Skip to content

Conversation

@Wazabie
Copy link
Contributor

@Wazabie Wazabie commented Oct 27, 2025

Jovian U17 upgrade task for Arena-Z, Swell Mainnets

@Wazabie Wazabie requested review from a team as code owners October 27, 2025 08:42
@Wazabie Wazabie requested a review from agusduha October 27, 2025 08:42
Comment on lines 13 to 19
cd src/tasks/eth/033-U17-main-arena-z-swell
SIMULATE_WITHOUT_LEDGER=1 just --dotenv-path $(pwd)/.env simulate <council|foundation>
```

Signing commands for each safe:
```bash
cd src/tasks/eth/033-U17-main-arena-z-swell
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Directory references in the README are inconsistent with the actual task directory. Lines 13 and 19 reference cd src/tasks/eth/033-U17-main-arena-z-swell, but the actual task directory is 034-U17-main-arena-z-swell (as shown in line 1). This mismatch will cause operators to execute commands in the wrong directory, potentially leading to task execution failures. Update both directory references to cd src/tasks/eth/034-U17-main-arena-z-swell to match the actual task directory.

Suggested change
cd src/tasks/eth/033-U17-main-arena-z-swell
SIMULATE_WITHOUT_LEDGER=1 just --dotenv-path $(pwd)/.env simulate <council|foundation>
```
Signing commands for each safe:
```bash
cd src/tasks/eth/033-U17-main-arena-z-swell
cd src/tasks/eth/034-U17-main-arena-z-swell
SIMULATE_WITHOUT_LEDGER=1 just --dotenv-path $(pwd)/.env simulate <council|foundation>

Signing commands for each safe:

cd src/tasks/eth/034-U17-main-arena-z-swell

Spotted by Graphite Agent (based on custom rule: Superchain Ops task/template review)

Fix in Graphite


Is this helpful? React 👍 or 👎 to let us know.

@Wazabie Wazabie self-assigned this Oct 27, 2025

[[opcmUpgrades]]
chainId = 7897
absolutePrestate = "0x038dca684026d946d1d0ddb05d50685d1a0dab350b89d10b6705e83c41ec8755" # prestates."1.7.0-rc.5" https://github.com/ethereum-optimism/devnets/issues/123#issuecomment-3444735369
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The GitHub comment URL contains an unusually long ID (3444735369) which appears to be incorrect. Standard GitHub comment IDs are typically shorter. This may prevent others from verifying the prestate hash source. Please verify the correct URL for the referenced comment in issue #123 to ensure proper traceability of this critical value.

Spotted by Graphite Agent

Fix in Graphite


Is this helpful? React 👍 or 👎 to let us know.

Comment on lines +15 to +23
> ### Nested Safe 1 (Foundation): `0x847B5c174615B1B7fDF770882256e2D3E95b9D92`
>
> - Domain Hash: `0xa4a9c312badf3fcaa05eafe5dc9bee8bd9316c78ee8b0bebe3115bb21b732672`
> - Message Hash: `0x217eb40268563e05b26fb1e487a307d8db494190efec5afb29b17971c8b8a116`
>
> ### Nested Safe 2 (Security Council): `0xc2819DC788505Aac350142A7A707BF9D03E3Bd03`
>
> - Domain Hash: `0xdf53d510b56e539b90b369ef08fce3631020fbf921e3136ea5f8747c20bce967`
> - Message Hash: `0x3cc2f5da158352f9690a7cc6c54dcd1938352f443ffb72d77af95072b3e707ce`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When reviewing Superchain Ops tasks and templates, look for places that the tasks/templates can be made more robust, safer, etc. The validation document provides hardcoded domain and message hashes but lacks sufficient robustness measures. To make this safer, it should include: 1) Instructions on how to independently verify these hash values, 2) Clear warnings about the consequences of signing incorrect hashes, 3) Cross-reference sources or calculation methods for the hashes, 4) Additional verification steps beyond just visual comparison. The current approach relies solely on manual hash comparison which is error-prone and could lead to signing malicious transactions if the documented hashes are compromised.

Suggested change
> ### Nested Safe 1 (Foundation): `0x847B5c174615B1B7fDF770882256e2D3E95b9D92`
>
> - Domain Hash: `0xa4a9c312badf3fcaa05eafe5dc9bee8bd9316c78ee8b0bebe3115bb21b732672`
> - Message Hash: `0x217eb40268563e05b26fb1e487a307d8db494190efec5afb29b17971c8b8a116`
>
> ### Nested Safe 2 (Security Council): `0xc2819DC788505Aac350142A7A707BF9D03E3Bd03`
>
> - Domain Hash: `0xdf53d510b56e539b90b369ef08fce3631020fbf921e3136ea5f8747c20bce967`
> - Message Hash: `0x3cc2f5da158352f9690a7cc6c54dcd1938352f443ffb72d77af95072b3e707ce`
> ### Nested Safe 1 (Foundation): `0x847B5c174615B1B7fDF770882256e2D3E95b9D92`
>
> - Domain Hash: `0xa4a9c312badf3fcaa05eafe5dc9bee8bd9316c78ee8b0bebe3115bb21b732672`
> - Message Hash: `0x217eb40268563e05b26fb1e487a307d8db494190efec5afb29b17971c8b8a116`
>
> ### Nested Safe 2 (Security Council): `0xc2819DC788505Aac350142A7A707BF9D03E3Bd03`
>
> - Domain Hash: `0xdf53d510b56e539b90b369ef08fce3631020fbf921e3136ea5f8747c20bce967`
> - Message Hash: `0x3cc2f5da158352f9690a7cc6c54dcd1938352f443ffb72d77af95072b3e707ce`
>
> ### ⚠️ IMPORTANT: Verification Instructions ⚠️
>
> **WARNING**: Signing incorrect hashes could lead to unauthorized transactions or loss of funds. Always verify hashes through multiple methods before signing.
>
> **How to verify these hashes independently:**
>
> 1. Use the Safe UI to view the transaction details and compare the displayed hashes
> 2. Use the Safe SDK or ethers.js to calculate the domain and message hashes using the transaction parameters
> 3. Cross-reference the transaction details with the official proposal documentation at [link to proposal]
> 4. Verify the contract addresses and parameters match the expected operation (Z-Swell arena upgrade)
>
> **Hash calculation method:**
>
> - Domain hashes are calculated using EIP-712 with the Safe domain parameters
> - Message hashes are derived from the transaction parameters including target address, value, and calldata
>
> **Additional verification steps:**
>
> - Confirm the transaction on a hardware wallet that displays full transaction details
> - Have at least two separate signers independently verify the hashes through different methods
> - Check that the transaction target and parameters match the expected operation

Spotted by Graphite Agent (based on custom rule: Superchain Ops task/template review)

Fix in Graphite


Is this helpful? React 👍 or 👎 to let us know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant