') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(bridge): Bridgehub migration, hardened with legacy-withdrawal replay guard + live-state fork tests by aliXsed · Pull Request #122 · NodleCode/rollup · GitHub
Skip to content

fix(bridge): Bridgehub migration, hardened with legacy-withdrawal replay guard + live-state fork tests - #122

Merged
aliXsed merged 7 commits into
mainfrom
fix/104-bridgehub-migration-hardened
Jul 9, 2026
Merged

fix(bridge): Bridgehub migration, hardened with legacy-withdrawal replay guard + live-state fork tests#122
aliXsed merged 7 commits into
mainfrom
fix/104-bridgehub-migration-hardened

Conversation

@aliXsed

@aliXsedaliXsed commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

Supersedes #121 by @DrVelvetFog — the Bridgehub transport migration there was correct and is included here unchanged (with authorship preserved in the commit history). This PR adds what live-state verification showed was still needed before the migration is deployable. Closes#104.

Summary

  • All of fix(bridge): migrate L1 deposits and quotes from deprecated Mailbox to Bridgehub #121: deposits via Bridgehub.requestL2TransactionDirect, quotes via Bridgehub.l2TransactionBaseCost, proof paths untouched on the Diamond, MockBridgehub unit coverage, fork-PR coverage CI fix.
  • New: LEGACY_BRIDGE replay guard. Withdrawal messages are (selector, receiver, amount) with no nonce; replay protection is each instance's own isWithdrawalFinalized map, which starts empty on a redeployment — and this migration forces a redeployment (L1_MAILBOX is immutable). Verified on a mainnet fork: a fresh bridge with MINTER_ROLE re-mints withdrawals the live bridge already paid out (~347M NODL replayable today, incl. a 286.7M and a 60.2M withdrawal, batch 511315). finalizeWithdrawal now reverts with WithdrawalFinalizedOnLegacyBridge for anything the predecessor already finalized.
  • New: mainnet-fork test suite (test/fork/L1BridgeMainnetFork.t.sol, self-skips without MAINNET_RPC_URL) — validates the migration against the real deployed zkSync contracts, not mocks, including a simulated Mailbox cutoff and a real historical withdrawal proof.
  • New: cutover runbook + deprecation canary (ops/bridgehub-migration-cutover.md, ops/check_zksync_deprecation.sh).

Live-state verification (2026-07-09)

CheckResult
Full unit suite1203 passed, 0 failed (fork tests skip without RPC)
Fork: deposit via real Bridgehub → priority op on Era Diamond✅
Fork: deposit survives simulated requestL2Transaction cutoff (old bridge breaks, new works)✅
Fork: Bridgehub quote == legacy Mailbox quote✅ byte-identical
Fork: real withdrawal proof (batch 503366, idx 17, already paid) blocked by guard✅ WithdrawalFinalizedOnLegacyBridge
Fork: same proof on an unguarded deployment⚠️ re-mints — the guard is load-bearing
Era protocol versionsmainnet v29.4, Sepolia v29.1 — deprecation not yet enforced (announcement, cutoff ~mid-Sept 2026)
yarn lint / yarn spellcheck0 errors / 0 issues

Deployment (see ops/bridgehub-migration-cutover.md for the full runbook)

Constructor gains _legacyBridge (zero allowed only for first-ever deployments). Key sequencing rule: the old bridge must be paused (and optionally de-minted) in the same ops window the new bridge goes live — until then a withdrawal can be finalized on both instances. In-flight withdrawals are not stuck: the guard only blocks pairs the old bridge already paid, so pre-cutover withdrawals finalize on the new bridge.

Test plan

  • forge test — 1203/1203
  • MAINNET_RPC_URL=… forge test --match-contract L1BridgeMainnetForkTest — 5/5 against live mainnet state
  • ops/check_zksync_deprecation.sh mainnet|sepolia — reports v29.4 / v29.1, legacy path still accepted
  • Sepolia rehearsal per runbook (deposit → mint, withdraw → finalize, failed deposit → claim, legacy replay → revert)
  • Rerun Sepolia loop once the canary detects testnet enforcement, then schedule mainnet cutover

