feat: migrate governance scripts from deployment-scripts branch

deployments.md

@@ -0,0 +1,156 @@
+## NTT Deployment:
+This document serves as an example of a possible order of execution of commands to perform a full deployment of NTT on Solana + one or more EVMs.
+
+### Requirements:
+NTT needs the following contracts to be able to operate. This doc assumes that these contracts are already deployed by the time you execute this deployment.
+
+Deployed by NTT deployment owner:
+- an ntt token
+
+Deployed by wormhole:
+- wormhole core layer
+- wormhole relayer (you can use wormhole's public one or deploy your own)
+
+### High level description of the process:
+To have a multi-chain NTT setup working a few things need to happen.
+- Deploy managers on EVM
+- Register managers on NTT Token
+- Deploy Transceivers on EVM
+- Deploy NTT Program on Solana
+- Set Mint authority to NTT program
+- Initialize NTT program on Solana
+- Cross register managers (let each manager know about the other managers)
+- Cross register transceivers
+
+## EVM Deployment:
+
+### Environments & Configuration:
+These scripts are implemented in way that helps keep track of the deployed addresses by reading contract addresses from json files that can be commited to the repository. Multiple environments are supported through the use of the `ENV` environment variable.
+To create or use a new env all that needs to be done is to create a new directory on `evm/ts-scripts/config/<my-env>` with the name of the env you want to use and then set the environment variable ENV to the same value (ie on linux: `export ENV="my-env"`)
+Inside the configuration directory, there needs to be a few files that will contain all the configuration you need to set up a full NTT deployment:
+- `chains.json` contains the configuration used by the deployment runner such as what rpcs will be used or what chains will it run scripts against
+- `contracts.json` this file contains the addresses of all contracts related to this deployment and will be used any time a script needs to know about the address of other of the contracts. Addresses of contracts will be written to this file as the deployment progress (ie after deploying managers we'll add the manager addresses here)
+- `managers.json` contains the configuration that will be applied to managers
+- `transceivers.json` contains the configuration that will be applied to transceivers
+- `peers.json` contains the configuration that will be used for contract cross-registrations
+
+> When a script deploys new contracts, it outputs the resulting addresseses on the directory `ts-scripts/output/<scripts-name>/<timestamp>.json (aside from logging them). Whenever we need to configure the addresses of a contract that we have just deployed we'll fetch the new addresses from those files.
+
+### Deployment Steps:
+- create/update `evm/config/<env>/contracts.json` as needed
+- create/update `evm/config/<env>/managers.json` as needed
+- create/update `evm/config/<env>/transceivers.json` as needed
+- Set environment variables:
+```
+export FOUNDRY_PROFILE=prod
+export WALLET_KEY="ledger"
+export LEDGER_BIP32_PATH=""
+export ENV=testnet
+```
+- Build:
+```shell
+make build-evm-prod
+cd evm/ts-scripts
+npm install
+cd .. 
+npm --prefix ./ts-scripts run build # builds typescript bindings to evm/ts-scripts/output
+```
+- Deploy Managers:
+```shell
+bash -c ./ts-scripts/shell/deploy-managers.sh
+#
+# Use the addresses to update the `contracts.json` file
+#
+```
+- Now that you have deployed your manager, you can go to your token deployment and configure the token to be managed by the managers you have deployed (aka, call `setMinter` on the token to the manager address).
+- Deploy Transceivers:
+```shell
+bash -c ./ts-scripts/shell/deploy-transceivers.sh
+#
+# Use the addresses to update the `contracts.json` file
+# 
+```
+- Configure Managers:
+```shell
+bash -c ./ts-scripts/shell/configure-managers.sh
+```
+
+## Solana Deployment:
+- set environment:
+```shell
+# Runner Configurations:
+export SOLANA_RPC_URL="" 
+export WORMHOLE_PROGRAM_ID="" # wormhole core layer program id
+export LEDGER_DERIVATION_PATH="" # derivation path
+
+# Deployment configuration:
+export MINT_ADDRESS="" # the program id of your spl token
+```
+- Create and set the pub key of the program:
+```shell
+solana-keygen grind --ignore-case --starts-with ntt:1
+```
+- use the pub key created to replace the `declare_id!` macro value on `lib.rs`
+- export the pub-key of the program:
+```
+export NTT_PROGRAM_ID=<your-program-key>
+```
+- Build:
+```
+cd solana
+anchor build --arch sbf -- --features "mainnet" # if you are deploying to tesnet, you should use "solana-devnet" instead of mainnet
+```
+- Deploy:
+```
+solana program -k usb://ledger?key=<your derivation path> deploy --url $SOLANA_RPC_URL --program-id "$NTT_PROGRAM_ID.json" target/deploy/example_native_token_transfers.so
+```
+- Initialize the program:
+``` shell
+make build
+npx tsx ./ts/scripts/initializeNtt.ts
+#
+# The script will print the manager emitter address PDA. You can always derive
+# this pda again, but might be easier if you take note of it at this point.
+# You'll need it later to do cross-registrations.
+#
+```
+
+## Cross Registrations:
+
+### EVM cross Registrations:
+- Create or update evm/config/<env>/peers.json (this file contains the data of all peers that the different evm deployments should know about. Note that the evm cross-registration script can find the addresses of its evm peers, but it can't find the solana peer address, so for solana you'll need to add two extra properties `managerAddress` and `transceiverAddress`. They correspond to the solana ntt deployment program-id and the manager-emitter-address PDA (the one printed during solana program initialization)
+- Run update peers script:
+```shell
+bash -c ./ts-scripts/shell/update-peer-addresses.sh
+```
+
+### Solana Cross Registrations:
+- update `evmNttDeployments` on solana/ts/scripts/env.ts with the addresses of your EVM managers and transceivers.
+- Run cross registrations script:
+```shell
+npx tsx ./ts/scripts/updatePeers.ts
+``` 
+
+## Contract Bytecode Verification:
+
+### EVM verification:
+On evm there are scripts that verify the deployed contracts. To run them you'll need a file with the etherscan scanners keys per each of the supported chains.
+Such file should have this structure:
+```json
+[
+  {
+    "chainId": 6,
+    "etherscan": "YOUR-ETTHERSCAN-API_KEY"
+  }
+]
+```
+Run verification scripts:
+```
+export SCANNER_TOKENS_FILE_PATH="the/path/to/file/above"
+bash -c ./evm/ts-scripts/shell/verify-managers.sh
+bash -c ./evm/ts-scripts/shell/verify-transceivers.sh
+```
+Finally, go to the etherscan scanner of the different chains and link the verified proxy to the verified implementation.
+
+### Solana Verification:
+TODO 

