VERIFIER()),
address(_input.implementationsInput.sp1Verifier),
"zk verifier sp1"
);
if (address(_input.implementationsInput.sp1Verifier) != address(0)) {
assertEq(
address(ZKVerifier(zkVerifierAddr).SP1_VERIFIER()),
address(_input.implementationsInput.sp1Verifier),
"zk verifier sp1"
);
}
}

function _expected(
Expand Down
Loading