Espresso 1: Contracts by QuentinI · Pull Request #443 · celo-org/optimism

QuentinI · 2026-05-07T23:06:43Z

This PR pulls in the BatchAuthenticator part of Espresso integration at packages/contracts-bedrock/src/L1/BatchAuthenticator.sol. All other changes are deployment scripts, tests, and other wiring.

BatchAuthenticator is the contract that the batchers will have to authenticate their batches with; corresponding changes for the derivation pipeline and batchers forthcoming as subsequent PRs.

Adds the Espresso-introduced contracts and the minimum supporting changes required for them to compile, test, and pass the contract checks. New contracts and scripts: - src/L1/BatchAuthenticator.sol and interfaces/L1/IBatchAuthenticator.sol (upgradeable contract that authenticates batch transactions, with switching between Espresso and fallback batchers) - scripts/deploy/DeployBatchAuthenticator.s.sol and scripts/deploy/DeployEspresso.s.sol - test/L1/BatchAuthenticator.t.sol and test/mocks/MockEspressoTEEVerifiers.sol - snapshots/{abi,storageLayout}/BatchAuthenticator.json - snapshots/semver-lock.json entry for BatchAuthenticator New submodules: - lib/espresso-tee-contracts (interfaces required by BatchAuthenticator) - lib/openzeppelin-contracts-upgradeable-v5 (OZ v5 used by BatchAuthenticator via OwnableUpgradeable) Supporting changes (Espresso-driven): - foundry.toml: remappings for OZ v5 and espresso-tee-contracts; ignored warning codes for vendored libs; OOM-safe jobs settings; via-ir profile. - justfile: fix-proxy-artifact recipe to handle OZ v5 shadowing Proxy/ProxyAdmin artifacts; build/coverage hooks. - src/universal/Proxy.sol, src/universal/ProxyAdmin.sol: pin pragma to exact 0.8.15 so they stay in their own compilation group and never emit PUSH0. - src/universal/ReinitializableBase.sol: loosen pragma to ^0.8.15 so BatchAuthenticator (compiled with OZ v5) can import it. - scripts/* and test/*: disambiguate Proxy artifact lookups to src/universal/Proxy.sol:Proxy (avoids OZ v5 proxy/Proxy.sol shadow). - scripts/checks: bypass interface checks for artifacts originating from lib/; add Espresso-related contract names to exclude lists; pragma exclusions for Proxy/ProxyAdmin/BatchAuthenticator. - test/vendor/Initializable.t.sol: exclude BatchAuthenticator (deployed by a separate Espresso script). Co-authored-by: OpenCode <noreply@opencode.ai>

jcortejoso · 2026-05-11T14:12:46Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee2d984108

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

piersy · 2026-05-12T15:23:51Z

+        vm.prank(proxyAdminOwner);
+        authenticator.switchBatcher();
+        assertFalse(authenticator.activeIsEspresso());
+    }


The tests currently seem to be missing tests of batch authentication behaviour when running in fallback mode and also a test of authentication behaviour when in fallback and paused.

I've added two tests which I think covers these cases in this commit 5d0a803

Co-authored-by: piersy <pierspowlesland@gmail.com>

Mc01 · 2026-05-20T09:00:27Z

@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.25;


I would recommend to double check versioning in each file for consistency.

OP source contracts follow 0.8.15, but files like BatchAuthenticator.sol & contracts in espresso-tee-contracts follow ^0.8.0 (which is fine I guess).

OP scripts usually follow ^0.8.0, but here scripts follow 0.8.25 - could you tell more about the motivation for it?

Relaxed to ^0.8.0 - I don't remember any specific reason for us doing this, going to assume there wasn't one since nothing seems to break doing this.

