[DO NOT MERGE]: EVM emulator

.github/workflows/system-contracts-ci.yaml

@@ -80,7 +80,7 @@ jobs:
       - name: Install rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          toolchain: nightly-2023-04-17
+          toolchain: nightly-2024-08-01
 
       - name: Restore artifacts cache
         uses: actions/cache/restore@v3
@@ -143,3 +143,37 @@ jobs:
       - name: Print output logs of era_test_node
         if: always()
         run: cat era_test_node.log
+
+  check-hashes:
+    needs: [build]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.18.0
+          cache: yarn
+
+      - name: Install dependencies
+        run: yarn
+
+      - name: Restore artifacts cache
+        uses: actions/cache/restore@v3
+        with:
+          fail-on-cache-miss: true
+          key: artifacts-system-${{ github.sha }}
+          path: |
+            system-contracts/zkout
+            system-contracts/cache-forge
+            system-contracts/bootloader/build
+            system-contracts/artifacts-zk
+            system-contracts/cache-zk
+            system-contracts/typechain
+            system-contracts/contracts-preprocessed
+
+      - name: Check hashes
+        run: yarn sc calculate-hashes:check

.gitignore

@@ -28,3 +28,5 @@ l1-contracts/script-config/*
 l1-contracts/script-out/*
 !l1-contracts/script-out/.gitkeep
 *.timestamp
+l1-contracts/test/foundry/l1/integration/deploy-scripts/script-out/*
+l1-contracts/zkout/*

.solhintignore

@@ -8,6 +8,7 @@ l1-contracts/lib
 l1-contracts/node_modules
 l1-contracts/contracts/dev-contracts
 l1-contracts/test
+l1-contracts/deploy-scripts
 
 # l1-contracts-foundry
 l1-contracts-foundry/cache
@@ -16,6 +17,7 @@ l1-contracts-foundry/lib
 # l2-contracts
 l2-contracts/cache-zk
 l2-contracts/node_modules
+l2-contracts/contracts/dev-contracts
 
 # system-contracts
 system-contracts/contracts/openzeppelin

l1-contracts/contracts/bridge/L1SharedBridge.sol

@@ -22,7 +22,7 @@ import {ETH_TOKEN_ADDRESS, TWO_BRIDGES_MAGIC_VALUE} from "../common/Config.sol";
 import {IBridgehub, L2TransactionRequestTwoBridgesInner, L2TransactionRequestDirect} from "../bridgehub/IBridgehub.sol";
 import {IGetters} from "../state-transition/chain-interfaces/IGetters.sol";
 import {L2_BASE_TOKEN_SYSTEM_CONTRACT_ADDR} from "../common/L2ContractAddresses.sol";
-import {Unauthorized, ZeroAddress, SharedBridgeValueAlreadySet, SharedBridgeKey, NoFundsTransferred, ZeroBalance, ValueMismatch, TokensWithFeesNotSupported, NonEmptyMsgValue, L2BridgeNotSet, TokenNotSupported, DepositIncorrectAmount, EmptyDeposit, DepositExists, AddressAlreadyUsed, InvalidProof, DepositDoesNotExist, InsufficientChainBalance, SharedBridgeValueNotSet, WithdrawalAlreadyFinalized, WithdrawFailed, L2WithdrawalMessageWrongLength, InvalidSelector, SharedBridgeBalanceMismatch, SharedBridgeValueNotSet} from "../common/L1ContractErrors.sol";
+import {Unauthorized, ZeroAddress, SharedBridgeValueAlreadySet, SharedBridgeKey, NoFundsTransferred, ZeroBalance, ValueMismatch, TokensWithFeesNotSupported, NonEmptyMsgValue, L2BridgeNotSet, TokenNotSupported, DepositIncorrectAmount, EmptyDeposit, DepositExists, AddressAlreadyUsed, InvalidProof, DepositDoesNotExist, InsufficientChainBalance, SharedBridgeValueNotSet, WithdrawalAlreadyFinalized, WithdrawFailed, L2WithdrawalMessageWrongLength, InvalidSelector, SharedBridgeBalanceMismatch, SharedBridgeValueNotSet, NotPendingAdmin, L2BridgeAlreadySet} from "../common/L1ContractErrors.sol";
 
