Guardians rebased

espresso/environment/enclave_helpers.go

@@ -39,6 +39,11 @@ const (
 	ENCLAVE_INTERMEDIATE_IMAGE_TAG = "op-batcher-enclave:tests"
 	ENCLAVE_IMAGE_TAG              = "op-batcher-enclaver:tests"
 	ESPRESSO_ENABLE_ENCLAVE_TESTS  = "ESPRESSO_RUN_ENCLAVE_TESTS"
+
+	// TeeTypeNitro corresponds to IEspressoTEEVerifier.TeeType.NITRO enum value
+	TeeTypeNitro uint8 = 1
+	// ServiceTypeBatchPoster corresponds to ServiceType.BatchPoster enum value
+	ServiceTypeBatchPoster uint8 = 0
 )
 
 // Skips the calling test if `ESPRESSO_ENABLE_ENCLAVE_TESTS` is not set.
@@ -274,21 +279,15 @@ func RegisterEnclaveHash(ctx context.Context, sys *e2esys.System, pcr0Bytes []by
 		return fmt.Errorf("failed to create verifier: %w", err)
 	}
 
-	nitroVerifierAddress, err := verifier.EspressoNitroTEEVerifier(&bind.CallOpts{})
-	if err != nil {
-		return fmt.Errorf("failed to get nitro verifier address: %w", err)
-	}
-
-	nitroVerifier, err := bindings.NewEspressoNitroTEEVerifier(nitroVerifierAddress, l1Client)
-	if err != nil {
-		return fmt.Errorf("failed to create nitro verifier: %w", err)
-	}
-
 	opts, err := bind.NewKeyedTransactorWithChainID(sys.Cfg.Secrets.Deployer, sys.Cfg.L1ChainIDBig())
 	if err != nil {
 		return fmt.Errorf("failed to create transactor: %w", err)
 	}
-	registrationTx, err := nitroVerifier.SetEnclaveHash(opts, crypto.Keccak256Hash(pcr0Bytes), true)
+
+	// SetEnclaveHash must be called through EspressoTEEVerifier wrapper because
+	// NitroTEEVerifier.setEnclaveHash has onlyTEEVerifier modifier, restricting calls
+	// to only the TEEVerifier contract. The wrapper has onlyGuardianOrOwner permissions.
+	registrationTx, err := verifier.SetEnclaveHash(opts, crypto.Keccak256Hash(pcr0Bytes), true, TeeTypeNitro, ServiceTypeBatchPoster)
 	if err != nil {
 		return fmt.Errorf("failed to create registration transaction: %w", err)
 	}

op-deployer/pkg/deployer/opcm/espresso.go

@@ -8,24 +8,33 @@ import (
 )
 
 type DeployAWSNitroVerifierInput struct {
-	EnclaveHash          [32]byte
 	NitroEnclaveVerifier common.Address
+	TeeVerifierAddress   common.Address
+	ProxyAdminOwner      common.Address
 }
 
 type DeployAWSNitroVerifierOutput struct {
-	NitroTEEVerifierAddress common.Address
+	NitroTEEVerifierProxy common.Address
+	NitroTEEVerifierImpl  common.Address
+	ProxyAdmin            common.Address
 }
 
 type DeployEspressoInput struct {
-	Salt             common.Hash
-	NitroTEEVerifier common.Address
-	NonTeeBatcher    common.Address
-	TeeBatcher       common.Address
+	Salt               common.Hash
+	NitroTEEVerifier   common.Address
+	SgxTEEVerifier     common.Address
+	NonTeeBatcher      common.Address
+	TeeBatcher         common.Address
+	ProxyAdminOwner    common.Address
+	UseMockTEEVerifier bool
 }
 
 type DeployEspressoOutput struct {
-	BatchAuthenticatorAddress common.Address
 	BatchInboxAddress         common.Address
+	BatchAuthenticatorAddress common.Address
+	TeeVerifierProxy          common.Address
+	TeeVerifierImpl           common.Address
+	TeeVerifierProxyAdmin     common.Address
 }
 
 type DeployEspressoScript struct {

op-deployer/pkg/deployer/pipeline/espresso.go

@@ -39,19 +39,11 @@ func DeployEspresso(env *Env, intent *state.Intent, st *state.State, chainID com
 		nitroEnclaveVerifierAddress = common.Address{}
 	}
 
