feat: add L1PortalExecuteL2Call template for L2 actions through OptimismPortal

foundry.toml

@@ -20,7 +20,7 @@ remappings = [
   '@solady/=lib/optimism/packages/contracts-bedrock/lib/solady/src/',
   '@lib-keccak/=lib/optimism/packages/contracts-bedrock/lib/lib-keccak/contracts/lib/',
   'ds-test/=lib/optimism/packages/contracts-bedrock/lib/forge-std/lib/ds-test/src',
-  'forge-std/=lib/forge-std/src/',
+  'forge-std/=lib/forge-std/src/'
 ]
 
 [profile.ci]

security-council-rehearsals/README.md

@@ -5,6 +5,7 @@ This directory contains templates and ceremonies related to onboarding Security
 ## Creating and signing a new rehearsal ceremony
 
 To create a new rehearsal ceremony, follow the instructions in the _Facilitator_ section of the README files for each of the following rehearsals:
+
 1. [rehearsal-1-welcome](./rehearsal-1-welcome/README.md)
 2. [rehearsal-2-remove-signer](./rehearsal-2-remove-signer/README.md)
 3. [rehearsal-3-nested-upgrade](./rehearsal-3-jointly-upgrade/README.md)

src/improvements/tasks/sep/019-worldchain-l1-ownership-transfers/VALIDATION.md

@@ -17,8 +17,8 @@ First, we need to validate the domain and message hashes. These values should ma
 >
 > ### Worldchain Proxy Admin Owner (`0x945185C01fb641bA3E63a9bdF66575e35a407837`)
 >
-> - Domain Hash:  `0x6faec9c52949ba8274340008df12c69faedd5c44e77f77c956d2ca8e4bcd877e`
-> - Message Hash: `0x20556e9d7d2847116caef0b79cdcd207b399adcdb01776e368fcbc9011559a4e`
+> - Domain Hash: `0x6faec9c52949ba8274340008df12c69faedd5c44e77f77c956d2ca8e4bcd877e`
+> - Message Hash: `0x9d228a76bf7ab77438ffffc6b869643ff697f20fbf681147caa88c93752aa06f`
 
 ## Normalized State Diff Hash Attestation
 
@@ -74,8 +74,8 @@ Note: The changes listed below do not include threshold, nonce and owner mapping
 
 - **Key:**          `0x0000000000000000000000000000000000000000000000000000000000000005`
   - **Decoded Kind:** `uint256`
-  - **Before:** `44` - (`cast --to-dec 0x2c` is `44`)
-  - **After:** `45` - (`cast --to-dec 0x2d` is `45`)
+  - **Before:** `51` - (`cast --to-dec 0x33` is `51`)
+  - **After:** `52` - (`cast --to-dec 0x34` is `52`)
   - **Summary:** nonce
   - **Detail:** Nonce update for the parent multisig.
 

src/improvements/tasks/sep/019-worldchain-l1-ownership-transfers/config.toml

@@ -1,10 +1,11 @@
-l2chains = [{name = "Worldchain Sepolia", chainId = 4801}] 
+l2chains = [{name = "Worldchain Sepolia", chainId = 4801}]
 templateName = "TransferOwners"
+safeAddressString = "ProxyAdminOwner"
 
 # Standard Sepolia L1PAO - https://github.com/ethereum-optimism/superchain-registry/blob/93c5073d233cb9011a95aebf275270fd00346400/validation/standard/standard-config-roles-sepolia.toml#L3
 newOwner = "0x1Eb2fFc903729a0F03966B917003800b145F56E2"
 
 [stateOverrides]
 0x945185c01fb641ba3e63a9bdf66575e35a407837 = [ # Worldchain L1PAO
-     {key = "0x0000000000000000000000000000000000000000000000000000000000000005", value = 45}
+     {key = "0x0000000000000000000000000000000000000000000000000000000000000005", value = 51}
 ]

