optimism wip: Standard L2 Genesis

Description

WIP Standard L2 Genesis

Sep 23 '24 14:09 tynes

Semgrep found 1 sol-style-return-arg-fmt finding:

packages/contracts-bedrock/src/L1/OPStackManager.sol
- L349 - Triage

Named return arguments to functions must be appended with an underscore (_)

_{Ignore this finding from sol-style-return-arg-fmt.}

Sep 23 '24 14:09 semgrep-app[bot]

Semgrep found 2 golang_fmt_errorf_no_params findings:

op-chain-ops/deployer/state/intent.go
- L47 - Triage
- L63 - Triage

No fmt.Errorf invocations without fmt arguments allowed

_{Ignore this finding from golang_fmt_errorf_no_params.}

Semgrep found 6 sol-style-return-arg-fmt findings:

packages/contracts-bedrock/src/L2/interfaces/IL1Block.sol
- L43 - Triage
- L44 - Triage
- L45 - Triage
packages/contracts-bedrock/src/L2/L1Block.sol
- L249 - Triage
- L254 - Triage
- L259 - Triage

Named return arguments to functions must be appended with an underscore (_)

_{Ignore this finding from sol-style-return-arg-fmt.}

Semgrep found 2 sol-style-require-reason findings:

packages/contracts-bedrock/scripts/deploy/Deploy.s.sol
- L1244 - Triage
- L1328 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 12 sol-safety-deployutils-args findings:

packages/contracts-bedrock/scripts/deploy/Deploy.s.sol
- L677-682 - Triage
- L693-698 - Triage
- L717-722 - Triage
- L777-782 - Triage
- L803-808 - Triage
- L824-829 - Triage
- L871-876 - Triage
- L950-955 - Triage
- L958-963 - Triage
- L977-982 - Triage
- 2 more - Triage

_args parameter should be wrapped with DeployUtils.encodeConstructor

_{Ignore this finding from sol-safety-deployutils-args.}

Sep 28 '24 23:09 semgrep-app[bot]

Semgrep found 6 sol-style-require-reason findings:

packages/contracts-bedrock/scripts/deploy/ChainAssertions.sol
- L109 - Triage
- L111 - Triage
- L115 - Triage
- L118 - Triage
- L119 - Triage
- L120 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Sep 30 '24 01:09 semgrep-app[bot]

Semgrep found 3 sol-style-require-reason findings:

packages/contracts-bedrock/scripts/deploy/Deploy.s.sol
- L1019 - Triage
- L1100 - Triage
- L1107-1110 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 1 err-todo finding:

op-program/client/l2/engineapi/l2_engine_api.go
- L500 - Triage

TODO in error handling code

_{Ignore this finding from err-todo.}

Oct 13 '24 00:10 semgrep-app[bot]

Another possible feature to include is https://github.com/ethereum-optimism/optimism/issues/12136. This would make the enshrined revenue sharing predeploy much simpler to implement. This is a 2 line change and is backwards compatible, we could also wait to roll this out until we get around to shipping the enshrined revshare contract

Oct 18 '24 08:10 tynes

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

Oct 23 '24 21:10 coderabbitai[bot]

Semgrep found 1 sol-style-require-reason finding:

packages/contracts-bedrock/src/L2/SuperchainWETH.sol
- L94 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 5 sol-style-input-arg-fmt findings:

packages/contracts-bedrock/src/L2/SuperchainWETH.sol
- L34 - Triage
- L40 - Triage
- L61 - Triage
- L85 - Triage
- L93 - Triage

Inputs to functions must be prepended with an underscore (_)

_{Ignore this finding from sol-style-input-arg-fmt.}

Semgrep found 1 no-direct-write-to-responsewriter finding:

op-challenger/game/fault/trace/prestates/multi_test.go
- L172 - Triage

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

_{Ignore this finding from no-direct-write-to-responsewriter.}

Semgrep found 1 no-direct-write-to-responsewriter-taint finding:

op-challenger/game/fault/trace/prestates/multi_test.go
- L172 - Triage

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: Go XSS prevention.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>op-challenger/game/fault/trace/prestates/multi_test.go</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/ethereum-optimism/optimism/blob/55f5e1966ee76a29a670edc211482c6f62d68f0a/op-challenger/game/fault/trace/prestates/multi_test.go#L172 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 172] r.URL</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/ethereum-optimism/optimism/blob/55f5e1966ee76a29a670edc211482c6f62d68f0a/op-challenger/game/fault/trace/prestates/multi_test.go#L172 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 172] w.Write([]byte(r.URL.Path))</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