 /// @author Matter Labs
 /// @custom:security-contact [email protected]
@@ -130,7 +130,9 @@ contract L1SharedBridge is IL1SharedBridge, ReentrancyGuard, Ownable2StepUpgrade
 
     /// @notice Checks that the message sender is either the owner or admin.
     modifier onlyOwnerOrAdmin() {
-        require(msg.sender == owner() || msg.sender == admin, "ShB not owner or admin");
+        if (msg.sender != owner() && msg.sender != admin) {
+            revert Unauthorized(msg.sender);
+        }
         _;
     }
 
@@ -174,7 +176,9 @@ contract L1SharedBridge is IL1SharedBridge, ReentrancyGuard, Ownable2StepUpgrade
     /// @notice Accepts transfer of admin rights. Only pending admin can accept the role.
     function acceptAdmin() external {
         address currentPendingAdmin = pendingAdmin;
-        require(msg.sender == currentPendingAdmin, "ShB not pending admin"); // Only proposed by current admin address can claim the admin rights
+        if (msg.sender != currentPendingAdmin) {
+            revert NotPendingAdmin();
+        }
 
         address previousAdmin = admin;
         admin = currentPendingAdmin;
@@ -276,8 +280,12 @@ contract L1SharedBridge is IL1SharedBridge, ReentrancyGuard, Ownable2StepUpgrade
     /// @param _chainId The chain ID for which the l2Bridge address is being initialized.
     /// @param _l2BridgeAddress The address of the L2 bridge contract.
     function initializeChainGovernance(uint256 _chainId, address _l2BridgeAddress) external onlyOwnerOrAdmin {
-        require(l2BridgeAddress[_chainId] == address(0), "ShB: l2 bridge already set");
-        require(_l2BridgeAddress != address(0), "ShB: l2 bridge 0");
+        if (l2BridgeAddress[_chainId] != address(0)) {
+            revert L2BridgeAlreadySet(_chainId);
+        }
+        if (_l2BridgeAddress == address(0)) {
+            revert ZeroAddress();
+        }
         l2BridgeAddress[_chainId] = _l2BridgeAddress;
     }
 
@@ -287,7 +295,9 @@ contract L1SharedBridge is IL1SharedBridge, ReentrancyGuard, Ownable2StepUpgrade
     /// @param _chainId The chain ID for which the l2Bridge address is being initialized.
     /// @param _l2BridgeAddress The address of the L2 bridge contract.
     function reinitializeChainGovernance(uint256 _chainId, address _l2BridgeAddress) external onlyOwner {
-        require(l2BridgeAddress[_chainId] != address(0), "ShB: l2 bridge not yet set");
+        if (l2BridgeAddress[_chainId] == address(0)) {
+            revert L2BridgeNotSet(_chainId);
+        }
         l2BridgeAddress[_chainId] = _l2BridgeAddress;
     }
 

l1-contracts/contracts/common/L1ContractErrors.sol

@@ -1,6 +1,28 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.21;
 
+// 0x5ecf2d7a
+error AccessToFallbackDenied(address target, address invoker);
+// 0x3995f750
+error AccessToFunctionDenied(address target, bytes4 selector, address invoker);
+// 0x6c167909
+error OnlySelfAllowed();
+// 0x52e22c98
+error RestrictionWasNotPresent(address restriction);
+// 0xf126e113
+error RestrictionWasAlreadyPresent(address restriction);
+// 0x3331e9c0
+error CallNotAllowed(bytes call);
+// 0x59e1b0d2
+error ChainZeroAddress();
+// 0xff4bbdf1
+error NotAHyperchain(address chainAddress);
+// 0xa3decdf3
+error NotAnAdmin(address expected, address actual);
+// 0xf6fd7071
+error RemovingPermanentRestriction();
+// 0xfcb9b2e1
+error UnallowedImplementation(bytes32 implementationHash);
 // 0x1ff9d522
 error AddressAlreadyUsed(address addr);
 // 0x86bb51b8
@@ -115,6 +137,8 @@ error InvalidValue();
 error L2BridgeNotDeployed(uint256 chainId);
 // 0xff8811ff
 error L2BridgeNotSet(uint256 chainId);
+// 0x685577fa
+error L2BridgeAlreadySet(uint256 chainId);
 // 0xcb5e4247
 error L2BytecodeHashMismatch(bytes32 expected, bytes32 provided);
 // 0xfb5c22e6
@@ -171,6 +195,8 @@ error NonZeroAddress(address);
 error NotEnoughGas();
 // 0xdd7e3621
 error NotInitializedReentrancyGuard();
+// 0x058d9a1b
+error NotPendingAdmin();
 // 0xf3ed9dfa
 error OnlyEraSupported();
 // 0x1a21feed