src/improvements/template/L1PortalExecuteL2Call.sol

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import {VmSafe} from "forge-std/Vm.sol";
+import {stdToml} from "forge-std/StdToml.sol";
+
+import {IOptimismPortal2} from "lib/optimism/packages/contracts-bedrock/interfaces/L1/IOptimismPortal2.sol";
+import {MultisigTaskPrinter} from "../../libraries/MultisigTaskPrinter.sol";
+import {Action} from "../../libraries/MultisigTypes.sol";
+import {SimpleTaskBase} from "../tasks/types/SimpleTaskBase.sol";
+
+/// @notice Template to execute an L2 call via the L1 Optimism Portal from a nested L1 Safe.
+/// Sends an L2 transaction using OptimismPortal.depositTransaction with config-driven params.
+contract L1PortalExecuteL2Call is SimpleTaskBase {
+    using stdToml for string;
+
+    // -------- Config inputs --------
+    address payable public portal; // L1 OptimismPortal address
+    address public l2Target; // L2 target address
+    bytes public l2Data; // Inner L2 calldata
+    uint256 public valueWei; // ETH value to forward to L2 (defaults to 0)
+    uint64 public gasLimit; // L2 gas limit (required)
+    bool public isCreation; // Whether to create a contract on L2 (defaults to false)
+
+    /// @notice Default Safe name. Can be overridden via `safeAddressString` in config.toml.
+    function safeAddressString() public pure override returns (string memory) {
+        return "ProxyAdminOwner";
+    }
+
+    /// @notice The contracts expected to have storage writes during execution.
+    /// Allowlist the OptimismPortal since it will mutate state (queue/event) on deposit.
+    function _taskStorageWrites() internal pure override returns (string[] memory) {
+        string[] memory _storageWrites = new string[](1);
+        _storageWrites[0] = "OptimismPortal";
+        return _storageWrites;
+    }
+
+    /// @notice The contracts expected to have balance changes during execution.
+    /// Allowlist the OptimismPortal to receive ETH (value) in the deposit call.
+    function _taskBalanceChanges() internal pure override returns (string[] memory) {
+        string[] memory _balanceChanges = new string[](1);
+        _balanceChanges[0] = "OptimismPortal";
+        return _balanceChanges;
+    }
+
+    /// @notice Parse config and initialize template variables.
+    /// Expected TOML keys:
+    /// - portal: address (L1 OptimismPortal) OR addresses.OptimismPortal in [addresses]
+    /// - l2Target: address (L2 target address)
+    /// - l2Data: hex string (e.g. 0x1234...)
+    /// - gasLimit: uint (will be cast to uint64)
+    /// - value: uint (optional, default 0)
+    /// - isCreation: bool (optional, default false)
+    function _templateSetup(string memory _taskConfigFilePath, address) internal override {
+        string memory _toml = vm.readFile(_taskConfigFilePath);
+
+        // Resolve portal from registry first if available, else read explicit field.
+        try simpleAddrRegistry.get("OptimismPortal") returns (address p) {
+            portal = payable(p);
+        } catch {
+            portal = payable(_toml.readAddress(".portal"));
+        }
+        require(portal != address(0), "portal must be set (addresses.OptimismPortal or .portal)");
+
+        l2Target = _toml.readAddress(".l2Target");
+        require(l2Target != address(0), "l2Target must be set");
+
+        // Read hex string and parse to bytes.
+        string memory _dataHex = _toml.readString(".l2Data");
+        l2Data = vm.parseBytes(_dataHex);
+        require(l2Data.length > 0, "l2Data must be set");
+
+        uint256 _gasLimitTmp = _toml.readUint(".gasLimit");
+        require(_gasLimitTmp > 0 && _gasLimitTmp <= type(uint64).max, "invalid gasLimit");
+        gasLimit = uint64(_gasLimitTmp);
+
+        // Optional fields
+        valueWei = 0;
+        try vm.parseTomlUint(_toml, ".value") returns (uint256 _v) {
+            valueWei = _v;
+        } catch {}
+
+        isCreation = false;
+        try vm.parseTomlBool(_toml, ".isCreation") returns (bool _b) {
+            isCreation = _b;
+        } catch {}
+    }
+
+    /// @notice Build the portal deposit action. WARNING: State changes here are reverted after capture.
+    function _build(address) internal override {
+        // Record the L1 portal call with value for action extraction.
+        IOptimismPortal2(portal).depositTransaction{value: valueWei}(l2Target, valueWei, gasLimit, isCreation, l2Data);
+    }
+
+    /// @notice Validate that exactly one action to the portal with the expected calldata and value was captured.
+    function _validate(VmSafe.AccountAccess[] memory, Action[] memory _actions, address) internal view override {
+        bytes memory _expected = abi.encodeWithSelector(
+            IOptimismPortal2.depositTransaction.selector, l2Target, valueWei, gasLimit, isCreation, l2Data
+        );
+
+        bool _found;
+        uint256 _matches;
+        for (uint256 _i = 0; _i < _actions.length; _i++) {
+            if (_actions[_i].target == portal && _actions[_i].value == valueWei) {
+                if (keccak256(_actions[_i].arguments) == keccak256(_expected)) {
+                    _found = true;
+                    _matches++;
+                }
+            }
+        }
+        require(_found && _matches == 1, "expected one portal deposit action");
+        MultisigTaskPrinter.printTitle("Validated portal deposit action");
+    }
+
+    /// @notice No code exceptions required for this template.
+    function _getCodeExceptions() internal view override returns (address[] memory) {}
+}