_{Ignore this finding from no-direct-write-to-responsewriter-taint.}

Oct 23 '24 21:10 semgrep-app[bot]

Semgrep found 3 sol-style-require-reason findings:

packages/contracts-bedrock/src/universal/WETH98.sol
- L60 - Triage
- L85 - Triage
- L88 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Oct 24 '24 19:10 semgrep-app[bot]

Semgrep found 1 sol-style-require-reason finding:

packages/contracts-bedrock/scripts/DeployOPChain.s.sol
- L877 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 12 sol-style-notice-over-dev-natspec findings:

packages/contracts-bedrock/test/L2/SequencerFeeVault.t.sol
- L26 - Triage
- L122 - Triage
packages/contracts-bedrock/test/L2/Predeploys.t.sol
- L24 - Triage
packages/contracts-bedrock/test/L2/FeeVault.t.sol
- L12 - Triage
packages/contracts-bedrock/test/L1/SystemConfig.t.sol
- L548 - Triage
- L558 - Triage
- L655 - Triage
packages/contracts-bedrock/test/L1/OptimismPortalInterop.t.sol
- L32 - Triage
- L52 - Triage
packages/contracts-bedrock/test/L1/OptimismPortal2.t.sol
- L385 - Triage
- L445 - Triage
- L465 - Triage

Prefer @notice over @dev in natspec comments

_{Ignore this finding from sol-style-notice-over-dev-natspec.}

Semgrep found 3 sol-style-malformed-revert findings:

packages/contracts-bedrock/test/universal/Proxy.t.sol
- L22 - Triage
packages/contracts-bedrock/test/mocks/Callers.sol
- L87 - Triage
packages/contracts-bedrock/test/invariants/FaultDisputeGame.t.sol
- L72 - Triage

Malformed revert statement style.

_{Ignore this finding from sol-style-malformed-revert.}

Semgrep found 9 sol-style-malformed-require findings:

packages/contracts-bedrock/test/safe-tools/CompatibilityFallbackHandler_1_3_0.sol
- L96 - Triage
packages/contracts-bedrock/test/invariants/OptimismSuperchainERC20/helpers/MockL2ToL2CrossDomainMessenger.t.sol
- L92 - Triage
packages/contracts-bedrock/test/invariants/OptimismSuperchainERC20/handlers/Protocol.t.sol
- L160 - Triage
packages/contracts-bedrock/test/dispute/FaultDisputeGame.t.sol
- L2644 - Triage
packages/contracts-bedrock/test/dispute/AnchorStateRegistry.t.sol
- L141 - Triage
packages/contracts-bedrock/test/L2/GasPriceOracle.t.sol
- L134 - Triage
- L225 - Triage
packages/contracts-bedrock/test/L1/SystemConfigInterop.t.sol
- L83 - Triage
- L105 - Triage

"Hash not approved" Malformed require statement style.

_{Ignore this finding from sol-style-malformed-require.}

Oct 25 '24 05:10 semgrep-app[bot]

@tynes I'm opening this up for your initial review.

Status:

Contract code should be feature complete.
There is a single failing contract test I still need to debug.
Many other checks still need fixing (spacers, semgrep, interfaces, etc).
Still want to migrate other L1 contracts to OZ' v5 Initializable
Still need to update op-deployer to support the new feeAdmin role

Oct 25 '24 06:10 maurelian

Semgrep found 1 sol-style-require-reason finding:

packages/contracts-bedrock/scripts/ops/FeeVaultWithdrawal.s.sol
- L23 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Oct 25 '24 17:10 semgrep-app[bot]

Semgrep found 6 sol-style-input-arg-fmt findings:

packages/contracts-bedrock/src/universal/interfaces/IWETH.sol
- L44 - Triage
- L50 - Triage
- L57 - Triage
- L67 - Triage
- L73 - Triage
- L80 - Triage

Inputs to functions must be prepended with an underscore (_)

_{Ignore this finding from sol-style-input-arg-fmt.}

Semgrep found 1 golang_fmt_errorf_no_params finding:

packages/contracts-bedrock/scripts/checks/semver-natspec/main.go
- L191 - Triage

No fmt.Errorf invocations without fmt arguments allowed

_{Ignore this finding from golang_fmt_errorf_no_params.}

Oct 28 '24 17:10 semgrep-app[bot]

Going to close this PR due to it being replaced by another

Nov 18 '24 10:11 tynes