Fallback Inbox contract changes #278

philippecamacho · 2025-11-14T14:02:58Z

Closes https://app.asana.com/1/1208976916964769/project/1209423958092927/task/1211849813289225?focus=true

This PR:

Make changes to the Inbox contract so that it allows two batchers. The specification of this contract change can be found at https://eng-wiki.espressosys.com/mainch36.html#:Components:Base%20Layer%20Batch%20Validation:Batch%20Inbox%20Contract (see paragraph "Allowing different batchers")
Extend the CI test suite to run L1 contract tests
Remove the concept of preapproved batcher key and replace it with the non TEE batcher key, while introducing the TEE batcher key.
Remove test TestRotateBatcherKey as the batcher key rotation will happen in the Inbox contract.
NOT RELATED to the fallback inbox contract changes, but the circle ci tests that are failing have been deactivated for now. We can reactivate them later once they pass.

This PR does not:

Implement the full fallback mechanism. This will be addressed in another PR.

Key places to review:

Focus on the smart contract changes, in particular packages/contracts-bedrock/test/L1/BatchInbox.t.sol.

How to test this PR:

cd packages/contracts-bedrock/
forge test  --match-path test/L1/BatchInbox.t.sol

Things tested

The core logic of the new inbox contract with about handling two batchers and allowing to switch from one to another. See packages/contracts-bedrock/test/L1/BatchInbox.t.sol.

.circleci/config.yml

packages/contracts-bedrock/src/L1/BatchInbox.sol

packages/contracts-bedrock/test/L1/BatchInbox.t.sol

shenkeyao · 2025-11-26T22:01:51Z

op-e2e/config/init.go

-			if allocType == AllocTypeEspressoWithoutEnclave {
-				batcherPk, err := crypto.HexToECDSA(ESPRESSO_PRE_APPROVED_BATCHER_PRIVATE_KEY)
+			// Configure Espresso allocation types
+			if allocType == AllocTypeEspresso || allocType == AllocTypeEspressoWithoutEnclave || allocType == AllocTypeEspressoWithEnclave {


Why do we have AllocTypeEspresso when we also have *WithEnclave and *WithoutEnclave?

Oh AllocTypeEspresso isn't introduced in this PR. @QuentinI looks like these three types were added from these two PRs on the same day: #110 and #144. Maybe there was some merge weirdness and we only wanted to keep the With and Without types?

Yeah, I think this is merge shenanigans... Non-prefixed type shouldn't exist.

op-e2e/config/init.go

shenkeyao

LGTM

QuentinI · 2025-12-02T18:27:18Z

packages/contracts-bedrock/src/L1/BatchInbox.sol

    }

+    /// @notice Toggles the active batcher between the TEE and non-TEE batcher.
+    function switchBatcher() external onlyOwner {


I don't think it matters that much, but I'd put this function and the new variables into batch authenticator contract to keep BatchInbox surface area minimal, as it's part of the original OP's derivation pipeline.

QuentinI · 2025-12-02T18:56:23Z

packages/contracts-bedrock/src/L1/BatchInbox.sol

-            if (!batchAuthenticator.validBatchInfo(hash)) {
-                revert("Invalid calldata batch");
+            // Non TEE batcher require batcher address authentication
+            if (msg.sender != nonTeeBatcher) {


I don't think this works unfortunately, as derivation pipeline checks that transaction is from one specific batcherAddress that is defined by RollupConfig, let's call it Batch Sender Address for clarity.

I think what we need to do is either keep this as-is and either

make a similar change to batch authenticator and require fallback batcher to authenticate the batch with the batch inbox before posting

skip any sort of authentication when activeIsTee is false

Both approaches require both TEE and fallback batcher sharing Batch Sender Address, which is... not great.
The first one will at least cleanly separate who can post batches at any given moment - when non-TEE batcher is active, only its batches will be approved. However, this comes at cost of fallback batcher needing to be a modified batcher (essentially our batcher in non-TEE mode)
The second approach will allow through both batchers when activeIsTee is false, but the fallback batcher can be an unmodified OP batcher.

As an alternative, we can make yet another change to the derivation pipeline and introduce a second batcher address there, this would allow us to have our cake and eat it too in terms of batcher modifications (the code as written in this PR would just work and batchers won't need to share Batch Sender Address), but at the cost of yet another change to the derivation pipeline, which I imagine would become even harder to upstream.

This is a great catch. I think the better alternative is to modify the derivation pipeline, because it reflects the introduction of a new batcher in the design and at some point we want to be able to support permissionless batching, so why not start moving in that direction anyways. Also IIRC, during the technical meetings we discussed that it would be undesirable to have the two batchers share the same key / identity.

at some point we want to be able to support permissionless batching

Oh, right, I failed to considered that. Yeah, then "don't make more changes to the pipeline" ship has already sailed and we can just as well do it.