l1-contracts/contracts/dev-contracts/test/CustomUpgradeTest.sol

@@ -31,7 +31,12 @@ contract CustomUpgradeTest is BaseZkSyncUpgrade {
         (uint32 newMinorVersion, bool isPatchOnly) = _setNewProtocolVersion(_proposedUpgrade.newProtocolVersion);
         _upgradeL1Contract(_proposedUpgrade.l1ContractsUpgradeCalldata);
         _upgradeVerifier(_proposedUpgrade.verifier, _proposedUpgrade.verifierParams);
-        _setBaseSystemContracts(_proposedUpgrade.bootloaderHash, _proposedUpgrade.defaultAccountHash, isPatchOnly);
+        _setBaseSystemContracts(
+            _proposedUpgrade.bootloaderHash,
+            _proposedUpgrade.defaultAccountHash,
+            _proposedUpgrade.evmEmulatorHash,
+            isPatchOnly
+        );
 
         bytes32 txHash;
         txHash = _setL2SystemContractUpgrade(

l1-contracts/contracts/dev-contracts/test/ExecutorProvingTest.sol

@@ -32,10 +32,15 @@ contract ExecutorProvingTest is ExecutorFacet {
         return _processL2Logs(_newBatch, _expectedSystemContractUpgradeTxHash);
     }
 
-    /// Sets the DefaultAccount Hash and Bootloader Hash.
-    function setHashes(bytes32 l2DefaultAccountBytecodeHash, bytes32 l2BootloaderBytecodeHash) external {
+    /// Sets the DefaultAccount Hash, Bootloader Hash and EVM emulator Hash.
+    function setHashes(
+        bytes32 l2DefaultAccountBytecodeHash,
+        bytes32 l2BootloaderBytecodeHash,
+        bytes32 l2EvmEmulatorBytecode
+    ) external {
         s.l2DefaultAccountBytecodeHash = l2DefaultAccountBytecodeHash;
         s.l2BootloaderBytecodeHash = l2BootloaderBytecodeHash;
+        s.l2EvmEmulatorBytecodeHash = l2EvmEmulatorBytecode;
         s.zkPorterIsAvailable = false;
     }
 }

l1-contracts/contracts/dev-contracts/test/ReenterGovernance.sol

@@ -3,6 +3,7 @@
 pragma solidity 0.8.24;
 
 import {IGovernance} from "../../governance/IGovernance.sol";
+import {Call} from "../../governance/Common.sol";
 
 contract ReenterGovernance {
     // add this to be excluded from coverage report
@@ -12,7 +13,7 @@ contract ReenterGovernance {
 
     // Store call, predecessor and salt separately,
     // because Operation struct can't be stored on storage.
-    IGovernance.Call call;
+    Call call;
     bytes32 predecessor;
     bytes32 salt;
 
@@ -45,7 +46,7 @@ contract ReenterGovernance {
     fallback() external payable {
         if (!alreadyReentered) {
             alreadyReentered = true;
-            IGovernance.Call[] memory calls = new IGovernance.Call[](1);
+            Call[] memory calls = new Call[](1);
             calls[0] = call;
             IGovernance.Operation memory op = IGovernance.Operation({
                 calls: calls,

l1-contracts/contracts/governance/Common.sol

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity 0.8.24;
+
+/// @dev Represents a call to be made during multicall.
+/// @param target The address to which the call will be made.
+/// @param value The amount of Ether (in wei) to be sent along with the call.
+/// @param data The calldata to be executed on the `target` address.
+struct Call {
+    address target;
+    uint256 value;
+    bytes data;
+}

l1-contracts/contracts/governance/Governance.sol

@@ -4,6 +4,7 @@ pragma solidity 0.8.24;
 
 import {Ownable2Step} from "@openzeppelin/contracts-v4/access/Ownable2Step.sol";
 import {IGovernance} from "./IGovernance.sol";
+import {Call} from "./Common.sol";
 import {ZeroAddress, Unauthorized, OperationMustBeReady, OperationMustBePending, OperationExists, InvalidDelay, PreviousOperationNotExecuted} from "../common/L1ContractErrors.sol";
 