evm/.gitignore

@@ -0,0 +1 @@
+forge-build

evm/ts-scripts/.env.sample

@@ -0,0 +1,3 @@
+WALLET_KEY=
+LEDGER_BIP32_PATH=
+GUARDIAN_KEY=

evm/ts-scripts/.gitignore

@@ -0,0 +1,5 @@
+output
+contract-bindings
+.env
+.env.testnet
+.env.mainnet

evm/ts-scripts/config/mainnet/contracts.json

@@ -1,4 +1,22 @@
 {
+  "NttTransceiverProxies": [
+    {
+      "address": "0xDb55492d7190D1baE8ACbE03911C4E3E7426870c",
+      "chainId": 2
+    },
+    {
+      "address": "0xD1a8AB69e00266e8B791a15BC47514153A5045a6",
+      "chainId": 23
+    },
+    {
+      "address": "0x9bD8b7b527CA4e6738cBDaBdF51C22466756073d",
+      "chainId": 24
+    },
+    {
+      "address": "0xD1a8AB69e00266e8B791a15BC47514153A5045a6",
+      "chainId": 30
+    }
+  ],
   "GeneralPurposeGovernances": [
     {
       "address": "0x23Fea5514DFC9821479fBE18BA1D7e1A61f6FfCf",

evm/ts-scripts/config/testnet/contracts.json

@@ -1,4 +1,22 @@
 {
+  "NttTransceiverProxies": [
+    {
+      "address": "0x649fF7B32C2DE771043ea105c4aAb2D724497238",
+      "chainId": 10002
+    },
+    {
+      "address": "0xfA42603152E4f133F5F3DA610CDa91dF5821d8bc",
+      "chainId": 10003
+    },
+    {
+      "address": "0xeCF0496DE01e9Aa4ADB50ae56dB550f52003bdB7",
+      "chainId": 10005
+    },
+    {
+      "address": "0x149987472333cD48ac6D28293A338a1EEa6Be7EE",
+      "chainId": 10004
+    }
+  ],
   "GeneralPurposeGovernances": [
     {
       "address": "0x574B7864119C9223A9870Ea614dC91A8EE09E512",