Mc01 · 2026-05-20T09:38:35Z

+            address payable _addr;
+            assembly { _addr := create(0, add(_initCode, 0x20), mload(_initCode)) }
+            require(_addr != address(0), "DeployBatchAuthenticator: ProxyAdmin deployment failed");
+            proxyAdmin = IProxyAdmin(_addr);


Should separate ProxyAdmin be deployed just for BatchAuthenticator or would it be possible to re-use existing ProxyAdmin from our OP Stack deployment?

I don't think there's a technical reason
cc @shenkeyao is there a governance reason for this?

I think technically we can reuse the existing ProxyAdmin, but that would require the OP stack to participate in every future batchAuthenticator upgrade, which is an undesirable governance dependency. Looks like this was introduced in this commit, so cc @jjeangal, who might have more context.

Mc01 · 2026-05-20T09:45:55Z

+        checkOutput(_output);
+    }
+
+    function deployBatchAuthenticator(


I see this is the second place that can deploy BatchAuthenticator, so the same question: should separate ProxyAdmin be freshly deployed just for this contract? Or is it possible to use already deployed ProxyAdmin for Celo's OP Stack?

palango · 2026-05-20T10:37:01Z

+	// Upstream OP stack contracts that intentionally use ^ for broad compatibility.
+	"src/universal/Proxy.sol",
+	"src/universal/ProxyAdmin.sol",


This looks unnecessary, as these files use strict pragmas already:

// SPDX-License-Identifier: MIT pragma solidity 0.8.15;

Removed in 452a1cb

palango · 2026-05-20T10:40:27Z

+optimizer_runs = 200
+use_literal_content = false


Why do you set these? To match some verification settings?

Oh, there was some verification changes we did in our fork that I dropped for this PR, didn't catch this. Fixed

palango · 2026-05-20T10:49:31Z

 	// Generic interfaces
 	"IHasSuperchainConfig",

+	// Espresso dependencies


nit: It would be good to move this to the Celo contracts sections, to remove future rebase conflicts.

Done in 452a1cb

palango · 2026-05-20T13:41:35Z

 		return nil, []error{fmt.Errorf("%s: Interface does not start with 'I'", contractName)}
 	}

+	// Espresso: skip interface artifacts that originate from lib/ (e.g. OZ v5 interfaces


I'm not the biggest fan of all this artifact handling.

I think there's a way around it: 0322873

Let me know what you think.

This makes sense to me
cc @shenkeyao I think you have more context here

Makes sense to cherry-pick 0322873! This would help clean up many artifact-related changes.

However, the lib/ skip in this file would still be necessary, because OZ v5 interfaces compiled transitively from espresso-tee-contracts would still land in forge-artifacts/.

palango · 2026-05-20T14:28:38Z

+        address _owner
+    )
+        external
+        reinitializer(initVersion())


initialize() is non-idempotent: activeIsEspresso = true on L73 re-runs on every reinitializer(initVersion()) bump and silently undoes any prior switchBatcher() (e.g. a guardian flip to Fallback).

Fixed in 0ba3285

palango · 2026-05-20T15:22:25Z

+    }
+
+    /// @notice Toggles the active batcher between the Espresso and fallback batcher.
+    function switchBatcher() external onlyGuardianOrOwner {


It might be better to make this a setter instead of a toggle.

function setActiveIsEspresso(bool _desired) external onlyGuardianOrOwner { if (activeIsEspresso == _desired) return; // idempotent no-op activeIsEspresso = _desired; emit BatcherSwitched(_desired); }

Agreed, but I'll need to clear that w/ the rest of the team.