 /// @author Matter Labs

l1-contracts/contracts/governance/IGovernance.sol

@@ -2,6 +2,8 @@
 // We use a floating point pragma here so it can be used within other projects that interact with the ZKsync ecosystem without using our exact pragma version.
 pragma solidity ^0.8.21;
 
+import {Call} from "./Common.sol";
+
 /// @title Governance contract interface
 /// @author Matter Labs
 /// @custom:security-contact [email protected]
@@ -18,16 +20,6 @@ interface IGovernance {
         Done
     }
 
-    /// @dev Represents a call to be made during an operation.
-    /// @param target The address to which the call will be made.
-    /// @param value The amount of Ether (in wei) to be sent along with the call.
-    /// @param data The calldata to be executed on the `target` address.
-    struct Call {
-        address target;
-        uint256 value;
-        bytes data;
-    }
-
     /// @dev Defines the structure of an operation that Governance executes.
     /// @param calls An array of `Call` structs, each representing a call to be made during the operation.
     /// @param predecessor The hash of the predecessor operation, that should be executed before this operation.

l1-contracts/contracts/state-transition/StateTransitionManager.sol

@@ -13,6 +13,7 @@ import {IDiamondInit} from "./chain-interfaces/IDiamondInit.sol";
 import {IExecutor} from "./chain-interfaces/IExecutor.sol";
 import {IStateTransitionManager, StateTransitionManagerInitializeData, ChainCreationParams} from "./IStateTransitionManager.sol";
 import {ISystemContext} from "./l2-deps/ISystemContext.sol";
+import {AllowedBytecodeTypes} from "./l2-deps/AllowedBytecodeTypes.sol";
 import {IZkSyncHyperchain} from "./chain-interfaces/IZkSyncHyperchain.sol";
 import {FeeParams} from "./chain-deps/ZkSyncHyperchainStorage.sol";
 import {L2_SYSTEM_CONTEXT_SYSTEM_CONTRACT_ADDR, L2_FORCE_DEPLOYER_ADDR} from "../common/L2ContractAddresses.sol";
@@ -322,8 +323,15 @@ contract StateTransitionManager is IStateTransitionManager, ReentrancyGuard, Own
     /// registration
 
     /// @dev we have to set the chainId at genesis, as blockhashzero is the same for all chains with the same chainId
-    function _setChainIdUpgrade(uint256 _chainId, address _chainContract) internal {
-        bytes memory systemContextCalldata = abi.encodeCall(ISystemContext.setChainId, (_chainId));
+    function _setChainConfigurationUpgrade(
+        uint256 _chainId,
+        AllowedBytecodeTypes _allowedBytecodeTypesMode,
+        address _chainContract
+    ) internal {
+        bytes memory systemContextCalldata = abi.encodeCall(
+            ISystemContext.setChainConfiguration,
+            (_chainId, uint256(_allowedBytecodeTypesMode))
+        );
         uint256[] memory uintEmptyArray;
         bytes[] memory bytesEmptyArray;
 
@@ -356,6 +364,7 @@ contract StateTransitionManager is IStateTransitionManager, ReentrancyGuard, Own
             factoryDeps: bytesEmptyArray,
             bootloaderHash: bytes32(0),
             defaultAccountHash: bytes32(0),
+            evmEmulatorHash: bytes32(0),
             verifier: address(0),
             verifierParams: VerifierParams({
                 recursionNodeLevelVkHash: bytes32(0),
@@ -395,26 +404,32 @@ contract StateTransitionManager is IStateTransitionManager, ReentrancyGuard, Own
     /// @param _baseToken the base token address used to pay for gas fees
     /// @param _sharedBridge the shared bridge address, used as base token bridge
     /// @param _admin the chain's admin address
-    /// @param _diamondCut the diamond cut data that initializes the chains Diamond Proxy
+    /// @param _inputData the input data for chain creation
     function createNewChain(
         uint256 _chainId,
         address _baseToken,
         address _sharedBridge,
         address _admin,
-        bytes calldata _diamondCut
+        bytes calldata _inputData
     ) external onlyBridgehub {
         if (getHyperchain(_chainId) != address(0)) {
             // Hyperchain already registered
             return;
         }
 
         // check not registered
+        (bytes memory _diamondCut, AllowedBytecodeTypes allowedBytecodeTypesMode) = abi.decode(
+            _inputData,
+            (bytes, AllowedBytecodeTypes)
+        );
         Diamond.DiamondCutData memory diamondCut = abi.decode(_diamondCut, (Diamond.DiamondCutData));
 
-        // check input
-        bytes32 cutHashInput = keccak256(_diamondCut);
-        if (cutHashInput != initialCutHash) {
-            revert HashMismatch(initialCutHash, cutHashInput);
+        {
+            // check input
+            bytes32 cutHashInput = keccak256(_diamondCut);
+            if (cutHashInput != initialCutHash) {
+                revert HashMismatch(initialCutHash, cutHashInput);
+            }
         }
 
         // construct init data
@@ -444,8 +459,8 @@ contract StateTransitionManager is IStateTransitionManager, ReentrancyGuard, Own
 
         _registerNewHyperchain(_chainId, hyperchainAddress);
 
-        // set chainId in VM
-        _setChainIdUpgrade(_chainId, hyperchainAddress);
+        // set chain configuration: chainId in VM and allowed bytecode types
+        _setChainConfigurationUpgrade(_chainId, allowedBytecodeTypesMode, hyperchainAddress);
     }
 
     /// @dev This internal function is used to register a new hyperchain in the system.

l1-contracts/contracts/state-transition/chain-deps/DiamondInit.sol

@@ -62,6 +62,7 @@ contract DiamondInit is ZkSyncHyperchainBase, IDiamondInit {
         s.__DEPRECATED_verifierParams = _initializeData.verifierParams;
         s.l2BootloaderBytecodeHash = _initializeData.l2BootloaderBytecodeHash;
         s.l2DefaultAccountBytecodeHash = _initializeData.l2DefaultAccountBytecodeHash;
+        s.l2EvmEmulatorBytecodeHash = _initializeData.l2EvmEmulatorBytecodeHash;
         s.priorityTxMaxGasLimit = _initializeData.priorityTxMaxGasLimit;
         s.feeParams = _initializeData.feeParams;
         s.blobVersionedHashRetriever = _initializeData.blobVersionedHashRetriever;

l1-contracts/contracts/state-transition/chain-deps/ZkSyncHyperchainStorage.sol

@@ -98,6 +98,9 @@ struct ZkSyncHyperchainStorage {
     /// @notice Bytecode hash of default account (bytecode for EOA).
     /// @dev Used as an input to zkp-circuit.
     bytes32 l2DefaultAccountBytecodeHash;
+    /// @notice Bytecode hash of evm emulator.
+    /// @dev Used as an input to zkp-circuit.
+    bytes32 l2EvmEmulatorBytecodeHash;
     /// @dev Indicates that the porter may be touched on L2 transactions.
     /// @dev Used as an input to zkp-circuit.
     bool zkPorterIsAvailable;

l1-contracts/contracts/state-transition/chain-deps/facets/Executor.sol

@@ -600,13 +600,13 @@ contract ExecutorFacet is ZkSyncHyperchainBase, IExecutor {
 
     function _batchMetaParameters() internal view returns (bytes memory) {
         bytes32 l2DefaultAccountBytecodeHash = s.l2DefaultAccountBytecodeHash;
+        bytes32 l2EvmEmulatorBytecodeHash = s.l2EvmEmulatorBytecodeHash;
         return
             abi.encodePacked(
                 s.zkPorterIsAvailable,
                 s.l2BootloaderBytecodeHash,
                 l2DefaultAccountBytecodeHash,
-                // VM 1.5.0 requires us to pass the EVM simulator code hash. For now it is the same as the default account.
-                l2DefaultAccountBytecodeHash
+                l2EvmEmulatorBytecodeHash
             );
     }