🤖 Generated with Claude Code

DrVelvetFogand others added 6 commits July 2, 2026 08:38
@DrVelvetFog@claude
fix(bridge): migrate L1 deposits and quotes from Mailbox to Bridgehub
57006ac
ZKsync has deprecated Mailbox.requestL2Transaction (and its
l2TransactionBaseCost quoting) in favor of the Bridgehub, with the
legacy entry points scheduled to stop working around mid-September.
This routes L1Bridge deposits through Bridgehub.requestL2TransactionDirect
and sources base-cost quotes from Bridgehub.l2TransactionBaseCost,
scoped by the new L2_CHAIN_ID immutable.
The Mailbox (Diamond proxy) stays for the L2->L1 proof paths
(proveL1ToL2TransactionStatus / proveL2MessageInclusion), which are
not deprecated. External function signatures are unchanged; the
constructor gains _bridgehub and _l2ChainId, so this ships as a new
deployment rather than an upgrade (cutover notes in the PR).
- src/bridge/L1Bridge.sol: Bridgehub routing for deposit + quotes,
mintValue = msg.value per the Bridgehub's ETH-chain invariant
- test: new MockBridgehub (mirrors the MockMailbox not-inheriting
pattern); MockMailbox trimmed to the proof paths; new coverage for
request-field mapping and zero-bridgehub / zero-chain-id constructor
guards (26 bridge tests, full suite 1080 green)
- script/DeployL1Bridge.s.sol + ops/deploy_L1L2_bridge.sh: BRIDGEHUB
and L2_CHAIN_ID env vars
Closes#104
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@DrVelvetFog@claude
ci: skip coverage PR comment for fork PRs
6ba4005
The Coverage job's 'Report coverage to PR' step fails on pull requests
from forks with 'Resource not accessible by integration': GitHub caps
GITHUB_TOKEN at read-only for fork-triggered pull_request runs, so the
sticky comment can never be posted (same-repo PRs are unaffected and
keep the comment). Gate the step on the head repo being this repo; the
coverage run, artifact upload, and threshold check still execute for
fork PRs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@aliXsed
Merge branch 'main' into fix/104-bridgehub-migration
7026187
@aliXsed@claude
feat(bridge): reject withdrawals already finalized by a legacy bridge…
5d66be0
… deployment
Withdrawal messages carry no nonce, so replay protection is each instance's
own isWithdrawalFinalized map — a redeployment (forced by the Bridgehub
migration, since L1_MAILBOX is immutable) would re-mint every withdrawal the
old bridge already paid out (~347M NODL currently replayable, verified on a
mainnet fork). New LEGACY_BRIDGE immutable makes finalizeWithdrawal revert
for (batch, index) pairs the predecessor already finalized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@aliXsed@claude
test(bridge): mainnet-fork suite validating the Bridgehub migration o…
271bac8
…n live state
Skipped unless MAINNET_RPC_URL is set. Against the real deployed zkSync
contracts: deposits enqueue a priority op via the Bridgehub, survive a
simulated legacy-Mailbox cutoff, quotes match the Mailbox exactly, and a
real historical withdrawal proof exercises both the proof path and the
LEGACY_BRIDGE replay guard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@aliXsed@claude
ops: Bridgehub cutover runbook and Mailbox-deprecation canary
5e56c3f
Runbook covers deployment sequencing (why the old bridge must stop minting
in the same ops window), in-flight deposit/withdrawal handling, and the
Sepolia rehearsal. The canary script reports the Era protocol version and
exits non-zero once the deprecated entrypoint starts reverting, for cron/CI.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@aliXsedaliXsed mentioned this pull request Jul 9, 2026
Closed
@github-actions

github-actionsBot commented Jul 9, 2026

Copy link
Copy Markdown

LCOV of commit 6591d26 during checks #749

Summary coverage rate:
lines......: 26.9% (939 of 3494 lines)
functions..: 27.4% (150 of 547 functions)
branches...: 27.7% (164 of 592 branches)
Files changed coverage rate:
|Lines |Functions |Branches Filename |Rate Num|Rate Num|Rate Num
========================================================================================
script/DeployL1Bridge.s.sol | 0.0% 28| 0.0% 2| 0.0% 3
src/bridge/L1Bridge.sol | 0.0% 65| 0.0% 9| 0.0% 11
test/bridge/L1Bridge.t.sol | 0.0% 37| 0.0% 9| 0.0% 11

@aliXsed
aliXsed merged commit 5d70e85 into mainJul 9, 2026
3 checks passed
@aliXsed
aliXsed deleted the fix/104-bridgehub-migration-hardened branch July 9, 2026 04:12
@DrVelvetFog

DrVelvetFog commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Appreciate this, @aliXsed — and that you fork-tested it against live state before merging. Nice catch turning the redeployment-sequencing note into the LEGACY_BRIDGE guard; a fresh instance's empty isWithdrawalFinalized map is exactly the kind of thing that bites on cutover. Happy to help with the deployment sequencing / MINTER_ROLE handoff whenever you schedule it.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ZKsync Mailbox functions deprecation

2 participants

@aliXsed@DrVelvetFog