-	// get enclave hash from environment variable, fallback to zeroed hash
-	var enclaveHash [32]byte
-	if envVar := os.Getenv("ENCLAVE_HASH"); envVar != "" {
-		copy(enclaveHash[:], common.FromHex(envVar))
-		lgr.Info("Using enclave hash from ENCLAVE_HASH env var", "hash", common.Bytes2Hex(enclaveHash[:]))
-	} else {
-		lgr.Info("ENCLAVE_HASH env var not set, using zeroed hash")
-	}
-
 	var nvo opcm.DeployAWSNitroVerifierOutput
 	nvo, err = opcm.DeployAWSNitroVerifier(env.L1ScriptHost, opcm.DeployAWSNitroVerifierInput{
-		EnclaveHash:          enclaveHash,
 		NitroEnclaveVerifier: nitroEnclaveVerifierAddress,
+		TeeVerifierAddress:   common.Address{}, // Will be set after TEEVerifier deployment if needed
+		ProxyAdminOwner:      env.Deployer,
 	})
 	if err != nil {
 		return fmt.Errorf("failed to deploy nitro verifier contracts: %w", err)
@@ -69,10 +61,13 @@ func DeployEspresso(env *Env, intent *state.Intent, st *state.State, chainID com
 	}
 
 	eo, err = opcm.DeployEspresso(env.L1ScriptHost, opcm.DeployEspressoInput{
-		Salt:             st.Create2Salt,
-		NitroTEEVerifier: nvo.NitroTEEVerifierAddress,
-		NonTeeBatcher:    chainIntent.NonTeeBatcher,
-		TeeBatcher:       chainIntent.TeeBatcher,
+		Salt:               st.Create2Salt,
+		NitroTEEVerifier:   nvo.NitroTEEVerifierProxy,
+		SgxTEEVerifier:     common.Address{}, // SGX not currently supported
+		NonTeeBatcher:      chainIntent.NonTeeBatcher,
+		TeeBatcher:         chainIntent.TeeBatcher,
+		ProxyAdminOwner:    batchAuthenticatorOwnwerAddress,
+		UseMockTEEVerifier: nitroEnclaveVerifierAddress == common.Address{},
 	}, batchAuthenticatorOwnwerAddress)
 	if err != nil {
 		return fmt.Errorf("failed to deploy espresso contracts: %w", err)

packages/contracts-bedrock/foundry.toml

@@ -35,12 +35,15 @@ ast = true
 evm_version = 'cancun'
 
 remappings = [
+  # Espresso-tee-contracts context-specific remappings (must come before general @openzeppelin remappings)
+  'lib/espresso-tee-contracts/:@openzeppelin/contracts/=lib/espresso-tee-contracts/lib/openzeppelin-contracts/contracts',
+  'lib/espresso-tee-contracts/:@openzeppelin/contracts-upgradeable/=lib/espresso-tee-contracts/lib/openzeppelin-contracts-upgradeable/contracts',
+  'lib/espresso-tee-contracts/:solady/=lib/solady/src',
+  # General remappings
   '@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts',
   '@espresso-tee-contracts/=lib/espresso-tee-contracts/src',
   '@nitro-validator/=lib/espresso-tee-contracts/lib/nitro-validator/src',
   'aws-nitro-enclave-attestation/=lib/espresso-tee-contracts/lib/aws-nitro-enclave-attestation/contracts/src',
-  'lib/espresso-tee-contracts/:@openzeppelin/contracts/=lib/espresso-tee-contracts/lib/openzeppelin-contracts/contracts',
-  'lib/espresso-tee-contracts/:solady/=lib/solady/src',
   '@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts',
   '@openzeppelin/contracts-v5/=lib/openzeppelin-contracts-v5/contracts',
   '@rari-capital/solmate/=lib/solmate',

packages/contracts-bedrock/interfaces/L1/IBatchAuthenticator.sol

@@ -19,6 +19,9 @@ interface IBatchAuthenticator {
     /// @notice Emitted when the non-TEE batcher address is updated.
     event NonTeeBatcherUpdated(address indexed oldNonTeeBatcher, address indexed newNonTeeBatcher);
 
+    /// @notice Emitted when the active batcher is switched.
+    event BatcherSwitched(bool indexed activeIsTee);
+
     function authenticateBatchInfo(
         bytes32 commitment,
         bytes memory _signature
@@ -48,4 +51,6 @@ interface IBatchAuthenticator {
     function setTeeBatcher(address _newTeeBatcher) external;
 
     function setNonTeeBatcher(address _newNonTeeBatcher) external;
+
+    function validateBatch(address sender, bytes calldata data) external view;
 }

packages/contracts-bedrock/interfaces/L1/IBatchInbox.sol

@@ -4,7 +4,5 @@ pragma solidity ^0.8.0;
 interface IBatchInbox {
     fallback() external;
 
-    function version() external view returns (string memory);
-
-    function __constructor__(address _batchAuthenticator, address _owner) external;
+    function __constructor__(address _batchAuthenticator) external;
 }

packages/contracts-bedrock/justfile

@@ -37,7 +37,7 @@ build *ARGS: lint-fix-no-fail
 
 # Builds the contracts (developer mode).
 build-dev *ARGS: lint-fix-no-fail
-  just forge-build-dev {{ARGS}}
+  just forge-build-dev {{ARGS}} && just fix-proxy-artifact
 
 # Builds the go-ffi tool for contract tests.
 build-go-ffi: