Fixes for upgrade testing (#1987)

l1-contracts/deploy-scripts/AdminFunctions.s.sol

@@ -28,6 +28,7 @@ import {BridgehubBurnCTMAssetData, IBridgehub} from "contracts/bridgehub/IBridge
 import {AddressAliasHelper} from "contracts/vendor/AddressAliasHelper.sol";
 import {L2_ASSET_ROUTER_ADDR} from "contracts/common/l2-helpers/L2ContractAddresses.sol";
 import {IL2AssetRouter} from "contracts/bridge/asset-router/IL2AssetRouter.sol";
+import {IL1AssetRouter} from "contracts/bridge/asset-router/IL1AssetRouter.sol";
 
 bytes32 constant SET_TOKEN_MULTIPLIER_SETTER_ROLE = keccak256("SET_TOKEN_MULTIPLIER_SETTER_ROLE");
 
@@ -62,6 +63,36 @@ contract AdminFunctions is Script {
         });
     }
 
+    // This function should be called by governance to accept ownership of all core contracts
+    // Only accepts ownership for contracts that have pendingOwner set to governance
+    function governanceAcceptOwnerAggregated(address governor, address bridgehub) public {
+        // Query contract addresses from bridgehub
+        address assetRouter = IBridgehub(bridgehub).assetRouter();
+        address chainAssetHandler = IBridgehub(bridgehub).chainAssetHandler();
+        address ctmDeploymentTracker = address(IBridgehub(bridgehub).l1CtmDeployer());
+
+        // Query l1Nullifier from assetRouter
+        IL1AssetRouter assetRouterContract = IL1AssetRouter(assetRouter);
+        address l1Nullifier = address(assetRouterContract.L1_NULLIFIER());
+
+        // Accept ownership only for contracts with pending ownership
+        if (Ownable2Step(bridgehub).pendingOwner() == governor) {
+            governanceAcceptOwner(governor, bridgehub);
+        }
+        if (Ownable2Step(assetRouter).pendingOwner() == governor) {
+            governanceAcceptOwner(governor, assetRouter);
+        }
+        if (Ownable2Step(l1Nullifier).pendingOwner() == governor) {
+            governanceAcceptOwner(governor, l1Nullifier);
+        }
+        if (Ownable2Step(ctmDeploymentTracker).pendingOwner() == governor) {
+            governanceAcceptOwner(governor, ctmDeploymentTracker);
+        }
+        if (Ownable2Step(chainAssetHandler).pendingOwner() == governor) {
+            governanceAcceptOwner(governor, chainAssetHandler);
+        }
+    }
+
     // This function should be called by the owner to accept the admin role
     function governanceAcceptAdmin(address governor, address target) public {
         IZKChain adminContract = IZKChain(target);

l1-contracts/deploy-scripts/DeployL1CoreContracts.s.sol

@@ -173,11 +173,17 @@ contract DeployL1CoreContractsScript is Script, DeployL1HelperScript {
         IL1AssetRouter sharedBridge = IL1AssetRouter(addresses.bridges.l1AssetRouterProxy);
         IOwnable(address(sharedBridge)).transferOwnership(addresses.governance);
 
+        // Transfer L1Nullifier ownership to governance
+        IOwnable(addresses.bridges.l1NullifierProxy).transferOwnership(addresses.governance);
+
         ICTMDeploymentTracker ctmDeploymentTracker = ICTMDeploymentTracker(
             addresses.bridgehub.ctmDeploymentTrackerProxy
         );
         IOwnable(address(ctmDeploymentTracker)).transferOwnership(addresses.governance);
 
+        // Transfer ChainAssetHandler ownership to governance
+        IOwnable(addresses.bridgehub.chainAssetHandlerProxy).transferOwnership(addresses.governance);
+
         vm.stopBroadcast();
         console.log("Owners updated");
     }

l1-contracts/deploy-scripts/DeployL1HelperScript.s.sol

@@ -211,7 +211,7 @@ abstract contract DeployL1HelperScript is Script, DeployUtils {
                 return
                     abi.encodeCall(
                         L1NativeTokenVault.initialize,
-                        (config.ownerAddress, addresses.bridges.bridgedTokenBeacon)
+                        (addresses.governance, addresses.bridges.bridgedTokenBeacon)
                     );
             } else if (compareStrings(contractName, "ChainTypeManager")) {
                 return

l1-contracts/foundry.toml

@@ -8,6 +8,11 @@ test = "test/foundry"
 solc_version = "0.8.28"
 evm_version = "cancun"
 fs_permissions = [
+    { access = "read-write", path = "./test/foundry/l1/integration/deploy-scripts/script-config/" },
+    { access = "read-write", path = "./test/foundry/l1/integration/deploy-scripts/script-out/" },
+    { access = "read-write", path = "./test/foundry/l1/integration/upgrade-envs/script-config/" },
+    { access = "read-write", path = "./test/foundry/l1/integration/upgrade-envs/script-out/" },
+    { access = "read-write", path = "./script-out" },
     { access = "read", path = "../system-contracts/bootloader/build/artifacts" },
     { access = "read", path = "../system-contracts/artifacts-zk/" },
     { access = "read", path = "../system-contracts/contracts-preprocessed/precompiles/artifacts" },
@@ -17,17 +22,11 @@ fs_permissions = [
     { access = "read", path = "../l2-contracts/artifacts-zk/" },
     { access = "read", path = "../l2-contracts/zkout/" },
     { access = "read", path = "../l1-contracts/artifacts-zk/" },
-    { access = "read-write", path = "../l1-contracts/script-out/" },
     { access = "read", path = "../da-contracts/" },
     { access = "read", path = "../system-contracts/zkout/" },
     { access = "read", path = "./script-config" },
-    { access = "read-write", path = "./script-out" },
     { access = "read", path = "./upgrade-envs/" },
     { access = "read", path = "./out" },
-    { access = "read-write", path = "./test/foundry/l1/integration/deploy-scripts/script-config/" },
-    { access = "read-write", path = "./test/foundry/l1/integration/deploy-scripts/script-out/" },
-    { access = "read-write", path = "./test/foundry/l1/integration/upgrade-envs/script-config/" },
-    { access = "read-write", path = "./test/foundry/l1/integration/upgrade-envs/script-out/" },
     { access = "read", path = "zkout" },
     { access = "read", path = "./deploy-scripts/evm-predeploys/evm-predeploy-datas" },
 ]

l1-contracts/test/foundry/l1/integration/AssetRouterTest.t.sol

@@ -30,6 +30,7 @@ import {DataEncoding} from "contracts/common/libraries/DataEncoding.sol";
 import {BridgeHelper} from "contracts/bridge/BridgeHelper.sol";
 import {BridgedStandardERC20, IBridgedStandardToken, NonSequentialVersion} from "contracts/bridge/BridgedStandardERC20.sol";
 import {IERC20} from "@openzeppelin/contracts-v4/token/ERC20/IERC20.sol";
+import {UpgradeableBeacon} from "@openzeppelin/contracts-v4/proxy/beacon/UpgradeableBeacon.sol";
 import {ConfigSemaphore} from "./utils/_ConfigSemaphore.sol";
 
 contract AssetRouterIntegrationTest is L1ContractDeployer, ZKChainDeployer, TokenDeployer, L2TxMocker, ConfigSemaphore {
@@ -132,8 +133,9 @@ contract AssetRouterIntegrationTest is L1ContractDeployer, ZKChainDeployer, Toke
         BridgedStandardERC20 bridgedToken = BridgedStandardERC20(
             addresses.l1NativeTokenVault.tokenAddress(l2TokenAssetId)
         );
-        address owner = addresses.l1NativeTokenVault.owner();
-        vm.broadcast(owner);
+        address beaconAddress = address(addresses.l1NativeTokenVault.bridgedTokenBeacon());
+        address beaconOwner = UpgradeableBeacon(beaconAddress).owner();
+        vm.prank(beaconOwner);
         bridgedToken.reinitializeToken(
             BridgedStandardERC20.ERC20Getters({ignoreName: false, ignoreSymbol: false, ignoreDecimals: false}),
             "TestnetERC20Token",