- strict-pragma: remove unneeded exclusions for src/universal/Proxy.sol and src/universal/ProxyAdmin.sol — both already use strict 'pragma solidity 0.8.15;', so the entries (and their misleading comment claiming '^') were dead. - interfaces: move the Espresso excludeContracts block out of the upstream-shared area and down next to the Celo block, with one entry per line to match the surrounding style. Localizes future rebase deltas. Co-authored-by: OpenCode <noreply@opencode.ai>

piersy · 2026-05-21T13:35:03Z

+    function paused() public view returns (bool) {
+        return systemConfig.paused();
+    }
+


I think the pause should be removed, I can't see any reason to want to stop batches reaching the L1. Also this is delegating to systemConfig.paused() which is intended to pause the bridge, not stop the chain from progressing.

jcortejoso · 2026-05-21T13:58:33Z

+        if (activeIsEspresso) {
+            // TEE batcher path: verify via registered TEE signer.
+            // Setting TEEType as Nitro because OP integration only supports AWS Nitro currently.
+            espressoTEEVerifier.verify(_signature, _commitment, IEspressoTEEVerifier.TeeType.NITRO);


Should we assume espressoTEEVerifier.verify() will always revert if there is a problem with the signature? Or should we check here the returned value and explicitly revert here if it's not true?

palango · 2026-05-21T14:28:09Z

+    ///         An attacker would need to compromise governance (to whitelist a malicious enclave hash), forge
+    ///         an AWS Nitro signature, or break the Succinct ZK proof — all outside the contract's threat model.
+    function registerSigner(bytes calldata _verificationData, bytes calldata _data) external {
+        if (paused()) revert BatchAuthenticator_Paused();


Is there a reason to not allow registering signers when the contract is paused?

QuentinI force-pushed the ag/contracts branch 2 times, most recently from 4bc5939 to cbd97f9 Compare May 8, 2026 00:42

QuentinI force-pushed the ag/contracts branch from cbd97f9 to ee2d984 Compare May 8, 2026 00:50

QuentinI changed the title ~~[WIP] Espresso Contracts~~ Espresso 1: Contracts May 8, 2026

jcortejoso requested a review from piersy May 11, 2026 14:12

chatgpt-codex-connector Bot reviewed May 11, 2026

View reviewed changes

Comment thread packages/contracts-bedrock/scripts/deploy/DeployEspresso.s.sol

piersy reviewed May 12, 2026

View reviewed changes

Comment thread packages/contracts-bedrock/test/mocks/MockEspressoTEEVerifiers.sol Outdated

piersy reviewed May 12, 2026

View reviewed changes

Comment thread packages/contracts-bedrock/test/L1/BatchAuthenticator.t.sol Outdated

piersy reviewed May 12, 2026

View reviewed changes

Comment thread packages/contracts-bedrock/foundry.toml Outdated

piersy reviewed May 12, 2026

View reviewed changes

Comment thread packages/contracts-bedrock/src/L1/BatchAuthenticator.sol

QuentinI and others added 4 commits May 13, 2026 15:24

Update packages/contracts-bedrock/src/L1/BatchAuthenticator.sol

8301942

Co-authored-by: piersy <pierspowlesland@gmail.com>

Remove stray path

2ae9515

Remove hardcoded Sepolia URL

781aa77

Use OZ v5 in mock verifier

42787cb

QuentinI mentioned this pull request May 14, 2026

Espresso 2: derivation pipeline #445

Draft

piersy requested review from m-chrzan and pahor167 May 19, 2026 16:48

Mc01 reviewed May 20, 2026

View reviewed changes

palango reviewed May 20, 2026

View reviewed changes

QuentinI and others added 4 commits May 20, 2026 21:14

Fix Codex's suggestion

f53b74e

Lower pragma

f41cbde

Remove unrelated foundry.toml changes

a07e57f

Fix re-initialization

0ba3285

piersy reviewed May 21, 2026

View reviewed changes

jcortejoso reviewed May 21, 2026

View reviewed changes

palango reviewed May 21, 2026

View reviewed changes

		@@ -0,0 +1,287 @@
		// SPDX-License-Identifier: MIT
		pragma solidity 0.8.25;

		optimizer_runs = 200
		use_literal_content = false

Conversation

QuentinI commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jcortejoso commented May 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mc01 May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

QuentinI commented May 7, 2026 •

edited

Loading

Mc01 May 20, 2026 •

edited

Loading