From 593c608a6ebec848477c49619707eaba338a773f Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 11:33:35 +0800 Subject: [PATCH 01/24] feat: add TeeDisputeGame, TeeProofVerifier, and DisputeGameFactoryRouter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TEE DisputeGame contracts for OP Stack. Replaces SP1 ZK proofs with AWS Nitro Enclave ECDSA signatures for batch state transition verification. - src/dispute/tee/TeeDisputeGame.sol: IDisputeGame impl (gameType=1960) - src/dispute/tee/TeeProofVerifier.sol: enclave registration + batch ECDSA verification - src/dispute/tee/AccessManager.sol: proposer/challenger permissions with fallback timeout - src/dispute/DisputeGameFactoryRouter.sol: multi-zone router (zoneId→factory) - interfaces/dispute/: ITeeProofVerifier, IRiscZeroVerifier, IDisputeGameFactoryRouter - tests: 69 unit tests covering full lifecycle - scripts: DeployTee.s.sol, RegisterTeeGame.s.sol Co-Authored-By: Claude Opus 4.6 (1M context) --- .../dispute/IDisputeGameFactoryRouter.sol | 42 ++ .../interfaces/dispute/IRiscZeroVerifier.sol | 12 + .../interfaces/dispute/ITeeProofVerifier.sol | 17 + .../scripts/deploy/DeployTee.s.sol | 150 +++++ .../scripts/deploy/RegisterTeeGame.s.sol | 42 ++ .../src/dispute/DisputeGameFactoryRouter.sol | 106 +++ .../src/dispute/tee/AccessManager.sol | 135 ++++ .../src/dispute/tee/TeeDisputeGame.sol | 485 +++++++++++++ .../src/dispute/tee/TeeProofVerifier.sol | 236 +++++++ .../src/dispute/tee/lib/Errors.sol | 30 + .../test/dispute/tee/AccessManager.t.sol | 108 +++ .../AnchorStateRegistryCompatibility.t.sol | 137 ++++ .../tee/DisputeGameFactoryRouter.t.sol | 141 ++++ .../tee/DisputeGameFactoryRouterCreate.t.sol | 72 ++ .../test/dispute/tee/INTEGRATION_TEST_PLAN.md | 153 +++++ .../test/dispute/tee/TeeDisputeGame.t.sol | 636 ++++++++++++++++++ .../test/dispute/tee/TeeProofVerifier.t.sol | 126 ++++ .../fork/DisputeGameFactoryRouterFork.t.sol | 365 ++++++++++ .../test/dispute/tee/helpers/TeeTestUtils.sol | 115 ++++ .../tee/mocks/MockAnchorStateRegistry.sol | 167 +++++ .../tee/mocks/MockCloneableDisputeGame.sol | 56 ++ .../tee/mocks/MockDisputeGameFactory.sol | 177 +++++ .../tee/mocks/MockRiscZeroVerifier.sol | 29 + .../tee/mocks/MockStatusDisputeGame.sol | 85 +++ .../dispute/tee/mocks/MockSystemConfig.sol | 26 + .../tee/mocks/MockTeeProofVerifier.sol | 42 ++ 26 files changed, 3690 insertions(+) create mode 100644 packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol create mode 100644 packages/contracts-bedrock/interfaces/dispute/IRiscZeroVerifier.sol create mode 100644 packages/contracts-bedrock/interfaces/dispute/ITeeProofVerifier.sol create mode 100644 packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol create mode 100644 packages/contracts-bedrock/scripts/deploy/RegisterTeeGame.s.sol create mode 100644 packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol create mode 100644 packages/contracts-bedrock/src/dispute/tee/AccessManager.sol create mode 100644 packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol create mode 100644 packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol create mode 100644 packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md create mode 100644 packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockAnchorStateRegistry.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockDisputeGameFactory.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockRiscZeroVerifier.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockStatusDisputeGame.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockSystemConfig.sol create mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol diff --git a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol new file mode 100644 index 0000000000000..b70163843e32c --- /dev/null +++ b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {GameType, Claim} from "src/dispute/lib/Types.sol"; + +/// @title IDisputeGameFactoryRouter +/// @notice Interface for routing dispute game creation across multiple zone factories. +interface IDisputeGameFactoryRouter { + /// @notice Parameters for creating a single dispute game in a batch. + struct CreateParams { + uint256 zoneId; + GameType gameType; + Claim rootClaim; + bytes extraData; + uint256 bond; + } + + // ============ Events ============ + + event ZoneRegistered(uint256 indexed zoneId, address indexed factory); + event ZoneUpdated(uint256 indexed zoneId, address indexed oldFactory, address indexed newFactory); + event ZoneRemoved(uint256 indexed zoneId, address indexed factory); + event GameCreated(uint256 indexed zoneId, address indexed proxy); + event BatchGamesCreated(uint256 count); + + // ============ Errors ============ + + error ZoneAlreadyRegistered(uint256 zoneId); + error ZoneNotRegistered(uint256 zoneId); + error ZeroAddress(); + error BatchEmpty(); + error BatchBondMismatch(uint256 totalBonds, uint256 msgValue); + + // ============ Functions ============ + + function registerZone(uint256 zoneId, address factory) external; + function updateZone(uint256 zoneId, address factory) external; + function removeZone(uint256 zoneId) external; + function create(uint256 zoneId, GameType gameType, Claim rootClaim, bytes calldata extraData) external payable returns (address proxy); + function createBatch(CreateParams[] calldata params) external payable returns (address[] memory proxies); + function getFactory(uint256 zoneId) external view returns (address); +} diff --git a/packages/contracts-bedrock/interfaces/dispute/IRiscZeroVerifier.sol b/packages/contracts-bedrock/interfaces/dispute/IRiscZeroVerifier.sol new file mode 100644 index 0000000000000..433d4d4c4ebdd --- /dev/null +++ b/packages/contracts-bedrock/interfaces/dispute/IRiscZeroVerifier.sol @@ -0,0 +1,12 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +/// @title IRiscZeroVerifier +/// @notice Minimal interface for the RISC Zero Groth16 verifier. +interface IRiscZeroVerifier { + /// @notice Verify a RISC Zero proof. + /// @param seal The proof seal (Groth16). + /// @param imageId The guest image ID. + /// @param journalDigest The SHA-256 digest of the journal. + function verify(bytes calldata seal, bytes32 imageId, bytes32 journalDigest) external view; +} diff --git a/packages/contracts-bedrock/interfaces/dispute/ITeeProofVerifier.sol b/packages/contracts-bedrock/interfaces/dispute/ITeeProofVerifier.sol new file mode 100644 index 0000000000000..a7498f2059761 --- /dev/null +++ b/packages/contracts-bedrock/interfaces/dispute/ITeeProofVerifier.sol @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +/// @title ITeeProofVerifier +/// @notice Interface for the TEE Proof Verifier contract. +interface ITeeProofVerifier { + /// @notice Verify a batch state transition signed by a registered TEE enclave. + /// @param digest The hash of the batch data. + /// @param signature ECDSA signature (65 bytes: r + s + v). + /// @return signer The address of the verified enclave. + function verifyBatch(bytes32 digest, bytes calldata signature) external view returns (address signer); + + /// @notice Check if an address is a registered enclave. + /// @param enclaveAddress The address to check. + /// @return True if the address is registered. + function isRegistered(address enclaveAddress) external view returns (bool); +} diff --git a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol new file mode 100644 index 0000000000000..33299a451b4ac --- /dev/null +++ b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol @@ -0,0 +1,150 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Script, console2} from "forge-std/Script.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {Duration} from "src/dispute/lib/Types.sol"; +import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import {AccessManager} from "src/dispute/tee/AccessManager.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; + +contract Deploy is Script { + struct DeployConfig { + uint256 deployerKey; + address deployer; + IRiscZeroVerifier riscZeroVerifier; + bytes32 imageId; + bytes nitroRootKey; + IDisputeGameFactory disputeGameFactory; + IAnchorStateRegistry anchorStateRegistry; + uint64 maxChallengeDuration; + uint64 maxProveDuration; + uint256 challengerBond; + uint256 fallbackTimeout; + bool deployRouter; + address proofVerifierOwner; + address[] proposers; + address[] challengers; + uint256[] zoneIds; + address[] routerFactories; + address routerOwner; + } + + function run() + external + returns ( + TeeProofVerifier teeProofVerifier, + AccessManager accessManager, + TeeDisputeGame teeDisputeGame, + DisputeGameFactoryRouter router + ) + { + DeployConfig memory cfg = _readConfig(); + + if (cfg.deployRouter) { + require(cfg.zoneIds.length == cfg.routerFactories.length, "Deploy: router zone/factory length mismatch"); + } + + vm.startBroadcast(cfg.deployerKey); + + teeProofVerifier = new TeeProofVerifier(cfg.riscZeroVerifier, cfg.imageId, cfg.nitroRootKey); + if (cfg.proofVerifierOwner != cfg.deployer) { + teeProofVerifier.transferOwnership(cfg.proofVerifierOwner); + } + + accessManager = new AccessManager(cfg.fallbackTimeout, cfg.disputeGameFactory); + _applyAllowlist(accessManager, cfg.proposers, cfg.challengers); + + teeDisputeGame = new TeeDisputeGame( + Duration.wrap(cfg.maxChallengeDuration), + Duration.wrap(cfg.maxProveDuration), + cfg.disputeGameFactory, + ITeeProofVerifier(address(teeProofVerifier)), + cfg.challengerBond, + cfg.anchorStateRegistry, + accessManager + ); + + if (cfg.deployRouter) { + router = _deployRouter(cfg.routerOwner, cfg.deployer, cfg.zoneIds, cfg.routerFactories); + } + + vm.stopBroadcast(); + + console2.log("deployer", cfg.deployer); + console2.log("teeProofVerifier", address(teeProofVerifier)); + console2.log("accessManager", address(accessManager)); + console2.log("teeDisputeGame", address(teeDisputeGame)); + if (cfg.deployRouter) { + console2.log("router", address(router)); + } + } + + function _readConfig() internal view returns (DeployConfig memory cfg) { + cfg.deployerKey = vm.envUint("PRIVATE_KEY"); + cfg.deployer = vm.addr(cfg.deployerKey); + cfg.riscZeroVerifier = IRiscZeroVerifier(vm.envAddress("RISC_ZERO_VERIFIER")); + cfg.imageId = vm.envBytes32("RISC_ZERO_IMAGE_ID"); + cfg.nitroRootKey = vm.envBytes("NITRO_ROOT_KEY"); + cfg.disputeGameFactory = IDisputeGameFactory(vm.envAddress("DISPUTE_GAME_FACTORY")); + cfg.anchorStateRegistry = IAnchorStateRegistry(vm.envAddress("ANCHOR_STATE_REGISTRY")); + cfg.maxChallengeDuration = uint64(vm.envUint("MAX_CHALLENGE_DURATION")); + cfg.maxProveDuration = uint64(vm.envUint("MAX_PROVE_DURATION")); + cfg.challengerBond = vm.envUint("CHALLENGER_BOND"); + cfg.fallbackTimeout = vm.envUint("FALLBACK_TIMEOUT"); + cfg.deployRouter = vm.envOr("DEPLOY_ROUTER", false); + cfg.proofVerifierOwner = vm.envOr("PROOF_VERIFIER_OWNER", cfg.deployer); + cfg.proposers = _envAddressArray("PROPOSERS"); + cfg.challengers = _envAddressArray("CHALLENGERS"); + cfg.zoneIds = _envUintArray("ROUTER_ZONE_IDS"); + cfg.routerFactories = _envAddressArray("ROUTER_FACTORIES"); + cfg.routerOwner = vm.envOr("ROUTER_OWNER", cfg.deployer); + } + + function _applyAllowlist( + AccessManager accessManager, + address[] memory proposers, + address[] memory challengers + ) + internal + { + for (uint256 i = 0; i < proposers.length; i++) { + accessManager.setProposer(proposers[i], true); + } + for (uint256 i = 0; i < challengers.length; i++) { + accessManager.setChallenger(challengers[i], true); + } + } + + function _deployRouter( + address routerOwner, + address deployer, + uint256[] memory zoneIds, + address[] memory routerFactories + ) + internal + returns (DisputeGameFactoryRouter router) + { + router = new DisputeGameFactoryRouter(); + for (uint256 i = 0; i < zoneIds.length; i++) { + router.registerZone(zoneIds[i], routerFactories[i]); + } + if (routerOwner != deployer) { + router.transferOwnership(routerOwner); + } + } + + function _envAddressArray(string memory name) internal view returns (address[] memory values) { + if (!vm.envExists(name)) return new address[](0); + return vm.envAddress(name, ","); + } + + function _envUintArray(string memory name) internal view returns (uint256[] memory values) { + if (!vm.envExists(name)) return new uint256[](0); + return vm.envUint(name, ","); + } +} diff --git a/packages/contracts-bedrock/scripts/deploy/RegisterTeeGame.s.sol b/packages/contracts-bedrock/scripts/deploy/RegisterTeeGame.s.sol new file mode 100644 index 0000000000000..27b6a1df96c37 --- /dev/null +++ b/packages/contracts-bedrock/scripts/deploy/RegisterTeeGame.s.sol @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Script, console2} from "forge-std/Script.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {GameType} from "src/dispute/lib/Types.sol"; + +contract RegisterTeeGame is Script { + uint32 internal constant TEE_GAME_TYPE = 1960; + string internal constant GAME_ARGS_UNSUPPORTED = + "RegisterTeeGame: GAME_ARGS is unsupported for gameType=1960"; + + function run() external { + uint256 deployerKey = vm.envUint("PRIVATE_KEY"); + IDisputeGameFactory disputeGameFactory = IDisputeGameFactory(vm.envAddress("DISPUTE_GAME_FACTORY")); + IDisputeGame teeDisputeGame = IDisputeGame(vm.envAddress("TEE_DISPUTE_GAME_IMPL")); + uint256 initBond = vm.envUint("INIT_BOND"); + bytes memory gameArgs = vm.envOr("GAME_ARGS", bytes("")); + bool setRespectedGameType = vm.envOr("SET_RESPECTED_GAME_TYPE", false); + + require(gameArgs.length == 0, GAME_ARGS_UNSUPPORTED); + + vm.startBroadcast(deployerKey); + + disputeGameFactory.setImplementation(GameType.wrap(TEE_GAME_TYPE), teeDisputeGame); + disputeGameFactory.setInitBond(GameType.wrap(TEE_GAME_TYPE), initBond); + + if (setRespectedGameType) { + IAnchorStateRegistry anchorStateRegistry = IAnchorStateRegistry(vm.envAddress("ANCHOR_STATE_REGISTRY")); + anchorStateRegistry.setRespectedGameType(GameType.wrap(TEE_GAME_TYPE)); + console2.log("anchorStateRegistry respected game type set", TEE_GAME_TYPE); + } + + vm.stopBroadcast(); + + console2.log("registered gameType", TEE_GAME_TYPE); + console2.log("teeDisputeGame", address(teeDisputeGame)); + console2.log("initBond", initBond); + } +} diff --git a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol new file mode 100644 index 0000000000000..280f13501f339 --- /dev/null +++ b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol @@ -0,0 +1,106 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; +import {GameType, Claim} from "src/dispute/lib/Types.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; + +/// @title DisputeGameFactoryRouter +/// @notice Routes dispute game creation to the correct zone's DisputeGameFactory. +/// @dev Each zone (identified by a uint256 zoneId) maps to a DisputeGameFactory address. +contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { + /// @custom:semver 1.0.0 + string public constant version = "1.0.0"; + + /// @notice Mapping of zoneId to DisputeGameFactory address. + mapping(uint256 => address) public factories; + + constructor() {} + + //////////////////////////////////////////////////////////////// + // Zone Management // + //////////////////////////////////////////////////////////////// + + /// @notice Register a new zone with its factory address. + function registerZone(uint256 zoneId, address factory) external onlyOwner { + if (factory == address(0)) revert ZeroAddress(); + if (factories[zoneId] != address(0)) revert ZoneAlreadyRegistered(zoneId); + factories[zoneId] = factory; + emit ZoneRegistered(zoneId, factory); + } + + /// @notice Update an existing zone's factory address. + function updateZone(uint256 zoneId, address factory) external onlyOwner { + if (factory == address(0)) revert ZeroAddress(); + address oldFactory = factories[zoneId]; + if (oldFactory == address(0)) revert ZoneNotRegistered(zoneId); + factories[zoneId] = factory; + emit ZoneUpdated(zoneId, oldFactory, factory); + } + + /// @notice Remove a zone. + function removeZone(uint256 zoneId) external onlyOwner { + address factory = factories[zoneId]; + if (factory == address(0)) revert ZoneNotRegistered(zoneId); + delete factories[zoneId]; + emit ZoneRemoved(zoneId, factory); + } + + //////////////////////////////////////////////////////////////// + // Game Creation // + //////////////////////////////////////////////////////////////// + + /// @notice Create a single dispute game in the specified zone. + function create( + uint256 zoneId, + GameType gameType, + Claim rootClaim, + bytes calldata extraData + ) external payable returns (address proxy) { + address factory = factories[zoneId]; + if (factory == address(0)) revert ZoneNotRegistered(zoneId); + + IDisputeGame game = IDisputeGameFactory(factory).create{value: msg.value}( + gameType, rootClaim, extraData + ); + proxy = address(game); + emit GameCreated(zoneId, proxy); + } + + /// @notice Create dispute games across multiple zones in a single transaction. + /// @dev The sum of all params[i].bond must equal msg.value. + function createBatch(CreateParams[] calldata params) external payable returns (address[] memory proxies) { + if (params.length == 0) revert BatchEmpty(); + + uint256 totalBonds; + for (uint256 i = 0; i < params.length; i++) { + totalBonds += params[i].bond; + } + if (totalBonds != msg.value) revert BatchBondMismatch(totalBonds, msg.value); + + proxies = new address[](params.length); + for (uint256 i = 0; i < params.length; i++) { + address factory = factories[params[i].zoneId]; + if (factory == address(0)) revert ZoneNotRegistered(params[i].zoneId); + + IDisputeGame game = IDisputeGameFactory(factory).create{value: params[i].bond}( + params[i].gameType, params[i].rootClaim, params[i].extraData + ); + proxies[i] = address(game); + emit GameCreated(params[i].zoneId, proxies[i]); + } + + emit BatchGamesCreated(params.length); + } + + //////////////////////////////////////////////////////////////// + // View Functions // + //////////////////////////////////////////////////////////////// + + /// @notice Get the factory address for a zone. + function getFactory(uint256 zoneId) external view returns (address) { + return factories[zoneId]; + } +} diff --git a/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol b/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol new file mode 100644 index 0000000000000..a28e1ae39e420 --- /dev/null +++ b/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol @@ -0,0 +1,135 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {GameType, Timestamp} from "src/dispute/lib/Types.sol"; + +/// @dev Game type constant for TEE Dispute Game. +uint32 constant TEE_DISPUTE_GAME_TYPE = 1960; + +/// @title AccessManager +/// @notice Manages permissions for dispute game proposers and challengers. +contract AccessManager is Ownable { + //////////////////////////////////////////////////////////////// + // Events // + //////////////////////////////////////////////////////////////// + + /// @notice Event emitted when proposer permissions are updated. + event ProposerPermissionUpdated(address indexed proposer, bool allowed); + + /// @notice Event emitted when challenger permissions are updated. + event ChallengerPermissionUpdated(address indexed challenger, bool allowed); + + //////////////////////////////////////////////////////////////// + // State Vars // + //////////////////////////////////////////////////////////////// + + /// @notice Tracks whitelisted proposers. + mapping(address => bool) public proposers; + + /// @notice Tracks whitelisted challengers. + mapping(address => bool) public challengers; + + /// @notice The timeout (in seconds) after which permissionless proposing is allowed (immutable). + uint256 public immutable FALLBACK_TIMEOUT; + + /// @notice The dispute game factory address. + IDisputeGameFactory public immutable DISPUTE_GAME_FACTORY; + + /// @notice The timestamp of this contract's creation. Used for permissionless fallback proposals. + uint256 public immutable DEPLOYMENT_TIMESTAMP; + + //////////////////////////////////////////////////////////////// + // Constructor // + //////////////////////////////////////////////////////////////// + + /// @notice Constructor sets the fallback timeout and initializes timestamp. + /// @param _fallbackTimeout The timeout in seconds after last proposal when permissionless mode activates. + /// @param _disputeGameFactory The dispute game factory address. + constructor(uint256 _fallbackTimeout, IDisputeGameFactory _disputeGameFactory) { + FALLBACK_TIMEOUT = _fallbackTimeout; + DISPUTE_GAME_FACTORY = _disputeGameFactory; + DEPLOYMENT_TIMESTAMP = block.timestamp; + } + + //////////////////////////////////////////////////////////////// + // Functions // + //////////////////////////////////////////////////////////////// + + /// @notice Allows the owner to whitelist or un-whitelist proposers. + /// @param _proposer The address to set in the proposers mapping. + /// @param _allowed True if whitelisting, false otherwise. + function setProposer(address _proposer, bool _allowed) external onlyOwner { + proposers[_proposer] = _allowed; + emit ProposerPermissionUpdated(_proposer, _allowed); + } + + /// @notice Allows the owner to whitelist or un-whitelist challengers. + /// @param _challenger The address to set in the challengers mapping. + /// @param _allowed True if whitelisting, false otherwise. + function setChallenger(address _challenger, bool _allowed) external onlyOwner { + challengers[_challenger] = _allowed; + emit ChallengerPermissionUpdated(_challenger, _allowed); + } + + /// @notice Returns the last proposal timestamp. + /// @return The last proposal timestamp. + function getLastProposalTimestamp() public view returns (uint256) { + GameType gameType = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + uint256 numGames = DISPUTE_GAME_FACTORY.gameCount(); + + if (numGames == 0) { + return DEPLOYMENT_TIMESTAMP; + } + + uint256 i = numGames - 1; + while (true) { + (GameType gameTypeAtIndex, Timestamp timestamp,) = DISPUTE_GAME_FACTORY.gameAtIndex(i); + uint256 gameTimestamp = uint256(timestamp.raw()); + + if (gameTimestamp < DEPLOYMENT_TIMESTAMP) { + return DEPLOYMENT_TIMESTAMP; + } + + if (gameTypeAtIndex.raw() == gameType.raw()) { + return gameTimestamp; + } + + if (i == 0) { + break; + } + + unchecked { + --i; + } + } + + return DEPLOYMENT_TIMESTAMP; + } + + /// @notice Returns whether proposal fallback timeout has elapsed. + /// @return Whether permissionless proposing is active. + function isProposalPermissionlessMode() public view returns (bool) { + if (proposers[address(0)]) { + return true; + } + + uint256 lastProposalTimestamp = getLastProposalTimestamp(); + return block.timestamp - lastProposalTimestamp > FALLBACK_TIMEOUT; + } + + /// @notice Checks if an address is allowed to propose. + /// @param _proposer The address to check. + /// @return allowed_ Whether the address is allowed to propose. + function isAllowedProposer(address _proposer) external view returns (bool allowed_) { + allowed_ = proposers[_proposer] || isProposalPermissionlessMode(); + } + + /// @notice Checks if an address is allowed to challenge. + /// @param _challenger The address to check. + /// @return allowed_ Whether the address is allowed to challenge. + function isAllowedChallenger(address _challenger) external view returns (bool allowed_) { + allowed_ = challengers[address(0)] || challengers[_challenger]; + } +} diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol new file mode 100644 index 0000000000000..14a3807e6deb3 --- /dev/null +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -0,0 +1,485 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +// Libraries +import {Clone} from "@solady/utils/Clone.sol"; +import { + BondDistributionMode, + Claim, + Duration, + GameStatus, + GameType, + Hash, + Proposal, + Timestamp +} from "src/dispute/lib/Types.sol"; +import { + AlreadyInitialized, + BadAuth, + BondTransferFailed, + ClaimAlreadyResolved, + GameNotFinalized, + IncorrectBondAmount, + InvalidBondDistributionMode, + NoCreditToClaim, + UnexpectedRootClaim +} from "src/dispute/lib/Errors.sol"; +import "src/dispute/tee/lib/Errors.sol"; + +// Interfaces +import {ISemver} from "interfaces/universal/ISemver.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; + +// Contracts +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; + +/// @title TeeDisputeGame +/// @notice A dispute game that uses TEE (AWS Nitro Enclave) ECDSA signatures +/// instead of SP1 ZK proofs for batch state transition verification. +/// @dev Mirrors OPSuccinctFaultDisputeGame architecture but replaces +/// SP1_VERIFIER.verifyProof() with TEE_PROOF_VERIFIER.verifyBatch(). +/// Uses the same DisputeGameFactory, AnchorStateRegistry, and AccessManager +/// infrastructure from OP Stack. +/// +/// prove() accepts multiple chained batch proofs to support the scenario +/// where different TEE executors handle different sub-ranges within a single game. +/// Each batch carries (startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block). +/// batchDigest = keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block)) +/// is computed on-chain and verified via TEE ECDSA signature. +/// +/// rootClaim = keccak256(abi.encode(blockHash, stateHash)) where blockHash and stateHash +/// are passed via extraData. The anchor state stores this combined hash. +contract TeeDisputeGame is Clone, ISemver, IDisputeGame { + //////////////////////////////////////////////////////////////// + // Enums // + //////////////////////////////////////////////////////////////// + + enum ProposalStatus { + Unchallenged, + Challenged, + UnchallengedAndValidProofProvided, + ChallengedAndValidProofProvided, + Resolved + } + + //////////////////////////////////////////////////////////////// + // Structs // + //////////////////////////////////////////////////////////////// + + struct ClaimData { + uint32 parentIndex; + address counteredBy; + address prover; + Claim claim; + ProposalStatus status; + Timestamp deadline; + } + + /// @notice A single batch proof segment within a chained prove() call. + /// @dev Multiple BatchProofs can be submitted to cover a game's full range, + /// e.g. when different TEE executors handle sub-ranges. + struct BatchProof { + bytes32 startBlockHash; + bytes32 startStateHash; + bytes32 endBlockHash; + bytes32 endStateHash; + uint256 l2Block; + bytes signature; // 65 bytes ECDSA (r + s + v) + } + + //////////////////////////////////////////////////////////////// + // Events // + //////////////////////////////////////////////////////////////// + + event Challenged(address indexed challenger); + event Proved(address indexed prover); + event GameClosed(BondDistributionMode bondDistributionMode); + + error EmptyBatchProofs(); + error StartHashMismatch(bytes32 expectedCombined, bytes32 actualCombined); + error BatchChainBreak(uint256 index); + error BatchBlockNotIncreasing(uint256 index, uint256 prevBlock, uint256 curBlock); + error FinalHashMismatch(bytes32 expectedCombined, bytes32 actualCombined); + error FinalBlockMismatch(uint256 expectedBlock, uint256 actualBlock); + error RootClaimMismatch(bytes32 expectedRootClaim, bytes32 actualRootClaim); + + //////////////////////////////////////////////////////////////// + // Immutables // + //////////////////////////////////////////////////////////////// + + Duration internal immutable MAX_CHALLENGE_DURATION; + Duration internal immutable MAX_PROVE_DURATION; + GameType internal immutable GAME_TYPE; + IDisputeGameFactory internal immutable DISPUTE_GAME_FACTORY; + ITeeProofVerifier internal immutable TEE_PROOF_VERIFIER; + uint256 internal immutable CHALLENGER_BOND; + IAnchorStateRegistry internal immutable ANCHOR_STATE_REGISTRY; + AccessManager internal immutable ACCESS_MANAGER; + + //////////////////////////////////////////////////////////////// + // State Vars // + //////////////////////////////////////////////////////////////// + + /// @custom:semver 1.0.0 + string public constant version = "1.0.0"; + + Timestamp public createdAt; + Timestamp public resolvedAt; + GameStatus public status; + /// @notice The proposer EOA captured during initialization, aligned with OP permissioned games. + address public proposer; + bool internal initialized; + ClaimData public claimData; + + mapping(address => uint256) public normalModeCredit; + mapping(address => uint256) public refundModeCredit; + + Proposal public startingOutputRoot; + bool public wasRespectedGameTypeWhenCreated; + BondDistributionMode public bondDistributionMode; + + //////////////////////////////////////////////////////////////// + // Constructor // + //////////////////////////////////////////////////////////////// + + constructor( + Duration _maxChallengeDuration, + Duration _maxProveDuration, + IDisputeGameFactory _disputeGameFactory, + ITeeProofVerifier _teeProofVerifier, + uint256 _challengerBond, + IAnchorStateRegistry _anchorStateRegistry, + AccessManager _accessManager + ) { + GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + MAX_CHALLENGE_DURATION = _maxChallengeDuration; + MAX_PROVE_DURATION = _maxProveDuration; + DISPUTE_GAME_FACTORY = _disputeGameFactory; + TEE_PROOF_VERIFIER = _teeProofVerifier; + CHALLENGER_BOND = _challengerBond; + ANCHOR_STATE_REGISTRY = _anchorStateRegistry; + ACCESS_MANAGER = _accessManager; + } + + //////////////////////////////////////////////////////////////// + // Initialize // + //////////////////////////////////////////////////////////////// + + function initialize() external payable virtual { + if (initialized) revert AlreadyInitialized(); + if (address(DISPUTE_GAME_FACTORY) != msg.sender) revert IncorrectDisputeGameFactory(); + if (!ACCESS_MANAGER.isAllowedProposer(tx.origin)) revert BadAuth(); + + assembly { + if iszero(eq(calldatasize(), 0xBE)) { + mstore(0x00, 0x9824bdab) + revert(0x1C, 0x04) + } + } + + // Verify rootClaim == keccak256(abi.encode(blockHash, stateHash)) + bytes32 expectedRootClaim = keccak256(abi.encode(blockHash(), stateHash())); + if (expectedRootClaim != rootClaim().raw()) { + revert RootClaimMismatch(expectedRootClaim, rootClaim().raw()); + } + + if (parentIndex() != type(uint32).max) { + (,, IDisputeGame proxy) = DISPUTE_GAME_FACTORY.gameAtIndex(parentIndex()); + + if ( + !ANCHOR_STATE_REGISTRY.isGameRespected(proxy) || ANCHOR_STATE_REGISTRY.isGameBlacklisted(proxy) + || ANCHOR_STATE_REGISTRY.isGameRetired(proxy) + ) { + revert InvalidParentGame(); + } + + startingOutputRoot = Proposal({ + l2SequenceNumber: TeeDisputeGame(address(proxy)).l2SequenceNumber(), + root: Hash.wrap(TeeDisputeGame(address(proxy)).rootClaim().raw()) + }); + + if (proxy.status() == GameStatus.CHALLENGER_WINS) revert InvalidParentGame(); + } else { + (startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = + IAnchorStateRegistry(ANCHOR_STATE_REGISTRY).anchors(GAME_TYPE); + } + + if (l2SequenceNumber() <= startingOutputRoot.l2SequenceNumber) { + revert UnexpectedRootClaim(rootClaim()); + } + + claimData = ClaimData({ + parentIndex: parentIndex(), + counteredBy: address(0), + prover: address(0), + claim: rootClaim(), + status: ProposalStatus.Unchallenged, + deadline: Timestamp.wrap(uint64(block.timestamp + MAX_CHALLENGE_DURATION.raw())) + }); + + initialized = true; + proposer = tx.origin; + refundModeCredit[proposer] += msg.value; + createdAt = Timestamp.wrap(uint64(block.timestamp)); + wasRespectedGameTypeWhenCreated = + GameType.unwrap(ANCHOR_STATE_REGISTRY.respectedGameType()) == GameType.unwrap(GAME_TYPE); + } + + //////////////////////////////////////////////////////////////// + // Core Game Logic // + //////////////////////////////////////////////////////////////// + + function challenge() external payable returns (ProposalStatus) { + if (claimData.status != ProposalStatus.Unchallenged) revert ClaimAlreadyChallenged(); + if (!ACCESS_MANAGER.isAllowedChallenger(msg.sender)) revert BadAuth(); + if (gameOver()) revert GameOver(); + if (msg.value != CHALLENGER_BOND) revert IncorrectBondAmount(); + + claimData.counteredBy = msg.sender; + claimData.status = ProposalStatus.Challenged; + claimData.deadline = Timestamp.wrap(uint64(block.timestamp + MAX_PROVE_DURATION.raw())); + refundModeCredit[msg.sender] += msg.value; + + emit Challenged(claimData.counteredBy); + return claimData.status; + } + + /// @notice Submit chained batch proofs to verify the full state transition. + /// @dev Each BatchProof covers a sub-range with (startBlockHash, startStateHash, endBlockHash, endStateHash). + /// The contract verifies: + /// 1. keccak256(proofs[0].startBlockHash, startStateHash) == startingOutputRoot.root + /// 2. proofs[i].end{Block,State}Hash == proofs[i+1].start{Block,State}Hash (chain continuity) + /// 3. proofs[i].l2Block < proofs[i+1].l2Block (monotonically increasing) + /// 4. keccak256(proofs[last].endBlockHash, endStateHash) == rootClaim + /// 5. proofs[last].l2Block == l2SequenceNumber + /// 6. Each batch's TEE signature is valid (via TEE_PROOF_VERIFIER) + /// @param proofBytes ABI-encoded BatchProof[] array + function prove(bytes calldata proofBytes) external returns (ProposalStatus) { + if (gameOver()) revert GameOver(); + + BatchProof[] memory proofs = abi.decode(proofBytes, (BatchProof[])); + if (proofs.length == 0) revert EmptyBatchProofs(); + + // Verify first proof starts from the starting output root + { + bytes32 startCombined = keccak256(abi.encode(proofs[0].startBlockHash, proofs[0].startStateHash)); + bytes32 expectedStart = Hash.unwrap(startingOutputRoot.root); + if (startCombined != expectedStart) { + revert StartHashMismatch(expectedStart, startCombined); + } + } + + uint256 prevBlock = startingOutputRoot.l2SequenceNumber; + + for (uint256 i = 0; i < proofs.length; i++) { + // Chain continuity: each batch starts where the previous ended + if (i > 0) { + if ( + proofs[i].startBlockHash != proofs[i - 1].endBlockHash + || proofs[i].startStateHash != proofs[i - 1].endStateHash + ) { + revert BatchChainBreak(i); + } + } + + // L2 block must be monotonically increasing + if (proofs[i].l2Block <= prevBlock) { + revert BatchBlockNotIncreasing(i, prevBlock, proofs[i].l2Block); + } + + // Compute batchDigest on-chain and verify TEE signature + bytes32 batchDigest = keccak256( + abi.encode( + proofs[i].startBlockHash, + proofs[i].startStateHash, + proofs[i].endBlockHash, + proofs[i].endStateHash, + proofs[i].l2Block + ) + ); + TEE_PROOF_VERIFIER.verifyBatch(batchDigest, proofs[i].signature); + + prevBlock = proofs[i].l2Block; + } + + // Final endHash must match rootClaim (which is keccak256(blockHash, stateHash)) + { + uint256 last = proofs.length - 1; + bytes32 endCombined = keccak256(abi.encode(proofs[last].endBlockHash, proofs[last].endStateHash)); + if (endCombined != rootClaim().raw()) { + revert FinalHashMismatch(rootClaim().raw(), endCombined); + } + } + + // Final l2Block must match game's l2SequenceNumber + if (prevBlock != l2SequenceNumber()) { + revert FinalBlockMismatch(l2SequenceNumber(), prevBlock); + } + + claimData.prover = msg.sender; + + if (claimData.counteredBy == address(0)) { + claimData.status = ProposalStatus.UnchallengedAndValidProofProvided; + } else { + claimData.status = ProposalStatus.ChallengedAndValidProofProvided; + } + + emit Proved(claimData.prover); + return claimData.status; + } + + function resolve() external returns (GameStatus) { + if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved(); + + GameStatus parentGameStatus = _getParentGameStatus(); + if (parentGameStatus == GameStatus.IN_PROGRESS) revert ParentGameNotResolved(); + + if (parentGameStatus == GameStatus.CHALLENGER_WINS) { + status = GameStatus.CHALLENGER_WINS; + normalModeCredit[claimData.counteredBy] = address(this).balance; + } else { + if (!gameOver()) revert GameNotOver(); + + if (claimData.status == ProposalStatus.Unchallenged) { + status = GameStatus.DEFENDER_WINS; + normalModeCredit[proposer] = address(this).balance; + } else if (claimData.status == ProposalStatus.Challenged) { + status = GameStatus.CHALLENGER_WINS; + normalModeCredit[claimData.counteredBy] = address(this).balance; + } else if (claimData.status == ProposalStatus.UnchallengedAndValidProofProvided) { + status = GameStatus.DEFENDER_WINS; + normalModeCredit[proposer] = address(this).balance; + } else if (claimData.status == ProposalStatus.ChallengedAndValidProofProvided) { + status = GameStatus.DEFENDER_WINS; + if (claimData.prover == proposer) { + normalModeCredit[claimData.prover] = address(this).balance; + } else { + normalModeCredit[claimData.prover] = CHALLENGER_BOND; + normalModeCredit[proposer] = address(this).balance - CHALLENGER_BOND; + } + } else { + revert InvalidProposalStatus(); + } + } + + claimData.status = ProposalStatus.Resolved; + resolvedAt = Timestamp.wrap(uint64(block.timestamp)); + emit Resolved(status); + + return status; + } + + function claimCredit(address _recipient) external { + closeGame(); + + uint256 recipientCredit; + if (bondDistributionMode == BondDistributionMode.REFUND) { + recipientCredit = refundModeCredit[_recipient]; + } else if (bondDistributionMode == BondDistributionMode.NORMAL) { + recipientCredit = normalModeCredit[_recipient]; + } else { + revert InvalidBondDistributionMode(); + } + + if (recipientCredit == 0) revert NoCreditToClaim(); + + refundModeCredit[_recipient] = 0; + normalModeCredit[_recipient] = 0; + + (bool success,) = _recipient.call{value: recipientCredit}(hex""); + if (!success) revert BondTransferFailed(); + } + + function closeGame() public { + if (bondDistributionMode == BondDistributionMode.REFUND || bondDistributionMode == BondDistributionMode.NORMAL) + { + return; + } else if (bondDistributionMode != BondDistributionMode.UNDECIDED) { + revert InvalidBondDistributionMode(); + } + + bool finalized = ANCHOR_STATE_REGISTRY.isGameFinalized(IDisputeGame(address(this))); + if (!finalized) { + revert GameNotFinalized(); + } + + try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} catch {} + + bool properGame = ANCHOR_STATE_REGISTRY.isGameProper(IDisputeGame(address(this))); + + if (properGame) { + bondDistributionMode = BondDistributionMode.NORMAL; + } else { + bondDistributionMode = BondDistributionMode.REFUND; + } + + emit GameClosed(bondDistributionMode); + } + + //////////////////////////////////////////////////////////////// + // View Functions // + //////////////////////////////////////////////////////////////// + + function gameOver() public view returns (bool gameOver_) { + gameOver_ = claimData.deadline.raw() < uint64(block.timestamp) || claimData.prover != address(0); + } + + function credit(address _recipient) external view returns (uint256 credit_) { + if (bondDistributionMode == BondDistributionMode.REFUND) { + credit_ = refundModeCredit[_recipient]; + } else { + credit_ = normalModeCredit[_recipient]; + } + } + + //////////////////////////////////////////////////////////////// + // IDisputeGame Impl // + //////////////////////////////////////////////////////////////// + + function gameType() public view returns (GameType gameType_) { gameType_ = GAME_TYPE; } + function gameCreator() public pure returns (address creator_) { creator_ = _getArgAddress(0x00); } + function rootClaim() public pure returns (Claim rootClaim_) { rootClaim_ = Claim.wrap(_getArgBytes32(0x14)); } + function l1Head() public pure returns (Hash l1Head_) { l1Head_ = Hash.wrap(_getArgBytes32(0x34)); } + function l2SequenceNumber() public pure returns (uint256 l2SequenceNumber_) { l2SequenceNumber_ = _getArgUint256(0x54); } + function l2BlockNumber() public pure returns (uint256 l2BlockNumber_) { l2BlockNumber_ = l2SequenceNumber(); } + function parentIndex() public pure returns (uint32 parentIndex_) { parentIndex_ = _getArgUint32(0x74); } + function blockHash() public pure returns (bytes32 blockHash_) { blockHash_ = _getArgBytes32(0x78); } + function stateHash() public pure returns (bytes32 stateHash_) { stateHash_ = _getArgBytes32(0x98); } + function startingBlockNumber() external view returns (uint256) { return startingOutputRoot.l2SequenceNumber; } + function startingRootHash() external view returns (Hash) { return startingOutputRoot.root; } + function extraData() public pure returns (bytes memory extraData_) { extraData_ = _getArgBytes(0x54, 0x64); } + + function gameData() external view returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { + gameType_ = gameType(); + rootClaim_ = rootClaim(); + extraData_ = extraData(); + } + + //////////////////////////////////////////////////////////////// + // Immutable Getters // + //////////////////////////////////////////////////////////////// + + function maxChallengeDuration() external view returns (Duration) { return MAX_CHALLENGE_DURATION; } + function maxProveDuration() external view returns (Duration) { return MAX_PROVE_DURATION; } + function disputeGameFactory() external view returns (IDisputeGameFactory) { return DISPUTE_GAME_FACTORY; } + function teeProofVerifier() external view returns (ITeeProofVerifier) { return TEE_PROOF_VERIFIER; } + function challengerBond() external view returns (uint256) { return CHALLENGER_BOND; } + function anchorStateRegistry() external view returns (IAnchorStateRegistry) { return ANCHOR_STATE_REGISTRY; } + function accessManager() external view returns (AccessManager) { return ACCESS_MANAGER; } + + //////////////////////////////////////////////////////////////// + // Internal Functions // + //////////////////////////////////////////////////////////////// + + function _getParentGameStatus() private view returns (GameStatus) { + if (parentIndex() != type(uint32).max) { + (,, IDisputeGame parentGame) = DISPUTE_GAME_FACTORY.gameAtIndex(parentIndex()); + return parentGame.status(); + } else { + return GameStatus.DEFENDER_WINS; + } + } +} diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol new file mode 100644 index 0000000000000..9b1713d39fe2b --- /dev/null +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -0,0 +1,236 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; +import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; + +/// @title TEE Proof Verifier for OP Stack DisputeGame +/// @notice Verifies TEE enclave identity via ZK proof (owner-gated registration) and +/// batch state transitions via ECDSA signature (permissionless verification). +/// @dev Two core responsibilities: +/// 1. register(): Owner verifies ZK proof of Nitro attestation, binds EOA <-> PCR on-chain +/// 2. verifyBatch(): ecrecover signature, check signer is a registered enclave +/// +/// Journal format (from RISC Zero guest program): +/// - 8 bytes: timestamp_ms (big-endian uint64) +/// - 32 bytes: pcr_hash = SHA256(PCR0) +/// - 96 bytes: root_pubkey (P384 without 0x04 prefix) +/// - 1 byte: pubkey_len +/// - pubkey_len bytes: pubkey (secp256k1 uncompressed, 65 bytes) +/// - 2 bytes: user_data_len (big-endian uint16) +/// - user_data_len bytes: user_data +contract TeeProofVerifier { + // ============ Immutables ============ + + /// @notice RISC Zero Groth16 verifier (only called during registration) + IRiscZeroVerifier public immutable riscZeroVerifier; + + /// @notice RISC Zero guest image ID (hash of the attestation verification guest ELF) + bytes32 public immutable imageId; + + /// @notice Expected AWS Nitro root public key (96 bytes, P384 without 0x04 prefix) + bytes public expectedRootKey; + + // ============ State ============ + + struct EnclaveInfo { + bytes32 pcrHash; + uint64 registeredAt; + } + + /// @notice Registered enclaves: EOA address => enclave info + mapping(address => EnclaveInfo) public registeredEnclaves; + + /// @notice Contract owner (can register and revoke enclaves) + address public owner; + + // ============ Events ============ + + event EnclaveRegistered( + address indexed enclaveAddress, bytes32 indexed pcrHash, uint64 timestampMs + ); + + event EnclaveRevoked(address indexed enclaveAddress); + + event OwnerTransferred(address indexed oldOwner, address indexed newOwner); + + // ============ Errors ============ + + error InvalidProof(); + error InvalidRootKey(); + error InvalidPublicKey(); + error EnclaveAlreadyRegistered(); + error EnclaveNotRegistered(); + error InvalidSignature(); + error Unauthorized(); + + // ============ Modifiers ============ + + modifier onlyOwner() { + if (msg.sender != owner) revert Unauthorized(); + _; + } + + // ============ Constructor ============ + + /// @param _riscZeroVerifier RISC Zero verifier contract (Groth16 or mock) + /// @param _imageId RISC Zero guest image ID + /// @param _rootKey Expected AWS Nitro root public key (96 bytes) + constructor( + IRiscZeroVerifier _riscZeroVerifier, + bytes32 _imageId, + bytes memory _rootKey + ) { + riscZeroVerifier = _riscZeroVerifier; + imageId = _imageId; + expectedRootKey = _rootKey; + owner = msg.sender; + } + + // ============ Registration (Owner Only) ============ + + /// @notice Register a TEE enclave by verifying its ZK attestation proof. + /// @dev Only callable by the owner. The owner calling register() is the trust gate -- + /// the PCR and EOA from the proof are automatically trusted upon registration. + /// @param seal The RISC Zero proof seal (Groth16) + /// @param journal The journal output from the guest program + function register(bytes calldata seal, bytes calldata journal) external onlyOwner { + // 1. Verify ZK proof + bytes32 journalDigest = sha256(journal); + try riscZeroVerifier.verify(seal, imageId, journalDigest) {} + catch { + revert InvalidProof(); + } + + // 2. Parse journal + ( + uint64 timestampMs, + bytes32 pcrHash, + bytes memory rootKey, + bytes memory publicKey, + ) = _parseJournal(journal); + + // 3. Verify root key matches AWS Nitro official root + if (keccak256(rootKey) != keccak256(expectedRootKey)) { + revert InvalidRootKey(); + } + + // 4. Extract EOA address from secp256k1 public key (65 bytes: 0x04 + x + y) + if (publicKey.length != 65) { + revert InvalidPublicKey(); + } + address enclaveAddress = _extractAddress(publicKey); + + // 5. Check not already registered + if (registeredEnclaves[enclaveAddress].registeredAt != 0) { + revert EnclaveAlreadyRegistered(); + } + + // 6. Store registration (PCR is implicitly trusted by owner's approval) + registeredEnclaves[enclaveAddress] = + EnclaveInfo({pcrHash: pcrHash, registeredAt: timestampMs}); + + emit EnclaveRegistered(enclaveAddress, pcrHash, timestampMs); + } + + // ============ Batch Verification (Permissionless) ============ + + /// @notice Verify a batch state transition signed by a registered TEE enclave. + /// @param digest The hash of the batch data (pre_batch, txs, post_batch, etc.) + /// @param signature ECDSA signature (65 bytes: r + s + v) + /// @return signer The address of the verified enclave that signed the batch + function verifyBatch(bytes32 digest, bytes calldata signature) + external + view + returns (address signer) + { + // 1. Recover signer from signature + (address recovered, ECDSA.RecoverError err) = ECDSA.tryRecover(digest, signature); + if (err != ECDSA.RecoverError.NoError || recovered == address(0)) { + revert InvalidSignature(); + } + + // 2. Check signer is a registered enclave + if (registeredEnclaves[recovered].registeredAt == 0) { + revert EnclaveNotRegistered(); + } + + return recovered; + } + + // ============ Query Functions ============ + + /// @notice Check if an address is a registered enclave + /// @param enclaveAddress The address to check + /// @return True if the address is registered + function isRegistered(address enclaveAddress) external view returns (bool) { + return registeredEnclaves[enclaveAddress].registeredAt != 0; + } + + // ============ Admin Functions ============ + + /// @notice Revoke a registered enclave + /// @param enclaveAddress The enclave address to revoke + function revoke(address enclaveAddress) external onlyOwner { + if (registeredEnclaves[enclaveAddress].registeredAt == 0) { + revert EnclaveNotRegistered(); + } + delete registeredEnclaves[enclaveAddress]; + emit EnclaveRevoked(enclaveAddress); + } + + /// @notice Transfer ownership + /// @param newOwner The new owner address + function transferOwnership(address newOwner) external onlyOwner { + address oldOwner = owner; + owner = newOwner; + emit OwnerTransferred(oldOwner, newOwner); + } + + // ============ Internal Functions ============ + + /// @notice Parse the journal bytes into attestation fields + function _parseJournal(bytes calldata journal) + internal + pure + returns ( + uint64 timestampMs, + bytes32 pcrHash, + bytes memory rootKey, + bytes memory publicKey, + bytes memory userData + ) + { + uint256 offset = 0; + + timestampMs = uint64(bytes8(journal[offset:offset + 8])); + offset += 8; + + pcrHash = bytes32(journal[offset:offset + 32]); + offset += 32; + + rootKey = journal[offset:offset + 96]; + offset += 96; + + uint8 pubkeyLen = uint8(journal[offset]); + offset += 1; + + publicKey = journal[offset:offset + pubkeyLen]; + offset += pubkeyLen; + + uint16 userDataLen = uint16(bytes2(journal[offset:offset + 2])); + offset += 2; + + userData = journal[offset:offset + userDataLen]; + } + + /// @notice Extract Ethereum address from secp256k1 uncompressed public key + /// @param publicKey 65 bytes: 0x04 prefix + 32-byte x + 32-byte y + function _extractAddress(bytes memory publicKey) internal pure returns (address) { + bytes memory coordinates = new bytes(64); + for (uint256 i = 0; i < 64; i++) { + coordinates[i] = publicKey[i + 1]; + } + return address(uint160(uint256(keccak256(coordinates)))); + } +} diff --git a/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol b/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol new file mode 100644 index 0000000000000..9a758435f7321 --- /dev/null +++ b/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +//////////////////////////////////////////////////////////////// +// `TeeDisputeGame` Errors // +//////////////////////////////////////////////////////////////// + +/// @notice Thrown when the claim has already been challenged. +error ClaimAlreadyChallenged(); + +/// @notice Thrown when the game type of the parent game does not match the current game. +error UnexpectedGameType(); + +/// @notice Thrown when the parent game is invalid. +error InvalidParentGame(); + +/// @notice Thrown when the parent game is not resolved. +error ParentGameNotResolved(); + +/// @notice Thrown when the game is over. +error GameOver(); + +/// @notice Thrown when the game is not over. +error GameNotOver(); + +/// @notice Thrown when the proposal status is invalid. +error InvalidProposalStatus(); + +/// @notice Thrown when the game is initialized by an incorrect factory. +error IncorrectDisputeGameFactory(); diff --git a/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol b/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol new file mode 100644 index 0000000000000..101ff6bfdbe2a --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Test} from "forge-std/Test.sol"; +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {GameType, Claim, GameStatus} from "src/dispute/lib/Types.sol"; +import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; +import {MockStatusDisputeGame} from "test/dispute/tee/mocks/MockStatusDisputeGame.sol"; + +contract AccessManagerTest is Test { + uint256 internal constant FALLBACK_TIMEOUT = 7 days; + + MockDisputeGameFactory internal factory; + AccessManager internal accessManager; + + function setUp() public { + factory = new MockDisputeGameFactory(); + accessManager = new AccessManager(FALLBACK_TIMEOUT, IDisputeGameFactory(address(factory))); + } + + function test_getLastProposalTimestamp_returnsDeploymentTimestampWhenNoGames() public view { + assertEq(accessManager.getLastProposalTimestamp(), accessManager.DEPLOYMENT_TIMESTAMP()); + } + + function test_getLastProposalTimestamp_scansBackwardForLatestTeeGame() public { + factory.pushGame( + GameType.wrap(100), + uint64(block.timestamp + 1), + IDisputeGame(address(_mockGame(GameType.wrap(100), 1))), + Claim.wrap(bytes32(uint256(1))), + bytes("") + ); + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(block.timestamp + 2), + IDisputeGame(address(_mockGame(GameType.wrap(TEE_DISPUTE_GAME_TYPE), 2))), + Claim.wrap(bytes32(uint256(2))), + bytes("") + ); + factory.pushGame( + GameType.wrap(200), + uint64(block.timestamp + 3), + IDisputeGame(address(_mockGame(GameType.wrap(200), 3))), + Claim.wrap(bytes32(uint256(3))), + bytes("") + ); + + assertEq(accessManager.getLastProposalTimestamp(), block.timestamp + 2); + } + + function test_getLastProposalTimestamp_returnsDeploymentTimestampWhenLatestTeeGameIsOlderThanDeployment() + public + { + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(accessManager.DEPLOYMENT_TIMESTAMP() - 1), + IDisputeGame(address(_mockGame(GameType.wrap(TEE_DISPUTE_GAME_TYPE), 1))), + Claim.wrap(bytes32(uint256(1))), + bytes("") + ); + + assertEq(accessManager.getLastProposalTimestamp(), accessManager.DEPLOYMENT_TIMESTAMP()); + } + + function test_isProposalPermissionlessMode_activatesAfterFallbackTimeout() public { + vm.warp(block.timestamp + FALLBACK_TIMEOUT + 1); + assertTrue(accessManager.isProposalPermissionlessMode()); + } + + function test_isProposalPermissionlessMode_zeroAddressOverride() public { + accessManager.setProposer(address(0), true); + assertTrue(accessManager.isProposalPermissionlessMode()); + } + + function test_isAllowedProposer_returnsTrueForWhitelistedProposer() public { + address proposer = makeAddr("proposer"); + accessManager.setProposer(proposer, true); + assertTrue(accessManager.isAllowedProposer(proposer)); + } + + function test_isAllowedChallenger_respectsZeroAddressWildcard() public { + address challenger = makeAddr("challenger"); + accessManager.setChallenger(address(0), true); + assertTrue(accessManager.isAllowedChallenger(challenger)); + } + + function test_isAllowedChallenger_returnsFalseForUnlistedChallenger() public { + assertFalse(accessManager.isAllowedChallenger(makeAddr("challenger"))); + } + + function _mockGame(GameType gameType_, uint256 nonce) internal returns (MockStatusDisputeGame) { + return new MockStatusDisputeGame({ + creator_: vm.addr(nonce + 1), + gameType_: gameType_, + rootClaim_: Claim.wrap(bytes32(nonce)), + l2SequenceNumber_: nonce, + extraData_: bytes(""), + status_: GameStatus.IN_PROGRESS, + createdAt_: uint64(block.timestamp), + resolvedAt_: 0, + respected_: true, + anchorStateRegistry_: IAnchorStateRegistry(address(0)) + }); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol new file mode 100644 index 0000000000000..7426c95c997dc --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol @@ -0,0 +1,137 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Proxy} from "src/universal/Proxy.sol"; +import {AnchorStateRegistry} from "src/dispute/AnchorStateRegistry.