…r passing.

…rent.

…E batchers.

…e pass to the constructor.

… the inbox contract.

…tor contract.

philippecamacho mentioned this pull request Nov 14, 2025

Fallback contract changes #271

Closed

philippecamacho force-pushed the philippe/fallback-contracts-change-new branch from b09bfab to 62d96d3 Compare November 14, 2025 20:06

philippecamacho requested review from QuentinI and alysiahuggins November 15, 2025 15:17

philippecamacho marked this pull request as ready for review November 15, 2025 15:18

philippecamacho requested review from dailinsubjam and shenkeyao November 17, 2025 19:01

dailinsubjam reviewed Nov 18, 2025

View reviewed changes

.circleci/config.yml Show resolved Hide resolved

packages/contracts-bedrock/src/L1/BatchInbox.sol Outdated Show resolved Hide resolved

packages/contracts-bedrock/src/L1/BatchInbox.sol Outdated Show resolved Hide resolved

philippecamacho force-pushed the philippe/fallback-contracts-change-new branch from fcd5832 to 9af9291 Compare November 26, 2025 16:47

shenkeyao reviewed Nov 26, 2025

View reviewed changes

philippecamacho force-pushed the philippe/fallback-contracts-change-new branch from f08d28d to 33f240a Compare December 1, 2025 20:57

shenkeyao approved these changes Dec 1, 2025

View reviewed changes

QuentinI reviewed Dec 2, 2025

View reviewed changes

philippecamacho added 17 commits December 3, 2025 19:08

Changes to the inbox contract. Test TestBatchInbox_SwitchActiveBatche…

4f7d40e

…r passing.

Fix logical error in the Inbox contract.

04f063e

Fix golint errors

c3764db

Remove unneeded changes.

90942e0

Fix configuration

6b6e3e6

Inbox contract unit test.

c5ebcea

Remove integration test for Inbox contract that was confusing.

b236b0f

Fix solidity formatting.

4112ad8

Fix configuration

4156aa8

Run the L1 contracts tests in CI.

5794792

Pinpoint forge version

98e871e

Trying to fix configuration issue for e2e tests.

c5056d4

Small configuration change.

2a5bf6c

Swapping batchers in batch inbox contract constructor.

7d81c15

Remove redundant concept of preApprovedBatcherKey.

7ffeeb3

Document BatchInbox.sol contract.

02d4e1a

Add a test to ensure the TEE and non TEE batchers addresses are diffe…

9534004

…rent.

philippecamacho added 17 commits December 3, 2025 19:08

Check formatting before running the tests.

c69af11

Ensure the devnet uses two different addresses for the TEE and non TE…

a9e5263

…E batchers.

Improve handling of configuration variables.

1d47fe2

Allow two batcher having the same address.

0b9e438

Only authenticate batcher in Inbox contract for the non TEE case.

d3335b0

Change Inbox contract API: the tee batcher address does not need to b…

a690d58

…e pass to the constructor.

All tests should be passing.

166b602

Skip Circle CI tests that are failing.

28a4ef7

Fix more Circle CI failures.

506ef7d

Skip acceptance tests.

0bf1123

Fix Circle CI config.yml.

662b0de

Fix github devnet tests workflow.

1cadc1d

Remove test about rotating batcher key as this logic (will) happen in…

d0b5346

… the inbox contract.

Use Owner pattern to switch betweern batcher.

9215f99

Remove redundant field 'teeBatcher'.

4dcf626

Rename private field of MockBatchAuthenticator.

758331f

Move the switching logic between batchers inside the Batch Authentica…

e8f100b

…tor contract.

philippecamacho force-pushed the philippe/fallback-contracts-change-new branch from f5587dc to e8f100b Compare December 3, 2025 22:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fallback Inbox contract changes #278

Fallback Inbox contract changes #278

philippecamacho commented Nov 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shenkeyao Nov 26, 2025

Uh oh!

shenkeyao Nov 26, 2025

Uh oh!

QuentinI Dec 2, 2025

Uh oh!

Uh oh!

shenkeyao left a comment

Uh oh!

QuentinI Dec 2, 2025

Uh oh!

QuentinI Dec 2, 2025

Uh oh!

philippecamacho Dec 3, 2025 •

edited

Loading

Uh oh!

QuentinI Dec 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Fallback Inbox contract changes #278

Are you sure you want to change the base?

Fallback Inbox contract changes #278

Conversation

philippecamacho commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This PR:

This PR does not:

Key places to review:

How to test this PR:

Things tested

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shenkeyao Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

shenkeyao Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

QuentinI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shenkeyao left a comment

Choose a reason for hiding this comment

Uh oh!

QuentinI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

QuentinI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

philippecamacho Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

QuentinI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

philippecamacho commented Nov 14, 2025 •

edited

Loading

philippecamacho Dec 3, 2025 •

edited

Loading