test/tasks/Regression.t.sol

@@ -29,6 +29,7 @@ import {WelcomeToSuperchainOps} from "src/improvements/template/WelcomeToSuperch
 import {GnosisSafeRemoveOwner} from "src/improvements/template/GnosisSafeRemoveOwner.sol";
 import {SetEIP1967Implementation} from "src/improvements/template/SetEIP1967Implementation.sol";
 import {UnpauseSuperchainConfigV400} from "src/improvements/template/UnpauseSuperchainConfigV400.sol";
+import {L1PortalExecuteL2Call} from "src/improvements/template/L1PortalExecuteL2Call.sol";
 import {UniFix} from "src/improvements/template/UniFix.sol";
 import {DeputyPauseKeyRotationTemplate} from "src/improvements/template/DeputyPauseKeyRotationTemplate.sol";
 import {BlacklistGamesV140} from "src/improvements/template/BlacklistGamesV140.sol";
@@ -678,6 +679,34 @@ contract RegressionTest is Test {
         _assertDataToSignNestedMultisig(multisigTask, actions, expectedDataToSign, MULTICALL3_ADDRESS, rootSafe);
     }
 
+    /// @notice Expected call data and data to sign generated by manually running the L1PortalExecuteL2CallUpgradeGovernor template at block 23197819 on mainnet.
+    /// Simulate from task directory (test/tasks/example/eth/014-noop-call-optimismportal/config.toml) with:
+    /// just --dotenv-path $(pwd)/.env --justfile ../../../../../src/improvements/justfile simulate (foundation|council)
+    function testRegressionCallDataMatches_L1PortalExecuteL2CallUpgradeGovernor() public {
+        string memory taskConfigFilePath = "test/tasks/example/eth/014-noop-call-optimismportal/config.toml";
+        string memory expectedCallData =
+            "0x174dea71000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000020000000000000000000000000beb5fc579115071764c7423a4f12edde41f106ed0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c42000000000000000000000000cdf27f107725988f2261ce2256bdfcde8b382b100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007a120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000243659cfe6000000000000000000000000ecbf4ed9f47302f00f0f039a691e7db83bdd26240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+        MultisigTask multisigTask = new L1PortalExecuteL2Call();
+        address rootSafe = address(0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A); // L1PAO
+        address securityCouncilChildMultisig = address(0xc2819DC788505Aac350142A7A707BF9D03E3Bd03);
+        address[] memory allSafes = MultisigTaskTestHelper.getAllSafes(rootSafe, securityCouncilChildMultisig);
+
+        (Action[] memory actions, uint256[] memory allOriginalNonces) =
+            _setupAndSimulate(taskConfigFilePath, 23197819, "mainnet", multisigTask, allSafes);
+
+        _assertCallDataMatches(multisigTask, actions, allSafes, allOriginalNonces, expectedCallData);
+
+        string[] memory expectedDataToSign = new string[](2);
+        // Foundation
+        expectedDataToSign[0] =
+            "0x1901a4a9c312badf3fcaa05eafe5dc9bee8bd9316c78ee8b0bebe3115bb21b73267229ea72d29d343d55ff76a6ce84cc8514d45683b4339b10bef5e956955bfe65c9";
+        // Security Council
+        expectedDataToSign[1] =
+            "0x1901df53d510b56e539b90b369ef08fce3631020fbf921e3136ea5f8747c20bce9672b811a78d33f39e928848432a404247a2ab7c4a596b8586797a2e86b284b3b8b";
+
+        _assertDataToSignNestedMultisig(multisigTask, actions, expectedDataToSign, MULTICALL3_ADDRESS, rootSafe);
+    }
+
     /// @notice Expected call data and data to sign generated by manually running the UniFix template at block 8029861 on sepolia.
     /// Simulate from task directory (test/tasks/example/sep/004-replace-superchain-config/config.toml) with:
     /// SIMULATE_WITHOUT_LEDGER=1 just --dotenv-path "$(pwd)"/.env --justfile ../../../../../src/improvements/justfile simulate

test/tasks/example/eth/014-noop-call-optimismportal/.env

@@ -0,0 +1,3 @@
+TENDERLY_GAS=10000000
+NESTED_SAFE_NAME_DEPTH_1=council
+FORK_BLOCK_NUMBER=23197819

test/tasks/example/eth/014-noop-call-optimismportal/config.toml

@@ -0,0 +1,13 @@
+templateName = "L1PortalExecuteL2Call"
+
+# Portal + L2 call params
+portal = "0xbEb5Fc579115071764c7423A4f12eDde41f106Ed" # L1 OptimismPortal
+l2Target = "0xcDF27F107725988f2261Ce2256bDfCdE8B382B10" # OptimismGovernor Proxy
+l2Data = "0x3659cfe6000000000000000000000000ecbf4ed9f47302f00f0f039a691e7db83bdd2624" # upgradeTo(currentImpl) -> 0xecbf4ed9f47302f00f0f039a691e7db83bdd2624
+gasLimit = 500000
+value = 0
+isCreation = false
+
+[addresses]
+ProxyAdminOwner = "0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A" # 2-of-2 between council and foundation
+OptimismPortal = "0xbEb5Fc579115071764c7423A4f12eDde41f106Ed"