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {Claim, Duration, GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; +import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; +import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; +import {MockTeeProofVerifier} from "test/dispute/tee/mocks/MockTeeProofVerifier.sol"; +import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; + +contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { + uint256 internal constant DEFENDER_BOND = 1 ether; + uint256 internal constant CHALLENGER_BOND = 2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; + uint64 internal constant MAX_PROVE_DURATION = 12 hours; + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("anchor-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("anchor-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 10; + + MockDisputeGameFactory internal factory; + MockSystemConfig internal systemConfig; + MockTeeProofVerifier internal teeProofVerifier; + AccessManager internal accessManager; + TeeDisputeGame internal implementation; + IAnchorStateRegistry internal anchorStateRegistry; + + address internal proposer; + address internal challenger; + address internal executor; + + function setUp() public { + proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; + challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; + executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; + + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + factory = new MockDisputeGameFactory(); + systemConfig = new MockSystemConfig(address(this)); + teeProofVerifier = new MockTeeProofVerifier(); + + AnchorStateRegistry anchorStateRegistryImpl = new AnchorStateRegistry(0); + Proxy anchorStateRegistryProxy = new Proxy(address(this)); + anchorStateRegistryProxy.upgradeToAndCall( + address(anchorStateRegistryImpl), + abi.encodeCall( + anchorStateRegistryImpl.initialize, + ( + ISystemConfig(address(systemConfig)), + IDisputeGameFactory(address(factory)), + Proposal({ + root: Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + GameType.wrap(TEE_DISPUTE_GAME_TYPE) + ) + ) + ); + anchorStateRegistry = IAnchorStateRegistry(address(anchorStateRegistryProxy)); + + accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); + accessManager.setProposer(proposer, true); + accessManager.setChallenger(challenger, true); + + implementation = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(teeProofVerifier)), + CHALLENGER_BOND, + anchorStateRegistry, + accessManager + ); + + factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); + factory.setInitBond(GameType.wrap(TEE_DISPUTE_GAME_TYPE), DEFENDER_BOND); + } + + function test_anchorStateRegistry_acceptsTeeDisputeGame() public { + vm.warp(block.timestamp + 1); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + assertTrue(anchorStateRegistry.isGameRegistered(game)); + assertTrue(anchorStateRegistry.isGameProper(game)); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: keccak256("end-block"), + endStateHash: keccak256("end-state"), + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + game.prove(abi.encode(proofs)); + game.resolve(); + + vm.warp(block.timestamp + 1); + AnchorStateRegistry(address(anchorStateRegistry)).setAnchorState(game); + + assertEq(address(AnchorStateRegistry(address(anchorStateRegistry)).anchorGame()), address(game)); + } + + function _createGame( + address creator, + uint256 l2SequenceNumber, + uint32 parentIndex, + bytes32 blockHash_, + bytes32 stateHash_ + ) + internal + returns (TeeDisputeGame game, bytes memory extraData, Claim rootClaim) + { + extraData = buildExtraData(l2SequenceNumber, parentIndex, blockHash_, stateHash_); + rootClaim = computeRootClaim(blockHash_, stateHash_); + + vm.startPrank(creator, creator); + game = TeeDisputeGame( + payable(address(factory.create{value: DEFENDER_BOND}(GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData))) + ); + vm.stopPrank(); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol new file mode 100644 index 0000000000000..3c0a1963d7dd0 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol @@ -0,0 +1,141 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Test} from "forge-std/Test.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; +import {GameType, Claim} from "src/dispute/lib/Types.sol"; + +contract DisputeGameFactoryRouterTest is Test { + DisputeGameFactoryRouter public router; + + // XLayer factory on ETH mainnet + address constant XLAYER_FACTORY = 0x9D4c8FAEadDdDeeE1Ed0c92dAbAD815c2484f675; + + address owner; + address alice; + + uint256 constant ZONE_XLAYER = 1; + uint256 constant ZONE_OTHER = 2; + + function setUp() public { + owner = address(this); + alice = makeAddr("alice"); + router = new DisputeGameFactoryRouter(); + } + + //////////////////////////////////////////////////////////////// + // Zone CRUD Tests // + //////////////////////////////////////////////////////////////// + + function test_registerZone() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + assertEq(router.getFactory(ZONE_XLAYER), XLAYER_FACTORY); + } + + function test_registerZone_revertDuplicate() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneAlreadyRegistered.selector, ZONE_XLAYER)); + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + } + + function test_registerZone_revertZeroAddress() public { + vm.expectRevert(IDisputeGameFactoryRouter.ZeroAddress.selector); + router.registerZone(ZONE_XLAYER, address(0)); + } + + function test_updateZone() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + address newFactory = makeAddr("newFactory"); + router.updateZone(ZONE_XLAYER, newFactory); + assertEq(router.getFactory(ZONE_XLAYER), newFactory); + } + + function test_updateZone_revertNotRegistered() public { + vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); + router.updateZone(ZONE_XLAYER, XLAYER_FACTORY); + } + + function test_removeZone() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + router.removeZone(ZONE_XLAYER); + assertEq(router.getFactory(ZONE_XLAYER), address(0)); + } + + function test_removeZone_revertNotRegistered() public { + vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); + router.removeZone(ZONE_XLAYER); + } + + //////////////////////////////////////////////////////////////// + // Access Control Tests // + //////////////////////////////////////////////////////////////// + + function test_registerZone_revertNotOwner() public { + vm.prank(alice); + vm.expectRevert("Ownable: caller is not the owner"); + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + } + + function test_updateZone_revertNotOwner() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + vm.prank(alice); + vm.expectRevert("Ownable: caller is not the owner"); + router.updateZone(ZONE_XLAYER, makeAddr("newFactory")); + } + + function test_removeZone_revertNotOwner() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + vm.prank(alice); + vm.expectRevert("Ownable: caller is not the owner"); + router.removeZone(ZONE_XLAYER); + } + + //////////////////////////////////////////////////////////////// + // Create Tests (Fork) // + //////////////////////////////////////////////////////////////// + + function test_create_revertZoneNotRegistered() public { + vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); + router.create(ZONE_XLAYER, GameType.wrap(0), Claim.wrap(bytes32(0)), ""); + } + + function test_createBatch_revertEmpty() public { + IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](0); + vm.expectRevert(IDisputeGameFactoryRouter.BatchEmpty.selector); + router.createBatch(params); + } + + function test_createBatch_revertBondMismatch() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + + IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](1); + params[0] = IDisputeGameFactoryRouter.CreateParams({ + zoneId: ZONE_XLAYER, + gameType: GameType.wrap(0), + rootClaim: Claim.wrap(bytes32(0)), + extraData: "", + bond: 1 ether + }); + + vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.BatchBondMismatch.selector, 1 ether, 0)); + router.createBatch(params); + } + + //////////////////////////////////////////////////////////////// + // View Function Tests // + //////////////////////////////////////////////////////////////// + + function test_getFactory_unregistered() public view { + assertEq(router.getFactory(999), address(0)); + } + + function test_factories_mapping() public { + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + assertEq(router.factories(ZONE_XLAYER), XLAYER_FACTORY); + } + + function test_version() public view { + assertEq(router.version(), "1.0.0"); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol new file mode 100644 index 0000000000000..6d4ae3f5400f9 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol @@ -0,0 +1,72 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Test} from "forge-std/Test.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; +import {GameType, Claim} from "src/dispute/lib/Types.sol"; +import {MockCloneableDisputeGame} from "test/dispute/tee/mocks/MockCloneableDisputeGame.sol"; +import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; + +contract DisputeGameFactoryRouterCreateTest is Test { + uint256 internal constant ZONE_ONE = 1; + uint256 internal constant ZONE_TWO = 2; + GameType internal constant GAME_TYPE = GameType.wrap(1960); + + DisputeGameFactoryRouter internal router; + MockDisputeGameFactory internal factoryOne; + MockDisputeGameFactory internal factoryTwo; + MockCloneableDisputeGame internal gameImpl; + + function setUp() public { + router = new DisputeGameFactoryRouter(); + factoryOne = new MockDisputeGameFactory(); + factoryTwo = new MockDisputeGameFactory(); + gameImpl = new MockCloneableDisputeGame(); + + factoryOne.setImplementation(GAME_TYPE, gameImpl); + factoryTwo.setImplementation(GAME_TYPE, gameImpl); + factoryOne.setInitBond(GAME_TYPE, 1 ether); + factoryTwo.setInitBond(GAME_TYPE, 2 ether); + + router.registerZone(ZONE_ONE, address(factoryOne)); + router.registerZone(ZONE_TWO, address(factoryTwo)); + } + + function test_create_routesToZoneFactory() public { + Claim rootClaim = Claim.wrap(keccak256("zone-one")); + bytes memory extraData = abi.encodePacked(uint256(1)); + + address proxy = router.create{value: 1 ether}(ZONE_ONE, GAME_TYPE, rootClaim, extraData); + + assertTrue(proxy != address(0)); + assertEq(factoryOne.gameCount(), 1); + assertEq(factoryTwo.gameCount(), 0); + } + + function test_createBatch_routesAcrossZones() public { + IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](2); + params[0] = IDisputeGameFactoryRouter.CreateParams({ + zoneId: ZONE_ONE, + gameType: GAME_TYPE, + rootClaim: Claim.wrap(keccak256("zone-one")), + extraData: abi.encodePacked(uint256(11)), + bond: 1 ether + }); + params[1] = IDisputeGameFactoryRouter.CreateParams({ + zoneId: ZONE_TWO, + gameType: GAME_TYPE, + rootClaim: Claim.wrap(keccak256("zone-two")), + extraData: abi.encodePacked(uint256(22)), + bond: 2 ether + }); + + address[] memory proxies = router.createBatch{value: 3 ether}(params); + + assertEq(proxies.length, 2); + assertTrue(proxies[0] != address(0)); + assertTrue(proxies[1] != address(0)); + assertEq(factoryOne.gameCount(), 1); + assertEq(factoryTwo.gameCount(), 1); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md b/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md new file mode 100644 index 0000000000000..ce29e39f61d6c --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md @@ -0,0 +1,153 @@ +# TEE TEE Dispute Game — Integration Test Plan + +## Background + +Current test coverage has three layers: + +| Layer | Files | Characteristics | +|-------|-------|-----------------| +| Unit tests | 5 files, ~50 tests | All dependencies mocked, isolated per contract | +| Integration test | `AnchorStateRegistryCompatibility.t.sol` (1 test) | Real ASR + Proxy, but Factory and TeeProofVerifier are mocked | +| Fork E2E | `DisputeGameFactoryRouterFork.t.sol` (3 tests) | Mainnet fork, requires `ETH_RPC_URL`, skipped otherwise | + +### Problem + +The integration layer only covers **one happy path** (unchallenged → prove → DEFENDER_WINS → setAnchorState). The fork tests cover a challenged DEFENDER_WINS path but are **conditional on `ETH_RPC_URL`** — if CI doesn't configure it, these paths have zero real-contract coverage. + +Critical paths involving **fund distribution (REFUND vs NORMAL)**, **parent-child game chains**, and **third-party prover bond splitting** have never been verified with real ASR + real Factory together. + +## Goal + +Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite that verifies the TEE TEE dispute game full lifecycle with real contracts, runnable in CI without any RPC dependency. + +## Contract Setup + +### Real contracts (deployed via Proxy where applicable) + +| Contract | Deploy Method | Notes | +|----------|--------------|-------| +| `DisputeGameFactory` | Proxy + `initialize(owner)` | Replaces `MockDisputeGameFactory` | +| `AnchorStateRegistry` | Proxy + `initialize(...)` | Already real in current integration test | +| `TeeProofVerifier` | `new TeeProofVerifier(verifier, imageId, rootKey)` | With real enclave registration flow | +| `TeeDisputeGame` | Implementation set in factory, cloned on `create()` | Real game logic | +| `AccessManager` | `new AccessManager(timeout, factory)` | Already real | +| `DisputeGameFactoryRouter` | `new DisputeGameFactoryRouter()` | For Router-based creation tests | + +### Mocks (minimal, non-critical) + +| Mock | Reason | +|------|--------| +| `MockRiscZeroVerifier` | ZK proof verification is out of scope; only need it to not revert during `register()` | +| `MockSystemConfig` | Provides `paused()` and `guardian`; no real SystemConfig needed for these tests | + +## Test Cases + +### Test 1: `test_lifecycle_unchallenged_defenderWins` + +**Path**: create → (no challenge) → wait MAX_CHALLENGE_DURATION → resolve → closeGame → claimCredit + +**Verifies**: +- Simplest happy path with real Factory + real ASR +- `resolve()` returns `DEFENDER_WINS` when unchallenged and time expires +- `closeGame()` → `ASR.isGameFinalized()` passes → `bondDistributionMode = NORMAL` +- `setAnchorState` succeeds, `anchorGame` updates +- Proposer receives back `DEFENDER_BOND` + +--- + +### Test 2: `test_lifecycle_challenged_proveByProposer_defenderWins` + +**Path**: create → challenge → proposer proves → resolve → closeGame → claimCredit + +**Verifies**: +- Challenge + prove flow with real TeeProofVerifier (registered enclave) +- `resolve()` returns `DEFENDER_WINS` +- `closeGame()` → `bondDistributionMode = NORMAL` +- Proposer receives `DEFENDER_BOND + CHALLENGER_BOND` (wins challenger's bond) +- `setAnchorState` succeeds + +--- + +### Test 3: `test_lifecycle_challenged_proveByThirdParty_bondSplit` + +**Path**: create → challenge → third-party proves → resolve → closeGame → claimCredit (proposer) + claimCredit (prover) + +**Verifies**: +- Third-party prover bond splitting with real ASR determining `bondDistributionMode` +- `bondDistributionMode = NORMAL` +- Proposer receives `DEFENDER_BOND`, prover receives `CHALLENGER_BOND` +- Both `claimCredit` calls succeed with correct amounts + +--- + +### Test 4: `test_lifecycle_challenged_timeout_challengerWins_refund` + +**Path**: create → challenge → (no prove) → wait MAX_PROVE_DURATION → resolve → closeGame → claimCredit + +**Verifies**: +- **REFUND mode** — the most critical untested path with real contracts +- `resolve()` returns `CHALLENGER_WINS` +- `closeGame()` → `ASR.isGameProper()` returns false for CHALLENGER_WINS → `bondDistributionMode = REFUND` +- `setAnchorState` is attempted but silently fails (try-catch in `closeGame`) +- `anchorGame` does NOT update +- Proposer gets back `DEFENDER_BOND`, challenger gets back `CHALLENGER_BOND` (each refunded their own deposit) + +--- + +### Test 5: `test_lifecycle_parentChildChain_defenderWins` + +**Path**: create parent → resolve parent (DEFENDER_WINS) → create child (parentIndex=0) → resolve child + +**Verifies**: +- Child game's `startingOutputRoot` comes from parent's rootClaim (not anchor state) +- Child cannot resolve before parent resolves (revert `ParentGameNotResolved`) +- After parent resolves, child lifecycle works normally +- Real Factory's `gameAtIndex()` is used to look up parent — validates the full lookup chain + +--- + +### Test 6: `test_lifecycle_parentChallengerWins_childShortCircuits` + +**Path**: create parent → challenge parent → parent timeout → resolve parent (CHALLENGER_WINS) → create child → challenge child → resolve child + +**Verifies**: +- When parent is `CHALLENGER_WINS`, child's resolve short-circuits to `CHALLENGER_WINS` +- Bond distribution for short-circuited child: challenger gets `DEFENDER_BOND + CHALLENGER_BOND` +- Tests the cascading failure propagation through game chains + +--- + +### Test 7: `test_lifecycle_viaRouter_fullCycle` + +**Path**: Router.create → challenge → prove → resolve → closeGame → claimCredit + +**Verifies**: +- `gameCreator()` is the Router address +- `proposer()` is `tx.origin` (transparent pass-through) +- Full lifecycle works identically when created via Router vs direct Factory call +- Bond accounting attributes correctly to tx.origin proposer, not Router + +## Shared Test Infrastructure + +Reuse `TeeTestUtils` as base contract. Add a shared `setUp()` helper that deploys the full real-contract stack: + +```solidity +function _deployFullStack() internal { + // 1. Deploy real DisputeGameFactory via Proxy + // 2. Deploy real AnchorStateRegistry via Proxy + // 3. Deploy real TeeProofVerifier (with MockRiscZeroVerifier) + // - Register enclave via real register() flow + // 4. Deploy real AccessManager + // 5. Deploy real TeeDisputeGame implementation + // 6. Register implementation + init bond in factory + // 7. (Optional) Deploy DisputeGameFactoryRouter + register zone +} +``` + +## Relationship to Existing Tests + +| File | Action | +|------|--------| +| `AnchorStateRegistryCompatibility.t.sol` | Can be removed or kept as-is; the new integration tests fully subsume it | +| `DisputeGameFactoryRouterFork.t.sol` | Keep — it uniquely tests XLayer cross-zone interop on mainnet fork | +| Unit test files | Keep — they test error paths and edge cases exhaustively with fast mock-based isolation | diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol new file mode 100644 index 0000000000000..419581b435576 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -0,0 +1,636 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {BadAuth, GameNotFinalized, IncorrectBondAmount, UnexpectedRootClaim} from "src/dispute/lib/Errors.sol"; +import { + ClaimAlreadyChallenged, + InvalidParentGame, + ParentGameNotResolved, + GameNotOver +} from "src/dispute/tee/lib/Errors.sol"; +import {BondDistributionMode, Duration, GameType, Claim, Hash, GameStatus} from "src/dispute/lib/Types.sol"; +import {MockAnchorStateRegistry} from "test/dispute/tee/mocks/MockAnchorStateRegistry.sol"; +import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; +import {MockStatusDisputeGame} from "test/dispute/tee/mocks/MockStatusDisputeGame.sol"; +import {MockTeeProofVerifier} from "test/dispute/tee/mocks/MockTeeProofVerifier.sol"; +import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; + +contract TeeDisputeGameTest is TeeTestUtils { + uint256 internal constant DEFENDER_BOND = 1 ether; + uint256 internal constant CHALLENGER_BOND = 2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; + uint64 internal constant MAX_PROVE_DURATION = 12 hours; + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("anchor-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("anchor-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 10; + + MockDisputeGameFactory internal factory; + MockAnchorStateRegistry internal anchorStateRegistry; + MockTeeProofVerifier internal teeProofVerifier; + AccessManager internal accessManager; + TeeDisputeGame internal implementation; + + address internal proposer; + address internal challenger; + address internal executor; + address internal thirdPartyProver; + + function setUp() public { + proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; + challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; + executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; + thirdPartyProver = makeWallet(DEFAULT_THIRD_PARTY_PROVER_KEY, "third-party-prover").addr; + + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + factory = new MockDisputeGameFactory(); + anchorStateRegistry = new MockAnchorStateRegistry(); + teeProofVerifier = new MockTeeProofVerifier(); + + accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); + accessManager.setProposer(proposer, true); + accessManager.setChallenger(challenger, true); + + implementation = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(teeProofVerifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(anchorStateRegistry)), + accessManager + ); + + factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); + factory.setInitBond(GameType.wrap(TEE_DISPUTE_GAME_TYPE), DEFENDER_BOND); + + anchorStateRegistry.setAnchor(Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), ANCHOR_L2_BLOCK); + anchorStateRegistry.setRespectedGameType(GameType.wrap(TEE_DISPUTE_GAME_TYPE)); + } + + function test_initialize_usesAnchorStateForRootGame() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + (Hash startingRoot, uint256 startingBlockNumber) = game.startingOutputRoot(); + assertEq(startingRoot.raw(), computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()); + assertEq(startingBlockNumber, ANCHOR_L2_BLOCK); + assertEq(game.proposer(), proposer); + assertEq(game.refundModeCredit(proposer), DEFENDER_BOND); + assertTrue(game.wasRespectedGameTypeWhenCreated()); + } + + function test_initialize_tracksTxOriginProposerThroughRouter() public { + DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(); + uint256 zoneId = 1; + router.registerZone(zoneId, address(factory)); + + bytes32 endBlockHash = keccak256("router-end-block"); + bytes32 endStateHash = keccak256("router-end-state"); + bytes memory extraData = + buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + Claim rootClaim = computeRootClaim(endBlockHash, endStateHash); + + vm.startPrank(proposer, proposer); + address proxy = router.create{value: DEFENDER_BOND}(zoneId, GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData); + vm.stopPrank(); + + TeeDisputeGame game = TeeDisputeGame(payable(proxy)); + assertEq(game.gameCreator(), address(router)); + assertEq(game.proposer(), proposer); + assertEq(game.refundModeCredit(proposer), DEFENDER_BOND); + assertEq(game.refundModeCredit(address(router)), 0); + } + + function test_initialize_usesParentGameOutput() public { + MockStatusDisputeGame parent = new MockStatusDisputeGame( + proposer, + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + computeRootClaim(keccak256("parent-block"), keccak256("parent-state")), + ANCHOR_L2_BLOCK + 3, + bytes("parent"), + GameStatus.IN_PROGRESS, + uint64(block.timestamp), + 0, + true, + IAnchorStateRegistry(address(anchorStateRegistry)) + ); + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(block.timestamp), + IDisputeGame(address(parent)), + parent.rootClaim(), + bytes("parent") + ); + anchorStateRegistry.setGameFlags(IDisputeGame(address(parent)), true, true, false, false, false, true, false); + + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); + + (Hash startingRoot, uint256 startingBlockNumber) = game.startingOutputRoot(); + assertEq(startingRoot.raw(), parent.rootClaim().raw()); + assertEq(startingBlockNumber, parent.l2SequenceNumber()); + } + + function test_initialize_revertUnauthorizedProposer() public { + address unauthorized = makeAddr("unauthorized"); + vm.deal(unauthorized, DEFENDER_BOND); + + vm.expectRevert(BadAuth.selector); + _createGame(unauthorized, ANCHOR_L2_BLOCK + 1, type(uint32).max, keccak256("block"), keccak256("state")); + } + + function test_initialize_revertRootClaimMismatch() public { + bytes memory extraData = + buildExtraData(ANCHOR_L2_BLOCK + 1, type(uint32).max, keccak256("block"), keccak256("state")); + Claim wrongRootClaim = Claim.wrap(keccak256("wrong-root-claim")); + Claim expectedRootClaim = computeRootClaim(keccak256("block"), keccak256("state")); + + vm.startPrank(proposer, proposer); + vm.expectRevert( + abi.encodeWithSelector( + TeeDisputeGame.RootClaimMismatch.selector, expectedRootClaim.raw(), wrongRootClaim.raw() + ) + ); + factory.create{value: DEFENDER_BOND}(GameType.wrap(TEE_DISPUTE_GAME_TYPE), wrongRootClaim, extraData); + vm.stopPrank(); + } + + function test_initialize_revertWhenL2SequenceNumberDoesNotAdvance() public { + vm.expectRevert(abi.encodeWithSelector(UnexpectedRootClaim.selector, computeRootClaim(keccak256("block"), keccak256("state")))); + _createGame(proposer, ANCHOR_L2_BLOCK, type(uint32).max, keccak256("block"), keccak256("state")); + } + + function test_initialize_revertInvalidParentGame() public { + MockStatusDisputeGame parent = new MockStatusDisputeGame( + proposer, + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + computeRootClaim(keccak256("parent-block"), keccak256("parent-state")), + ANCHOR_L2_BLOCK + 3, + bytes("parent"), + GameStatus.CHALLENGER_WINS, + uint64(block.timestamp), + uint64(block.timestamp), + true, + IAnchorStateRegistry(address(anchorStateRegistry)) + ); + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(block.timestamp), + IDisputeGame(address(parent)), + parent.rootClaim(), + bytes("parent") + ); + anchorStateRegistry.setGameFlags(IDisputeGame(address(parent)), true, true, false, false, false, true, false); + + vm.expectRevert(InvalidParentGame.selector); + _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); + } + + function test_challenge_updatesState() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.prank(challenger); + TeeDisputeGame.ProposalStatus proposalStatus = game.challenge{value: CHALLENGER_BOND}(); + + (, address counteredBy,, , TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); + assertEq(counteredBy, challenger); + assertEq(uint8(proposalStatus), uint8(TeeDisputeGame.ProposalStatus.Challenged)); + assertEq(uint8(storedStatus), uint8(TeeDisputeGame.ProposalStatus.Challenged)); + assertEq(game.refundModeCredit(challenger), CHALLENGER_BOND); + } + + function test_challenge_revertIncorrectBond() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.prank(challenger); + vm.expectRevert(IncorrectBondAmount.selector); + game.challenge{value: CHALLENGER_BOND - 1}(); + } + + function test_challenge_revertWhenAlreadyChallenged() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + vm.prank(challenger); + vm.expectRevert(ClaimAlreadyChallenged.selector); + game.challenge{value: CHALLENGER_BOND}(); + } + + function test_prove_succeedsWithSingleBatch() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + TeeDisputeGame.ProposalStatus status = game.prove(abi.encode(proofs)); + (, , address prover,, TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); + assertEq(prover, address(this)); + assertEq(uint8(status), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); + assertEq(uint8(storedStatus), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); + } + + function test_prove_succeedsWithChainedBatches() public { + bytes32 middleBlockHash = keccak256("middle-block"); + bytes32 middleStateHash = keccak256("middle-state"); + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 8, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](2); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: middleBlockHash, + endStateHash: middleStateHash, + l2Block: ANCHOR_L2_BLOCK + 4 + }), + DEFAULT_EXECUTOR_KEY + ); + proofs[1] = buildBatchProof( + BatchInput({ + startBlockHash: middleBlockHash, + startStateHash: middleStateHash, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + TeeDisputeGame.ProposalStatus status = game.prove(abi.encode(proofs)); + assertEq(uint8(status), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); + } + + function test_prove_revertEmptyBatchProofs() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.expectRevert(TeeDisputeGame.EmptyBatchProofs.selector); + game.prove(abi.encode(new TeeDisputeGame.BatchProof[](0))); + } + + function test_prove_revertStartHashMismatch() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: keccak256("wrong-start-block"), + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert( + abi.encodeWithSelector( + TeeDisputeGame.StartHashMismatch.selector, + computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw(), + keccak256(abi.encode(keccak256("wrong-start-block"), ANCHOR_STATE_HASH)) + ) + ); + game.prove(abi.encode(proofs)); + } + + function test_prove_revertBatchChainBreak() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 8, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](2); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: keccak256("middle-block"), + endStateHash: keccak256("middle-state"), + l2Block: ANCHOR_L2_BLOCK + 4 + }), + DEFAULT_EXECUTOR_KEY + ); + proofs[1] = buildBatchProof( + BatchInput({ + startBlockHash: keccak256("different-block"), + startStateHash: keccak256("different-state"), + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert(abi.encodeWithSelector(TeeDisputeGame.BatchChainBreak.selector, 1)); + game.prove(abi.encode(proofs)); + } + + function test_prove_revertBatchBlockNotIncreasing() public { + bytes32 middleBlockHash = keccak256("middle-block"); + bytes32 middleStateHash = keccak256("middle-state"); + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 8, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](2); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: middleBlockHash, + endStateHash: middleStateHash, + l2Block: ANCHOR_L2_BLOCK + 4 + }), + DEFAULT_EXECUTOR_KEY + ); + proofs[1] = buildBatchProof( + BatchInput({ + startBlockHash: middleBlockHash, + startStateHash: middleStateHash, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: ANCHOR_L2_BLOCK + 4 + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert(abi.encodeWithSelector(TeeDisputeGame.BatchBlockNotIncreasing.selector, 1, ANCHOR_L2_BLOCK + 4, ANCHOR_L2_BLOCK + 4)); + game.prove(abi.encode(proofs)); + } + + function test_prove_revertFinalHashMismatch() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: keccak256("wrong-end-block"), + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert( + abi.encodeWithSelector( + TeeDisputeGame.FinalHashMismatch.selector, + computeRootClaim(endBlockHash, endStateHash).raw(), + keccak256(abi.encode(keccak256("wrong-end-block"), endStateHash)) + ) + ); + game.prove(abi.encode(proofs)); + } + + function test_prove_revertFinalBlockMismatch() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() - 1 + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert( + abi.encodeWithSelector(TeeDisputeGame.FinalBlockMismatch.selector, game.l2SequenceNumber(), game.l2SequenceNumber() - 1) + ); + game.prove(abi.encode(proofs)); + } + + function test_prove_revertWhenVerifierRejectsSignature() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.expectRevert(MockTeeProofVerifier.EnclaveNotRegistered.selector); + game.prove(abi.encode(proofs)); + } + + function test_resolve_revertWhenParentInProgress() public { + MockStatusDisputeGame parent = new MockStatusDisputeGame( + proposer, + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + computeRootClaim(keccak256("parent-block"), keccak256("parent-state")), + ANCHOR_L2_BLOCK + 3, + bytes("parent"), + GameStatus.IN_PROGRESS, + uint64(block.timestamp), + 0, + true, + IAnchorStateRegistry(address(anchorStateRegistry)) + ); + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(block.timestamp), + IDisputeGame(address(parent)), + parent.rootClaim(), + bytes("parent") + ); + anchorStateRegistry.setGameFlags(IDisputeGame(address(parent)), true, true, false, false, false, true, false); + + (TeeDisputeGame child,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); + + vm.expectRevert(ParentGameNotResolved.selector); + child.resolve(); + } + + function test_resolve_parentChallengerWinsShortCircuits() public { + MockStatusDisputeGame parent = new MockStatusDisputeGame( + proposer, + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + computeRootClaim(keccak256("parent-block"), keccak256("parent-state")), + ANCHOR_L2_BLOCK + 3, + bytes("parent"), + GameStatus.IN_PROGRESS, + uint64(block.timestamp), + 0, + true, + IAnchorStateRegistry(address(anchorStateRegistry)) + ); + factory.pushGame( + GameType.wrap(TEE_DISPUTE_GAME_TYPE), + uint64(block.timestamp), + IDisputeGame(address(parent)), + parent.rootClaim(), + bytes("parent") + ); + anchorStateRegistry.setGameFlags(IDisputeGame(address(parent)), true, true, false, false, false, true, false); + + (TeeDisputeGame child,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); + + parent.setStatus(GameStatus.CHALLENGER_WINS); + parent.setResolvedAt(uint64(block.timestamp)); + + vm.prank(challenger); + child.challenge{value: CHALLENGER_BOND}(); + + GameStatus status = child.resolve(); + assertEq(uint8(status), uint8(GameStatus.CHALLENGER_WINS)); + assertEq(child.normalModeCredit(challenger), DEFENDER_BOND + CHALLENGER_BOND); + } + + function test_resolve_challengedWithThirdPartyProverSplitsCreditAndClaimCredit() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.prank(thirdPartyProver); + game.prove(abi.encode(proofs)); + + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + assertEq(game.normalModeCredit(thirdPartyProver), CHALLENGER_BOND); + assertEq(game.normalModeCredit(proposer), DEFENDER_BOND); + + anchorStateRegistry.setGameFlags(game, true, true, false, false, true, true, true); + + uint256 proposerBalanceBefore = proposer.balance; + uint256 proverBalanceBefore = thirdPartyProver.balance; + game.claimCredit(proposer); + game.claimCredit(thirdPartyProver); + + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + assertEq(thirdPartyProver.balance, proverBalanceBefore + CHALLENGER_BOND); + } + + function test_claimCredit_refundModeRefundsDeposits() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + assertEq(uint8(game.