evm/ts-scripts/config/testnet/governance-vaas.json

@@ -0,0 +1,18 @@
+[
+  {
+    "chainId": 10002,
+    "vaa": "AQAAAAABAO9GFw0p7M1k1+dApnFYahEtKd6We4dPSZa+FirgR0BNWAcESgcQvNguSV66noi7/0dY+/Vg4NvyjC3WSPsiTBcAAAAAALXylaUAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAExxsVgsLk1ikgAAAAAAAAAABHZW5lcmFsUHVycG9zZUdvdmVybmFuY2UBJxKVF/AWTB0ImtcuZp5XuQiHkJZtvXOBQe/2WWJfLq1P7s382UFVxn8YAATO/BQp"
+  },
+  {
+    "chainId": 10003,
+    "vaa": "AQAAAAABABRt1qnWaWa2nRm22+NDCbmX1SIt6uck4CFZf5OFhrHVP8HhCMWOfobvSmnrAp0aBCyg1Wq/smyZybczTthXnmMAAAAAAL931RgAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE0TeyxhuLDpwgAAAAAAAAAABHZW5lcmFsUHVycG9zZUdvdmVybmFuY2UBJxOBtlpI3KzLoErKPAVcQRKwcVuQwDldPHQjLRKRbsqJUro1K00ngYA1AATO/BQp"
+  },
+  {
+    "chainId": 10004,
+    "vaa": "AQAAAAABAH345FjR31wRQxliMQKFNmGmerZZ3VCzfJxnW4LYABHPCGlnicrUHmXSXfx6hMvdr560prlSoJqO8ard2a+dhJwAAAAAAEB58FMAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE19jKl8J3pksgAAAAAAAAAABHZW5lcmFsUHVycG9zZUdvdmVybmFuY2UBJxRyClkSi5btpuwpQMeJlAbk3FbQ3B0w54t8f7vO+Hrm6XtTibLkcMpKAATO/BQp"
+  },
+  {
+    "chainId": 10005,
+    "vaa": "AQAAAAABAGHthpHgkBKYghkiZ9wlsjq/yzfOrqtNQI84ZmrQcQX+NFQG2o1XhL2Gm+/iYZjFpmAX3Z9vVs+iMjstsbNwpZsBAAAAAK7WazAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEMpcRWPILd/UgAAAAAAAAAABHZW5lcmFsUHVycG9zZUdvdmVybmFuY2UBJxXOHeHqSwQNMkoHcZBDpiNMlP0LXd3+q8zyBjzWb1OhIY4jxoG6bnliAATO/BQp"
+  }
+]

evm/ts-scripts/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "ts-scripts",
+  "version": "1.0.0",
+  "private": true,
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "build": "npx typechain --target=ethers-v5 --out-dir=./contract-bindings ../out/*/*.json"
+  },
+  "author": "",
+  "license": "ISC",
+  "devDependencies": {
+    "@certusone/wormhole-sdk": "^0.10.11",
+    "@typechain/ethers-v5": "^11.1.2",
+    "@types/node": "^20.11.22",
+    "@xlabs-xyz/ledger-signer": "^0.0.3",
+    "dotenv": "^16.4.5",
+    "ethers": "^5.7.2",
+    "typechain": "^8.3.2",
+    "tsx": "^4.7.2",
+    "typescript": "^5.4.5"
+  }
+}

evm/ts-scripts/shell/verify-governance-contract.sh

@@ -0,0 +1,60 @@
+if test -z "$ENV"; then
+  echo "ENV is not set"
+  exit 1
+fi
+
+scanner_tokens_file="$SCANNER_TOKENS_FILE_PATH"
+if test -z $scanner_tokens_file; then
+    echo "SCANNER_TOKENS_FILE_PATH is not set"
+    exit 1
+fi
+echo "Using scanner tokens file at $scanner_tokens_file"
+
+chains_file_path="ts-scripts/config/$ENV/chains.json"
+if ! test -f "$chains_file_path"; then
+  echo "File does not exist at $chains_file_path"
+  exit 1
+fi
+
+contracts_file_path="ts-scripts/config/$ENV/contracts.json"
+if ! test -f "$contracts_file_path"; then
+  echo "Contracts file configuration does not exist at $contracts_file_path"
+  exit 1
+fi
+
+operating_chains=$(jq -r '.operatingChains' $chains_file_path);
+
+if [ "$operating_chains" = "null" ]; then
+  operating_chains=$(jq -r '.chains[] | .chainId' $chains_file_path)
+else
+  operating_chains=$(jq -r '.operatingChains[]' $chains_file_path)
+fi
+
+export FOUNDRY_PROFILE=prod
+
+for chain in $operating_chains; do
+  echo "Operating on chain $chain:"
+
+  export governance_address=$(jq --raw-output ".GeneralPurposeGovernances[] | select(.chainId == $chain) | .address" $contracts_file_path)
+  export core_wormhole_address=$(jq --raw-output ".WormholeCoreContracts[] | select(.chainId == $chain) | .address" $contracts_file_path)
+  export etherscan_api_key=$(jq --raw-output ".[] | select(.chainId == $chain) | .etherscan" $scanner_tokens_file)
+  export evm_chain_id=$(jq ".chains[] | select(.chainId == $chain) | .evmNetworkId" $chains_file_path)
+
+  # echo "governance_address: $governance_address"
+  # echo "etherscan_api_key: $etherscan_api_key"
+  # echo "evm_chain_id: $evm_chain_id"
+
+  if [ "$governance_address" = "" ] ||
+    [ "$governance_address" = "" ] ||
+    [ "$etherscan_api_key" = "null" ] ||
+    [ "$evm_chain_id" = "null" ]; then
+      echo "One of the addresses is not set. Skipping...";
+      continue
+  fi
+
+  forge verify-contract --chain "$evm_chain_id" \
+    --etherscan-api-key "$etherscan_api_key" \
+    "$governance_address" \
+    src/wormhole/Governance.sol:Governance --watch \
+    --constructor-args $(cast abi-encode "constructor(address)" "$core_wormhole_address")
+done