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + + anchorStateRegistry.setGameFlags(game, true, true, false, false, true, false, false); + + uint256 proposerBalanceBefore = proposer.balance; + uint256 challengerBalanceBefore = challenger.balance; + game.claimCredit(proposer); + game.claimCredit(challenger); + + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + assertEq(challenger.balance, challengerBalanceBefore + CHALLENGER_BOND); + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.REFUND)); + } + + function test_closeGame_revertWhenNotFinalized() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + vm.expectRevert(GameNotFinalized.selector); + game.closeGame(); + } + + function test_resolve_revertWhenGameNotOver() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.expectRevert(GameNotOver.selector); + game.resolve(); + } + + function _createGame( + address creator, + uint256 l2SequenceNumber, + uint32 parentIndex, + bytes32 blockHash_, + bytes32 stateHash_ + ) + internal + returns (TeeDisputeGame game, bytes memory extraData, Claim rootClaim) + { + extraData = buildExtraData(l2SequenceNumber, parentIndex, blockHash_, stateHash_); + rootClaim = computeRootClaim(blockHash_, stateHash_); + + vm.startPrank(creator, creator); + game = TeeDisputeGame( + payable(address(factory.create{value: DEFENDER_BOND}(GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData))) + ); + vm.stopPrank(); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol new file mode 100644 index 0000000000000..2ab9d04482384 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -0,0 +1,126 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Vm} from "forge-std/Vm.sol"; +import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; +import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; + +contract TeeProofVerifierTest is TeeTestUtils { + MockRiscZeroVerifier internal riscZeroVerifier; + TeeProofVerifier internal verifier; + + Vm.Wallet internal enclaveWallet; + bytes32 internal constant IMAGE_ID = keccak256("tee-image"); + bytes32 internal constant PCR_HASH = keccak256("pcr-hash"); + bytes internal expectedRootKey; + + function setUp() public { + riscZeroVerifier = new MockRiscZeroVerifier(); + expectedRootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + verifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); + enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "enclave"); + } + + function test_register_succeeds() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), "data"); + + verifier.register(hex"1234", journal); + + (bytes32 pcrHash, uint64 registeredAt) = verifier.registeredEnclaves(enclaveWallet.addr); + assertEq(pcrHash, PCR_HASH); + assertEq(registeredAt, 1234); + assertTrue(verifier.isRegistered(enclaveWallet.addr)); + } + + function test_register_revertUnauthorizedCaller() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + + vm.prank(makeAddr("attacker")); + vm.expectRevert(TeeProofVerifier.Unauthorized.selector); + verifier.register(hex"1234", journal); + } + + function test_register_revertInvalidProof() public { + riscZeroVerifier.setShouldRevert(true); + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + + vm.expectRevert(TeeProofVerifier.InvalidProof.selector); + verifier.register(hex"1234", journal); + } + + function test_register_revertInvalidRootKey() public { + bytes memory badRootKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); + bytes memory journal = buildJournal(1234, PCR_HASH, badRootKey, uncompressedPublicKey(enclaveWallet), ""); + + vm.expectRevert(TeeProofVerifier.InvalidRootKey.selector); + verifier.register(hex"1234", journal); + } + + function test_register_revertInvalidPublicKey() public { + bytes memory shortPublicKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2))); + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, shortPublicKey, ""); + + vm.expectRevert(TeeProofVerifier.InvalidPublicKey.selector); + verifier.register(hex"1234", journal); + } + + function test_register_revertDuplicateEnclave() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + verifier.register(hex"1234", journal); + + vm.expectRevert(TeeProofVerifier.EnclaveAlreadyRegistered.selector); + verifier.register(hex"1234", journal); + } + + function test_register_revertMalformedJournal() public { + vm.expectRevert(); + verifier.register(hex"1234", hex"0001"); + } + + function test_verifyBatch_succeedsForRegisteredEnclave() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + verifier.register(hex"1234", journal); + + bytes32 digest = keccak256("batch"); + bytes memory signature = signDigest(enclaveWallet.privateKey, digest); + + assertEq(verifier.verifyBatch(digest, signature), enclaveWallet.addr); + } + + function test_verifyBatch_revertForUnregisteredSigner() public { + bytes32 digest = keccak256("batch"); + bytes memory signature = signDigest(enclaveWallet.privateKey, digest); + + vm.expectRevert(TeeProofVerifier.EnclaveNotRegistered.selector); + verifier.verifyBatch(digest, signature); + } + + function test_verifyBatch_revertForInvalidSignature() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + verifier.register(hex"1234", journal); + + vm.expectRevert(TeeProofVerifier.InvalidSignature.selector); + verifier.verifyBatch(keccak256("batch"), hex"1234"); + } + + function test_revoke_succeeds() public { + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + verifier.register(hex"1234", journal); + + verifier.revoke(enclaveWallet.addr); + + assertFalse(verifier.isRegistered(enclaveWallet.addr)); + } + + function test_revoke_revertWhenEnclaveMissing() public { + vm.expectRevert(TeeProofVerifier.EnclaveNotRegistered.selector); + verifier.revoke(enclaveWallet.addr); + } + + function test_transferOwnership_updatesOwner() public { + address newOwner = makeAddr("newOwner"); + verifier.transferOwnership(newOwner); + assertEq(verifier.owner(), newOwner); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol new file mode 100644 index 0000000000000..1ed0fe4285412 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -0,0 +1,365 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Vm} from "forge-std/Vm.sol"; +import {Proxy} from "src/universal/Proxy.sol"; +import {AnchorStateRegistry} from "src/dispute/AnchorStateRegistry.sol"; +import {DisputeGameFactory} from "src/dispute/DisputeGameFactory.sol"; +import {PermissionedDisputeGame} from "src/dispute/PermissionedDisputeGame.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {Claim, Duration, GameStatus, GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; +import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; + +contract DisputeGameFactoryRouterForkTest is TeeTestUtils { + struct SecondZoneFixture { + DisputeGameFactory factory; + AnchorStateRegistry anchorStateRegistry; + TeeProofVerifier teeProofVerifier; + TeeDisputeGame implementation; + address registeredExecutor; + } + + struct XLayerConfig { + GameType gameType; + uint256 initBond; + address proposer; + } + + uint256 internal constant DEFENDER_BOND = 1 ether; + uint256 internal constant CHALLENGER_BOND = 2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; + uint64 internal constant MAX_PROVE_DURATION = 12 hours; + bytes32 internal constant IMAGE_ID = keccak256("fork-tee-image"); + bytes32 internal constant PCR_HASH = keccak256("fork-pcr-hash"); + + // XLayer's dispute game factory is deployed on Ethereum mainnet L1. + address internal constant XLAYER_FACTORY = 0x9D4c8FAEadDdDeeE1Ed0c92dAbAD815c2484f675; + uint256 internal constant ZONE_XLAYER = 1; + uint256 internal constant ZONE_SECOND = 2; + GameType internal constant XLAYER_GAME_TYPE = GameType.wrap(1); + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("fork-anchor-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("fork-anchor-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 10; + + DisputeGameFactory internal xLayerFactory; + DisputeGameFactoryRouter internal router; + bool internal hasFork; + + address internal proposer; + address internal challenger; + + function setUp() public { + proposer = makeWallet(DEFAULT_PROPOSER_KEY, "fork-proposer").addr; + challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "fork-challenger").addr; + + if (!vm.envExists("ETH_RPC_URL")) return; + + vm.createSelectFork(vm.envString("ETH_RPC_URL")); + hasFork = true; + xLayerFactory = DisputeGameFactory(XLAYER_FACTORY); + router = new DisputeGameFactoryRouter(); + router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + } + + function test_liveFactoryReadPaths() public view { + if (!hasFork) return; + + _assertLiveFactoryFork(); + + assertTrue(xLayerFactory.owner() != address(0)); + assertTrue(bytes(xLayerFactory.version()).length > 0); + assertTrue(address(xLayerFactory.gameImpls(XLAYER_GAME_TYPE)) != address(0)); + assertGt(xLayerFactory.initBonds(XLAYER_GAME_TYPE), 0); + } + + function test_routerCreate_onlyXLayer() public { + if (!hasFork) return; + + _assertLiveFactoryFork(); + XLayerConfig memory xLayer = _readXLayerConfig(); + + vm.deal(xLayer.proposer, 10 ether); + + Claim rootClaim = Claim.wrap(keccak256("xlayer-router-root")); + bytes memory extraData = abi.encodePacked(uint256(1_000_000_000)); + + vm.startPrank(xLayer.proposer, xLayer.proposer); + address proxy = router.create{value: xLayer.initBond}(ZONE_XLAYER, xLayer.gameType, rootClaim, extraData); + vm.stopPrank(); + + assertTrue(proxy != address(0)); + + (IDisputeGame storedGame,) = xLayerFactory.games(xLayer.gameType, rootClaim, extraData); + assertEq(address(storedGame), proxy); + assertEq(storedGame.gameCreator(), address(router)); + assertEq(storedGame.rootClaim().raw(), rootClaim.raw()); + } + + function test_routerCreate_onlySecondZone_lifecycle() public { + if (!hasFork) return; + + _assertLiveFactoryFork(); + SecondZoneFixture memory secondZone = _installSecondZoneFixture(proposer); + + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + bytes32 endBlockHash = keccak256("second-zone-end-block"); + bytes32 endStateHash = keccak256("second-zone-end-state"); + (TeeDisputeGame game, Claim rootClaim, bytes memory extraData) = + _createSecondZoneGame(endBlockHash, endStateHash, ANCHOR_L2_BLOCK + 6); + + _assertStoredSecondZoneGame(secondZone.factory, game, rootClaim, extraData); + assertEq(game.gameCreator(), address(router)); + assertEq(game.proposer(), proposer); + + _runSecondZoneLifecycle(secondZone, game, endBlockHash, endStateHash); + } + + function test_routerCreateBatch_xLayerAndSecondZone() public { + if (!hasFork) return; + + _assertLiveFactoryFork(); + XLayerConfig memory xLayer = _readXLayerConfig(); + SecondZoneFixture memory secondZone = _installSecondZoneFixture(xLayer.proposer); + + vm.deal(xLayer.proposer, 10 ether); + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + Claim xLayerRootClaim = Claim.wrap(keccak256("batch-xlayer-root")); + bytes memory xLayerExtraData = abi.encodePacked(uint256(1_000_000_001)); + + bytes32 secondZoneEndBlockHash = keccak256("batch-second-zone-end-block"); + bytes32 secondZoneEndStateHash = keccak256("batch-second-zone-end-state"); + bytes memory secondZoneExtraData = + buildExtraData(ANCHOR_L2_BLOCK + 8, type(uint32).max, secondZoneEndBlockHash, secondZoneEndStateHash); + Claim secondZoneRootClaim = computeRootClaim(secondZoneEndBlockHash, secondZoneEndStateHash); + + IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](2); + params[0] = IDisputeGameFactoryRouter.CreateParams({ + zoneId: ZONE_XLAYER, + gameType: xLayer.gameType, + rootClaim: xLayerRootClaim, + extraData: xLayerExtraData, + bond: xLayer.initBond + }); + params[1] = IDisputeGameFactoryRouter.CreateParams({ + zoneId: ZONE_SECOND, + gameType: TEE_GAME_TYPE, + rootClaim: secondZoneRootClaim, + extraData: secondZoneExtraData, + bond: DEFENDER_BOND + }); + + vm.startPrank(xLayer.proposer, xLayer.proposer); + address[] memory proxies = router.createBatch{value: xLayer.initBond + DEFENDER_BOND}(params); + vm.stopPrank(); + + assertEq(proxies.length, 2); + + (IDisputeGame xLayerStoredGame,) = xLayerFactory.games(xLayer.gameType, xLayerRootClaim, xLayerExtraData); + assertEq(address(xLayerStoredGame), proxies[0]); + assertEq(xLayerStoredGame.gameCreator(), address(router)); + + TeeDisputeGame secondZoneGame = TeeDisputeGame(payable(proxies[1])); + _assertStoredSecondZoneGame(secondZone.factory, secondZoneGame, secondZoneRootClaim, secondZoneExtraData); + assertEq(secondZoneGame.gameCreator(), address(router)); + assertEq(secondZoneGame.proposer(), xLayer.proposer); + + _runSecondZoneLifecycle(secondZone, secondZoneGame, secondZoneEndBlockHash, secondZoneEndStateHash); + } + + function _readXLayerConfig() internal view returns (XLayerConfig memory xLayer) { + xLayer.gameType = XLAYER_GAME_TYPE; + xLayer.initBond = xLayerFactory.initBonds(XLAYER_GAME_TYPE); + + PermissionedDisputeGame implementation = + PermissionedDisputeGame(payable(address(xLayerFactory.gameImpls(XLAYER_GAME_TYPE)))); + xLayer.proposer = implementation.proposer(); + + assertTrue(address(implementation) != address(0), "xlayer impl missing"); + assertGt(xLayer.initBond, 0, "xlayer init bond missing"); + } + + function _installSecondZoneFixture(address allowedProposer) + internal + returns (SecondZoneFixture memory secondZone) + { + secondZone.factory = _deployLocalDisputeGameFactory(); + router.registerZone(ZONE_SECOND, address(secondZone.factory)); + + secondZone.anchorStateRegistry = _deployRealAnchorStateRegistry(secondZone.factory); + (secondZone.teeProofVerifier, secondZone.registeredExecutor) = _deployRealTeeProofVerifier(); + + AccessManager accessManager = + new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(secondZone.factory))); + accessManager.setProposer(allowedProposer, true); + accessManager.setChallenger(challenger, true); + + secondZone.implementation = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(secondZone.factory)), + ITeeProofVerifier(address(secondZone.teeProofVerifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(secondZone.anchorStateRegistry)), + accessManager + ); + + secondZone.factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(secondZone.implementation)), bytes("")); + secondZone.factory.setInitBond(TEE_GAME_TYPE, DEFENDER_BOND); + + // Real ASR marks games created at or before the retirement timestamp as retired. + vm.warp(block.timestamp + 1); + } + + function _createSecondZoneGame( + bytes32 endBlockHash, + bytes32 endStateHash, + uint256 l2SequenceNumber + ) + internal + returns (TeeDisputeGame game, Claim rootClaim, bytes memory extraData) + { + extraData = buildExtraData(l2SequenceNumber, type(uint32).max, endBlockHash, endStateHash); + rootClaim = computeRootClaim(endBlockHash, endStateHash); + + vm.startPrank(proposer, proposer); + address proxy = router.create{value: DEFENDER_BOND}(ZONE_SECOND, TEE_GAME_TYPE, rootClaim, extraData); + vm.stopPrank(); + + game = TeeDisputeGame(payable(proxy)); + } + + function _runSecondZoneLifecycle( + SecondZoneFixture memory secondZone, + TeeDisputeGame game, + bytes32 endBlockHash, + bytes32 endStateHash + ) + internal + { + (Hash startingRoot, uint256 startingBlockNumber) = game.startingOutputRoot(); + assertEq(startingRoot.raw(), computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()); + assertEq(startingBlockNumber, ANCHOR_L2_BLOCK); + + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + address gameProposer = game.proposer(); + + vm.prank(gameProposer); + game.prove(abi.encode(proofs)); + + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + assertTrue(secondZone.anchorStateRegistry.isGameRegistered(game)); + assertTrue(secondZone.anchorStateRegistry.isGameProper(game)); + assertFalse(secondZone.anchorStateRegistry.isGameFinalized(game)); + assertTrue(secondZone.teeProofVerifier.isRegistered(secondZone.registeredExecutor)); + + vm.warp(block.timestamp + 1); + assertTrue(secondZone.anchorStateRegistry.isGameFinalized(game)); + assertEq(game.normalModeCredit(gameProposer), DEFENDER_BOND + CHALLENGER_BOND); + + uint256 proposerBalanceBefore = gameProposer.balance; + game.claimCredit(gameProposer); + assertEq(gameProposer.balance, proposerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + assertEq(address(secondZone.anchorStateRegistry.anchorGame()), address(game)); + } + + function _assertStoredSecondZoneGame( + DisputeGameFactory factory, + TeeDisputeGame game, + Claim rootClaim, + bytes memory extraData + ) + internal + view + { + (IDisputeGame storedGame,) = factory.games(TEE_GAME_TYPE, rootClaim, extraData); + assertEq(address(storedGame), address(game)); + assertEq(game.rootClaim().raw(), rootClaim.raw()); + } + + function _deployLocalDisputeGameFactory() internal returns (DisputeGameFactory factory) { + DisputeGameFactory implementation = new DisputeGameFactory(); + Proxy proxy = new Proxy(address(this)); + proxy.upgradeToAndCall( + address(implementation), + abi.encodeCall(implementation.initialize, (address(this))) + ); + factory = DisputeGameFactory(address(proxy)); + } + + function _deployRealAnchorStateRegistry(DisputeGameFactory factory) + internal + returns (AnchorStateRegistry anchorStateRegistry) + { + MockSystemConfig systemConfig = new MockSystemConfig(address(this)); + AnchorStateRegistry anchorStateRegistryImpl = new AnchorStateRegistry(0); + Proxy anchorStateRegistryProxy = new Proxy(address(this)); + anchorStateRegistryProxy.upgradeToAndCall( + address(anchorStateRegistryImpl), + abi.encodeCall( + anchorStateRegistryImpl.initialize, + ( + ISystemConfig(address(systemConfig)), + IDisputeGameFactory(address(factory)), + Proposal({ + root: Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + TEE_GAME_TYPE + ) + ) + ); + anchorStateRegistry = AnchorStateRegistry(address(anchorStateRegistryProxy)); + } + + function _deployRealTeeProofVerifier() + internal + returns (TeeProofVerifier teeProofVerifier, address registeredExecutor) + { + Vm.Wallet memory enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "fork-registered-enclave"); + MockRiscZeroVerifier riscZeroVerifier = new MockRiscZeroVerifier(); + bytes memory expectedRootKey = + abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + + registeredExecutor = enclaveWallet.addr; + teeProofVerifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); + bytes memory journal = + buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + teeProofVerifier.register("", journal); + } + + function _assertLiveFactoryFork() internal view { + assertEq(block.chainid, 1, "expected Ethereum mainnet fork"); + assertTrue(XLAYER_FACTORY.code.length > 0, "factory missing on fork"); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol new file mode 100644 index 0000000000000..70cddc92a8f59 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol @@ -0,0 +1,115 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Test} from "forge-std/Test.sol"; +import {Vm} from "forge-std/Vm.sol"; +import {Claim} from "src/dispute/lib/Types.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; + +abstract contract TeeTestUtils is Test { + uint256 internal constant DEFAULT_PROPOSER_KEY = 0xA11CE; + uint256 internal constant DEFAULT_CHALLENGER_KEY = 0xB0B; + uint256 internal constant DEFAULT_EXECUTOR_KEY = 0xC0DE; + uint256 internal constant DEFAULT_THIRD_PARTY_PROVER_KEY = 0xD00D; + + struct BatchInput { + bytes32 startBlockHash; + bytes32 startStateHash; + bytes32 endBlockHash; + bytes32 endStateHash; + uint256 l2Block; + } + + function buildExtraData( + uint256 l2SequenceNumber, + uint32 parentIndex, + bytes32 blockHash_, + bytes32 stateHash_ + ) + internal + pure + returns (bytes memory) + { + return abi.encodePacked(l2SequenceNumber, parentIndex, blockHash_, stateHash_); + } + + function computeRootClaim(bytes32 blockHash_, bytes32 stateHash_) internal pure returns (Claim) { + return Claim.wrap(keccak256(abi.encode(blockHash_, stateHash_))); + } + + function computeBatchDigest(BatchInput memory batch) internal pure returns (bytes32) { + return keccak256( + abi.encode( + batch.startBlockHash, + batch.startStateHash, + batch.endBlockHash, + batch.endStateHash, + batch.l2Block + ) + ); + } + + function signDigest(uint256 privateKey, bytes32 digest) internal pure returns (bytes memory) { + (uint8 v, bytes32 r, bytes32 s) = vm.sign(privateKey, digest); + return abi.encodePacked(r, s, v); + } + + function buildBatchProof(BatchInput memory batch, uint256 privateKey) + internal + returns (TeeDisputeGame.BatchProof memory) + { + return TeeDisputeGame.BatchProof({ + startBlockHash: batch.startBlockHash, + startStateHash: batch.startStateHash, + endBlockHash: batch.endBlockHash, + endStateHash: batch.endStateHash, + l2Block: batch.l2Block, + signature: signDigest(privateKey, computeBatchDigest(batch)) + }); + } + + function buildBatchProofWithSignature(BatchInput memory batch, bytes memory signature) + internal + pure + returns (TeeDisputeGame.BatchProof memory) + { + return TeeDisputeGame.BatchProof({ + startBlockHash: batch.startBlockHash, + startStateHash: batch.startStateHash, + endBlockHash: batch.endBlockHash, + endStateHash: batch.endStateHash, + l2Block: batch.l2Block, + signature: signature + }); + } + + function makeWallet(uint256 privateKey, string memory label) internal returns (Vm.Wallet memory wallet) { + wallet = vm.createWallet(privateKey, label); + } + + function uncompressedPublicKey(Vm.Wallet memory wallet) internal pure returns (bytes memory) { + return abi.encodePacked(bytes1(0x04), bytes32(wallet.publicKeyX), bytes32(wallet.publicKeyY)); + } + + function buildJournal( + uint64 timestampMs, + bytes32 pcrHash, + bytes memory rootKey, + bytes memory publicKey, + bytes memory userData + ) + internal + pure + returns (bytes memory) + { + return abi.encodePacked( + bytes8(timestampMs), + pcrHash, + rootKey, + bytes1(uint8(publicKey.length)), + publicKey, + bytes2(uint16(userData.length)), + userData + ); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockAnchorStateRegistry.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockAnchorStateRegistry.sol new file mode 100644 index 0000000000000..c0e7a59c8b055 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockAnchorStateRegistry.sol @@ -0,0 +1,167 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IFaultDisputeGame} from "interfaces/dispute/IFaultDisputeGame.sol"; +import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; +import {ISuperchainConfig} from "interfaces/L1/ISuperchainConfig.sol"; +import {IProxyAdmin} from "interfaces/universal/IProxyAdmin.sol"; +import {GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; + +contract MockAnchorStateRegistry is IAnchorStateRegistry { + struct Flags { + bool registered; + bool respected; + bool blacklisted; + bool retired; + bool finalized; + bool proper; + bool claimValid; + } + + uint8 public initVersion = 1; + ISystemConfig public systemConfig; + IDisputeGameFactory public disputeGameFactory; + IFaultDisputeGame public anchorGame; + Proposal internal anchorRoot; + mapping(IDisputeGame => bool) public disputeGameBlacklist; + mapping(address => Flags) internal flags; + GameType public respectedGameType; + uint64 public retirementTimestamp; + bool public paused; + bool public revertOnSetAnchorState; + IDisputeGame public lastSetAnchorState; + + function initialize( + ISystemConfig _systemConfig, + IDisputeGameFactory _disputeGameFactory, + Proposal memory _startingAnchorRoot, + GameType _startingRespectedGameType + ) + external + { + systemConfig = _systemConfig; + disputeGameFactory = _disputeGameFactory; + anchorRoot = _startingAnchorRoot; + respectedGameType = _startingRespectedGameType; + } + + function anchors(GameType) external view returns (Hash, uint256) { + return (anchorRoot.root, anchorRoot.l2SequenceNumber); + } + + function setAnchor(Hash root_, uint256 l2SequenceNumber_) external { + anchorRoot = Proposal({root: root_, l2SequenceNumber: l2SequenceNumber_}); + } + + function setRespectedGameType(GameType _gameType) external { + respectedGameType = _gameType; + } + + function updateRetirementTimestamp() external { + retirementTimestamp = uint64(block.timestamp); + } + + function blacklistDisputeGame(IDisputeGame game) external { + disputeGameBlacklist[game] = true; + flags[address(game)].blacklisted = true; + } + + function setPaused(bool value) external { + paused = value; + } + + function setRevertOnSetAnchorState(bool value) external { + revertOnSetAnchorState = value; + } + + function setGameFlags( + IDisputeGame game, + bool registered_, + bool respected_, + bool blacklisted_, + bool retired_, + bool finalized_, + bool proper_, + bool claimValid_ + ) + external + { + flags[address(game)] = Flags({ + registered: registered_, + respected: respected_, + blacklisted: blacklisted_, + retired: retired_, + finalized: finalized_, + proper: proper_, + claimValid: claimValid_ + }); + disputeGameBlacklist[game] = blacklisted_; + } + + function isGameBlacklisted(IDisputeGame game) external view returns (bool) { + return flags[address(game)].blacklisted; + } + + function isGameProper(IDisputeGame game) external view returns (bool) { + return flags[address(game)].proper; + } + + function isGameRegistered(IDisputeGame game) external view returns (bool) { + return flags[address(game)].registered; + } + + function isGameResolved(IDisputeGame) external pure returns (bool) { + return false; + } + + function isGameRespected(IDisputeGame game) external view returns (bool) { + return flags[address(game)].respected; + } + + function isGameRetired(IDisputeGame game) external view returns (bool) { + return flags[address(game)].retired; + } + + function isGameFinalized(IDisputeGame game) external view returns (bool) { + return flags[address(game)].finalized; + } + + function isGameClaimValid(IDisputeGame game) external view returns (bool) { + return flags[address(game)].claimValid; + } + + function setAnchorState(IDisputeGame game) external { + if (revertOnSetAnchorState) revert AnchorStateRegistry_InvalidAnchorGame(); + anchorGame = IFaultDisputeGame(address(game)); + lastSetAnchorState = game; + } + + function getAnchorRoot() external view returns (Hash, uint256) { + return (anchorRoot.root, anchorRoot.l2SequenceNumber); + } + + function disputeGameFinalityDelaySeconds() external pure returns (uint256) { + return 0; + } + + function superchainConfig() external view returns (ISuperchainConfig) { + return systemConfig.superchainConfig(); + } + + function version() external pure returns (string memory) { + return "mock"; + } + + function proxyAdmin() external pure returns (IProxyAdmin) { + return IProxyAdmin(address(0)); + } + + function proxyAdminOwner() external pure returns (address) { + return address(0); + } + + function __constructor__(uint256) external { } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol new file mode 100644 index 0000000000000..e81fa3f2200c0 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol @@ -0,0 +1,56 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Clone} from "@solady/utils/Clone.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {Timestamp, GameStatus, GameType, Claim, Hash} from "src/dispute/lib/Types.sol"; + +contract MockCloneableDisputeGame is Clone, IDisputeGame { + bool public initialized; + bool public wasRespectedGameTypeWhenCreated; + Timestamp public createdAt; + Timestamp public resolvedAt; + GameStatus public status; + + function initialize() external payable { + require(!initialized, "MockCloneableDisputeGame: already initialized"); + initialized = true; + createdAt = Timestamp.wrap(uint64(block.timestamp)); + status = GameStatus.IN_PROGRESS; + msg.value; + } + + function resolve() external returns (GameStatus status_) { + status = GameStatus.DEFENDER_WINS; + resolvedAt = Timestamp.wrap(uint64(block.timestamp)); + return status; + } + + function gameType() external pure returns (GameType gameType_) { + return GameType.wrap(0); + } + + function gameCreator() external pure returns (address creator_) { + return address(0); + } + + function rootClaim() external pure returns (Claim rootClaim_) { + return Claim.wrap(bytes32(0)); + } + + function l1Head() external pure returns (Hash l1Head_) { + return Hash.wrap(bytes32(0)); + } + + function l2SequenceNumber() external pure returns (uint256 l2SequenceNumber_) { + return 0; + } + + function extraData() external pure returns (bytes memory extraData_) { + return bytes(""); + } + + function gameData() external pure returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { + return (GameType.wrap(0), Claim.wrap(bytes32(0)), bytes("")); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockDisputeGameFactory.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockDisputeGameFactory.sol new file mode 100644 index 0000000000000..fe78a49f89831 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockDisputeGameFactory.sol @@ -0,0 +1,177 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {LibClone} from "@solady/utils/LibClone.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {GameType, Claim, Timestamp} from "src/dispute/lib/Types.sol"; + +contract MockDisputeGameFactory { + using LibClone for address; + + struct StoredGame { + GameType gameType; + Timestamp timestamp; + IDisputeGame proxy; + Claim rootClaim; + bytes extraData; + } + + struct Lookup { + IDisputeGame proxy; + Timestamp timestamp; + } + + error IncorrectBondAmount(); + error NoImplementation(GameType gameType); + + address public owner; + + mapping(GameType => IDisputeGame) public gameImpls; + mapping(GameType => uint256) public initBonds; + mapping(GameType => bytes) public gameArgs; + + StoredGame[] internal storedGames; + mapping(bytes32 => Lookup) internal storedLookups; + + modifier onlyOwner() { + require(msg.sender == owner, "MockDisputeGameFactory: not owner"); + _; + } + + constructor() { + owner = msg.sender; + } + + function create(GameType _gameType, Claim _rootClaim, bytes calldata _extraData) + external + payable + returns (IDisputeGame proxy_) + { + IDisputeGame impl = gameImpls[_gameType]; + if (address(impl) == address(0)) revert NoImplementation(_gameType); + if (msg.value != initBonds[_gameType]) revert IncorrectBondAmount(); + + bytes32 parentHash = blockhash(block.number - 1); + if (gameArgs[_gameType].length == 0) { + proxy_ = IDisputeGame( + address(impl).clone(abi.encodePacked(msg.sender, _rootClaim, parentHash, _extraData)) + ); + } else { + proxy_ = IDisputeGame( + address(impl).clone( + abi.encodePacked(msg.sender, _rootClaim, parentHash, _gameType, _extraData, gameArgs[_gameType]) + ) + ); + } + + proxy_.initialize{value: msg.value}(); + _storeGame(_gameType, _rootClaim, _extraData, proxy_, uint64(block.timestamp)); + } + + function pushGame( + GameType _gameType, + uint64 _timestamp, + IDisputeGame _proxy, + Claim _rootClaim, + bytes memory _extraData + ) + external + { + _storeGame(_gameType, _rootClaim, _extraData, _proxy, _timestamp); + } + + function setImplementation(GameType _gameType, IDisputeGame _impl) external onlyOwner { + gameImpls[_gameType] = _impl; + } + + function setImplementation(GameType _gameType, IDisputeGame _impl, bytes calldata _args) external onlyOwner { + gameImpls[_gameType] = _impl; + gameArgs[_gameType] = _args; + } + + function setInitBond(GameType _gameType, uint256 _initBond) external onlyOwner { + initBonds[_gameType] = _initBond; + } + + function games(GameType _gameType, Claim _rootClaim, bytes calldata _extraData) + external + view + returns (IDisputeGame proxy_, Timestamp timestamp_) + { + Lookup memory lookup = storedLookups[_uuid(_gameType, _rootClaim, _extraData)]; + return (lookup.proxy, lookup.timestamp); + } + + function findLatestGames(GameType, uint256, uint256) external pure returns (bytes memory) { + revert("MockDisputeGameFactory: not implemented"); + } + + function gameAtIndex(uint256 _index) + external + view + returns (GameType gameType_, Timestamp timestamp_, IDisputeGame proxy_) + { + StoredGame storage game = storedGames[_index]; + return (game.gameType, game.timestamp, game.proxy); + } + + function gameCount() external view returns (uint256) { + return storedGames.length; + } + + function transferOwnership(address newOwner) external onlyOwner { + owner = newOwner; + } + + function initialize(address newOwner) external { + owner = newOwner; + } + + function proxyAdmin() external pure returns (address) { + return address(0); + } + + function proxyAdminOwner() external pure returns (address) { + return address(0); + } + + function initVersion() external pure returns (uint8) { + return 1; + } + + function renounceOwnership() external onlyOwner { + owner = address(0); + } + + function version() external pure returns (string memory) { + return "mock"; + } + + function __constructor__() external { } + + function _storeGame( + GameType _gameType, + Claim _rootClaim, + bytes memory _extraData, + IDisputeGame _proxy, + uint64 _timestamp + ) + internal + { + Timestamp timestamp = Timestamp.wrap(_timestamp); + storedGames.push( + StoredGame({ + gameType: _gameType, + timestamp: timestamp, + proxy: _proxy, + rootClaim: _rootClaim, + extraData: _extraData + }) + ); + storedLookups[_uuid(_gameType, _rootClaim, _extraData)] = Lookup({proxy: _proxy, timestamp: timestamp}); + } + + function _uuid(GameType _gameType, Claim _rootClaim, bytes memory _extraData) internal pure returns (bytes32) { + return keccak256(abi.encode(_gameType, _rootClaim, _extraData)); + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockRiscZeroVerifier.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockRiscZeroVerifier.sol new file mode 100644 index 0000000000000..ab897314e8fd5 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockRiscZeroVerifier.sol @@ -0,0 +1,29 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; + +contract MockRiscZeroVerifier is IRiscZeroVerifier { + bool public shouldRevert; + bytes public lastSeal; + bytes32 public lastImageId; + bytes32 public lastJournalDigest; + + function setShouldRevert(bool value) external { + shouldRevert = value; + } + + function verify(bytes calldata seal, bytes32 imageId, bytes32 journalDigest) external view { + if (shouldRevert) revert("MockRiscZeroVerifier: invalid proof"); + seal; + imageId; + journalDigest; + } + + function verifyAndRecord(bytes calldata seal, bytes32 imageId, bytes32 journalDigest) external { + if (shouldRevert) revert("MockRiscZeroVerifier: invalid proof"); + lastSeal = seal; + lastImageId = imageId; + lastJournalDigest = journalDigest; + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockStatusDisputeGame.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockStatusDisputeGame.sol new file mode 100644 index 0000000000000..3398bdbbebc46 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockStatusDisputeGame.sol @@ -0,0 +1,85 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {Timestamp, GameStatus, GameType, Claim, Hash} from "src/dispute/lib/Types.sol"; + +contract MockStatusDisputeGame { + Timestamp public createdAt; + Timestamp public resolvedAt; + GameStatus public status; + GameType internal _gameType; + Claim internal _rootClaim; + Hash internal _l1Head; + uint256 internal _l2SequenceNumber; + bytes internal _extraData; + address internal _gameCreator; + bool public wasRespectedGameTypeWhenCreated; + IAnchorStateRegistry public anchorStateRegistry; + + constructor( + address creator_, + GameType gameType_, + Claim rootClaim_, + uint256 l2SequenceNumber_, + bytes memory extraData_, + GameStatus status_, + uint64 createdAt_, + uint64 resolvedAt_, + bool respected_, + IAnchorStateRegistry anchorStateRegistry_ + ) { + _gameCreator = creator_; + _gameType = gameType_; + _rootClaim = rootClaim_; + _l2SequenceNumber = l2SequenceNumber_; + _extraData = extraData_; + status = status_; + createdAt = Timestamp.wrap(createdAt_); + resolvedAt = Timestamp.wrap(resolvedAt_); + wasRespectedGameTypeWhenCreated = respected_; + anchorStateRegistry = anchorStateRegistry_; + } + + function initialize() external payable { } + + function resolve() external view returns (GameStatus status_) { + return status; + } + + function setStatus(GameStatus status_) external { + status = status_; + } + + function setResolvedAt(uint64 resolvedAt_) external { + resolvedAt = Timestamp.wrap(resolvedAt_); + } + + function gameData() external view returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { + return (_gameType, _rootClaim, _extraData); + } + + function gameType() external view returns (GameType gameType_) { + return _gameType; + } + + function rootClaim() external view returns (Claim rootClaim_) { + return _rootClaim; + } + + function l1Head() external view returns (Hash l1Head_) { + return _l1Head; + } + + function l2SequenceNumber() external view returns (uint256 l2SequenceNumber_) { + return _l2SequenceNumber; + } + + function extraData() external view returns (bytes memory extraData_) { + return _extraData; + } + + function gameCreator() external view returns (address creator_) { + return _gameCreator; + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockSystemConfig.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockSystemConfig.sol new file mode 100644 index 0000000000000..b318e6c19ef08 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockSystemConfig.sol @@ -0,0 +1,26 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {ISuperchainConfig} from "interfaces/L1/ISuperchainConfig.sol"; + +contract MockSystemConfig { + bool public paused; + address public guardian; + ISuperchainConfig public superchainConfig; + + constructor(address guardian_) { + guardian = guardian_; + } + + function setPaused(bool value) external { + paused = value; + } + + function setGuardian(address value) external { + guardian = value; + } + + function setSuperchainConfig(ISuperchainConfig value) external { + superchainConfig = value; + } +} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol new file mode 100644 index 0000000000000..4324c983dcda4 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; + +contract MockTeeProofVerifier is ITeeProofVerifier { + error EnclaveNotRegistered(); + error InvalidSignature(); + + mapping(address => bool) public registered; + bytes32 public lastDigest; + bytes public lastSignature; + + function setRegistered(address enclave, bool value) external { + registered[enclave] = value; + } + + function verifyBatch(bytes32 digest, bytes calldata signature) + external + view + returns (address signer) + { + (address recovered, ECDSA.RecoverError err) = ECDSA.tryRecover(digest, signature); + if (err != ECDSA.RecoverError.NoError || recovered == address(0)) revert InvalidSignature(); + if (!registered[recovered]) revert EnclaveNotRegistered(); + return recovered; + } + + function verifyBatchAndRecord(bytes32 digest, bytes calldata signature) + external + returns (address signer) + { + lastDigest = digest; + lastSignature = signature; + return this.verifyBatch(digest, signature); + } + + function isRegistered(address enclaveAddress) external view returns (bool) { + return registered[enclaveAddress]; + } +} From c4a4b7cbfde9a7ae5f3fefd7dfbcfe8d566d96a9 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 14:44:55 +0800 Subject: [PATCH 02/24] refactor: consolidate zone management into single setZone function Replace registerZone/updateZone/removeZone with a single setZone(zoneId, factory) that handles all three operations. Pass address(0) to remove a zone. Also remove redundant getFactory view (factories mapping is already public). Co-Authored-By: Claude Opus 4.6 (1M context) --- .../dispute/IDisputeGameFactoryRouter.sol | 11 +-- .../scripts/deploy/DeployTee.s.sol | 2 +- .../src/dispute/DisputeGameFactoryRouter.sol | 33 +------- .../tee/DisputeGameFactoryRouter.t.sol | 81 ++++++------------- .../tee/DisputeGameFactoryRouterCreate.t.sol | 4 +- .../test/dispute/tee/TeeDisputeGame.t.sol | 2 +- .../fork/DisputeGameFactoryRouterFork.t.sol | 4 +- 7 files changed, 36 insertions(+), 101 deletions(-) diff --git a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol index b70163843e32c..a225889361bde 100644 --- a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol +++ b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol @@ -17,26 +17,19 @@ interface IDisputeGameFactoryRouter { // ============ Events ============ - event ZoneRegistered(uint256 indexed zoneId, address indexed factory); - event ZoneUpdated(uint256 indexed zoneId, address indexed oldFactory, address indexed newFactory); - event ZoneRemoved(uint256 indexed zoneId, address indexed factory); + event ZoneSet(uint256 indexed zoneId, address indexed oldFactory, address indexed newFactory); event GameCreated(uint256 indexed zoneId, address indexed proxy); event BatchGamesCreated(uint256 count); // ============ Errors ============ - error ZoneAlreadyRegistered(uint256 zoneId); error ZoneNotRegistered(uint256 zoneId); - error ZeroAddress(); error BatchEmpty(); error BatchBondMismatch(uint256 totalBonds, uint256 msgValue); // ============ Functions ============ - function registerZone(uint256 zoneId, address factory) external; - function updateZone(uint256 zoneId, address factory) external; - function removeZone(uint256 zoneId) external; + function setZone(uint256 zoneId, address factory) external; function create(uint256 zoneId, GameType gameType, Claim rootClaim, bytes calldata extraData) external payable returns (address proxy); function createBatch(CreateParams[] calldata params) external payable returns (address[] memory proxies); - function getFactory(uint256 zoneId) external view returns (address); } diff --git a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol index 33299a451b4ac..a4df915785bd9 100644 --- a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol +++ b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol @@ -131,7 +131,7 @@ contract Deploy is Script { { router = new DisputeGameFactoryRouter(); for (uint256 i = 0; i < zoneIds.length; i++) { - router.registerZone(zoneIds[i], routerFactories[i]); + router.setZone(zoneIds[i], routerFactories[i]); } if (routerOwner != deployer) { router.transferOwnership(routerOwner); diff --git a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol index 280f13501f339..f0e26f6d7b75f 100644 --- a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol +++ b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol @@ -23,29 +23,12 @@ contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { // Zone Management // //////////////////////////////////////////////////////////////// - /// @notice Register a new zone with its factory address. - function registerZone(uint256 zoneId, address factory) external onlyOwner { - if (factory == address(0)) revert ZeroAddress(); - if (factories[zoneId] != address(0)) revert ZoneAlreadyRegistered(zoneId); - factories[zoneId] = factory; - emit ZoneRegistered(zoneId, factory); - } - - /// @notice Update an existing zone's factory address. - function updateZone(uint256 zoneId, address factory) external onlyOwner { - if (factory == address(0)) revert ZeroAddress(); + /// @notice Set, update, or remove a zone's factory address. + /// @dev Pass address(0) as factory to remove the zone. + function setZone(uint256 zoneId, address factory) external onlyOwner { address oldFactory = factories[zoneId]; - if (oldFactory == address(0)) revert ZoneNotRegistered(zoneId); factories[zoneId] = factory; - emit ZoneUpdated(zoneId, oldFactory, factory); - } - - /// @notice Remove a zone. - function removeZone(uint256 zoneId) external onlyOwner { - address factory = factories[zoneId]; - if (factory == address(0)) revert ZoneNotRegistered(zoneId); - delete factories[zoneId]; - emit ZoneRemoved(zoneId, factory); + emit ZoneSet(zoneId, oldFactory, factory); } //////////////////////////////////////////////////////////////// @@ -95,12 +78,4 @@ contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { emit BatchGamesCreated(params.length); } - //////////////////////////////////////////////////////////////// - // View Functions // - //////////////////////////////////////////////////////////////// - - /// @notice Get the factory address for a zone. - function getFactory(uint256 zoneId) external view returns (address) { - return factories[zoneId]; - } } diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol index 3c0a1963d7dd0..5a9c28f65adbe 100644 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol @@ -25,74 +25,41 @@ contract DisputeGameFactoryRouterTest is Test { } //////////////////////////////////////////////////////////////// - // Zone CRUD Tests // + // Zone Management Tests // //////////////////////////////////////////////////////////////// - function test_registerZone() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); - assertEq(router.getFactory(ZONE_XLAYER), XLAYER_FACTORY); - } - - function test_registerZone_revertDuplicate() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); - vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneAlreadyRegistered.selector, ZONE_XLAYER)); - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); - } - - function test_registerZone_revertZeroAddress() public { - vm.expectRevert(IDisputeGameFactoryRouter.ZeroAddress.selector); - router.registerZone(ZONE_XLAYER, address(0)); + function test_setZone_register() public { + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); + assertEq(router.factories(ZONE_XLAYER), XLAYER_FACTORY); } - function test_updateZone() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + function test_setZone_update() public { + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); address newFactory = makeAddr("newFactory"); - router.updateZone(ZONE_XLAYER, newFactory); - assertEq(router.getFactory(ZONE_XLAYER), newFactory); - } - - function test_updateZone_revertNotRegistered() public { - vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); - router.updateZone(ZONE_XLAYER, XLAYER_FACTORY); - } - - function test_removeZone() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); - router.removeZone(ZONE_XLAYER); - assertEq(router.getFactory(ZONE_XLAYER), address(0)); + router.setZone(ZONE_XLAYER, newFactory); + assertEq(router.factories(ZONE_XLAYER), newFactory); } - function test_removeZone_revertNotRegistered() public { - vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); - router.removeZone(ZONE_XLAYER); - } - - //////////////////////////////////////////////////////////////// - // Access Control Tests // - //////////////////////////////////////////////////////////////// - - function test_registerZone_revertNotOwner() public { - vm.prank(alice); - vm.expectRevert("Ownable: caller is not the owner"); - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + function test_setZone_remove() public { + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); + router.setZone(ZONE_XLAYER, address(0)); + assertEq(router.factories(ZONE_XLAYER), address(0)); } - function test_updateZone_revertNotOwner() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); - vm.prank(alice); - vm.expectRevert("Ownable: caller is not the owner"); - router.updateZone(ZONE_XLAYER, makeAddr("newFactory")); + function test_setZone_emitsEvent() public { + vm.expectEmit(true, true, true, true); + emit IDisputeGameFactoryRouter.ZoneSet(ZONE_XLAYER, address(0), XLAYER_FACTORY); + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); } - function test_removeZone_revertNotOwner() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + function test_setZone_revertNotOwner() public { vm.prank(alice); vm.expectRevert("Ownable: caller is not the owner"); - router.removeZone(ZONE_XLAYER); + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); } //////////////////////////////////////////////////////////////// - // Create Tests (Fork) // + // Create Tests // //////////////////////////////////////////////////////////////// function test_create_revertZoneNotRegistered() public { @@ -107,7 +74,7 @@ contract DisputeGameFactoryRouterTest is Test { } function test_createBatch_revertBondMismatch() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](1); params[0] = IDisputeGameFactoryRouter.CreateParams({ @@ -123,15 +90,15 @@ contract DisputeGameFactoryRouterTest is Test { } //////////////////////////////////////////////////////////////// - // View Function Tests // + // View Function Tests // //////////////////////////////////////////////////////////////// - function test_getFactory_unregistered() public view { - assertEq(router.getFactory(999), address(0)); + function test_factories_unregistered() public view { + assertEq(router.factories(999), address(0)); } function test_factories_mapping() public { - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); assertEq(router.factories(ZONE_XLAYER), XLAYER_FACTORY); } diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol index 6d4ae3f5400f9..e006ae19a3062 100644 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol @@ -29,8 +29,8 @@ contract DisputeGameFactoryRouterCreateTest is Test { factoryOne.setInitBond(GAME_TYPE, 1 ether); factoryTwo.setInitBond(GAME_TYPE, 2 ether); - router.registerZone(ZONE_ONE, address(factoryOne)); - router.registerZone(ZONE_TWO, address(factoryTwo)); + router.setZone(ZONE_ONE, address(factoryOne)); + router.setZone(ZONE_TWO, address(factoryTwo)); } function test_create_routesToZoneFactory() public { diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 419581b435576..53bb3eeaec8b1 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -91,7 +91,7 @@ contract TeeDisputeGameTest is TeeTestUtils { function test_initialize_tracksTxOriginProposerThroughRouter() public { DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(); uint256 zoneId = 1; - router.registerZone(zoneId, address(factory)); + router.setZone(zoneId, address(factory)); bytes32 endBlockHash = keccak256("router-end-block"); bytes32 endStateHash = keccak256("router-end-state"); diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index 1ed0fe4285412..3d54501096601 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -71,7 +71,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { hasFork = true; xLayerFactory = DisputeGameFactory(XLAYER_FACTORY); router = new DisputeGameFactoryRouter(); - router.registerZone(ZONE_XLAYER, XLAYER_FACTORY); + router.setZone(ZONE_XLAYER, XLAYER_FACTORY); } function test_liveFactoryReadPaths() public view { @@ -200,7 +200,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { returns (SecondZoneFixture memory secondZone) { secondZone.factory = _deployLocalDisputeGameFactory(); - router.registerZone(ZONE_SECOND, address(secondZone.factory)); + router.setZone(ZONE_SECOND, address(secondZone.factory)); secondZone.anchorStateRegistry = _deployRealAnchorStateRegistry(secondZone.factory); (secondZone.teeProofVerifier, secondZone.registeredExecutor) = _deployRealTeeProofVerifier(); From 1091a58f8ed11c0905278a1270f2999a75266228 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 15:02:30 +0800 Subject: [PATCH 03/24] refactor: separate deployer and owner in DisputeGameFactoryRouter constructor Constructor now takes an explicit _owner parameter instead of defaulting to msg.sender, ensuring the deployer never holds owner privileges. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../scripts/deploy/DeployTee.s.sol | 7 +- .../src/dispute/DisputeGameFactoryRouter.sol | 4 +- .../tee/DisputeGameFactoryRouter.t.sol | 2 +- .../tee/DisputeGameFactoryRouterCreate.t.sol | 2 +- .../test/dispute/tee/TeeDisputeGame.t.sol | 80 ++++++++++++++++--- .../fork/DisputeGameFactoryRouterFork.t.sol | 2 +- 6 files changed, 79 insertions(+), 18 deletions(-) diff --git a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol index a4df915785bd9..673aeeaac13c6 100644 --- a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol +++ b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol @@ -122,20 +122,17 @@ contract Deploy is Script { function _deployRouter( address routerOwner, - address deployer, + address, uint256[] memory zoneIds, address[] memory routerFactories ) internal returns (DisputeGameFactoryRouter router) { - router = new DisputeGameFactoryRouter(); + router = new DisputeGameFactoryRouter(routerOwner); for (uint256 i = 0; i < zoneIds.length; i++) { router.setZone(zoneIds[i], routerFactories[i]); } - if (routerOwner != deployer) { - router.transferOwnership(routerOwner); - } } function _envAddressArray(string memory name) internal view returns (address[] memory values) { diff --git a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol index f0e26f6d7b75f..6cfbd82176d5f 100644 --- a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol +++ b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol @@ -17,7 +17,9 @@ contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { /// @notice Mapping of zoneId to DisputeGameFactory address. mapping(uint256 => address) public factories; - constructor() {} + constructor(address _owner) { + _transferOwnership(_owner); + } //////////////////////////////////////////////////////////////// // Zone Management // diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol index 5a9c28f65adbe..68231890cab15 100644 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol @@ -21,7 +21,7 @@ contract DisputeGameFactoryRouterTest is Test { function setUp() public { owner = address(this); alice = makeAddr("alice"); - router = new DisputeGameFactoryRouter(); + router = new DisputeGameFactoryRouter(owner); } //////////////////////////////////////////////////////////////// diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol index e006ae19a3062..2877bc3695247 100644 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol @@ -19,7 +19,7 @@ contract DisputeGameFactoryRouterCreateTest is Test { MockCloneableDisputeGame internal gameImpl; function setUp() public { - router = new DisputeGameFactoryRouter(); + router = new DisputeGameFactoryRouter(address(this)); factoryOne = new MockDisputeGameFactory(); factoryTwo = new MockDisputeGameFactory(); gameImpl = new MockCloneableDisputeGame(); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 53bb3eeaec8b1..627d68367575a 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -89,7 +89,7 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_initialize_tracksTxOriginProposerThroughRouter() public { - DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(); + DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(address(this)); uint256 zoneId = 1; router.setZone(zoneId, address(factory)); @@ -494,10 +494,17 @@ contract TeeDisputeGameTest is TeeTestUtils { (TeeDisputeGame child,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); + // Wait for child's challenge window to expire so gameOver() passes + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + + // Child still cannot resolve because parent is IN_PROGRESS vm.expectRevert(ParentGameNotResolved.selector); child.resolve(); } + /// @notice When parent resolves as CHALLENGER_WINS, child short-circuits to CHALLENGER_WINS. + /// @dev Realistic timing: child is created while parent is IN_PROGRESS (required by initialize), + /// then parent later resolves as CHALLENGER_WINS, then child resolve short-circuits. function test_resolve_parentChallengerWinsShortCircuits() public { MockStatusDisputeGame parent = new MockStatusDisputeGame( proposer, @@ -520,15 +527,20 @@ contract TeeDisputeGameTest is TeeTestUtils { ); anchorStateRegistry.setGameFlags(IDisputeGame(address(parent)), true, true, false, false, false, true, false); + // Child created while parent is still IN_PROGRESS (TeeDisputeGame child,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 7, 0, keccak256("child-block"), keccak256("child-state")); - parent.setStatus(GameStatus.CHALLENGER_WINS); - parent.setResolvedAt(uint64(block.timestamp)); - + // Challenger challenges the child vm.prank(challenger); child.challenge{value: CHALLENGER_BOND}(); + // Time passes: parent is challenged and times out → CHALLENGER_WINS + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + parent.setStatus(GameStatus.CHALLENGER_WINS); + parent.setResolvedAt(uint64(block.timestamp)); + + // Child resolve short-circuits because parent lost GameStatus status = child.resolve(); assertEq(uint8(status), uint8(GameStatus.CHALLENGER_WINS)); assertEq(child.normalModeCredit(challenger), DEFENDER_BOND + CHALLENGER_BOND); @@ -563,6 +575,7 @@ contract TeeDisputeGameTest is TeeTestUtils { assertEq(game.normalModeCredit(thirdPartyProver), CHALLENGER_BOND); assertEq(game.normalModeCredit(proposer), DEFENDER_BOND); + // Simulate finality: game is proper and finalized (DEFENDER_WINS, not blacklisted) anchorStateRegistry.setGameFlags(game, true, true, false, false, true, true, true); uint256 proposerBalanceBefore = proposer.balance; @@ -570,11 +583,43 @@ contract TeeDisputeGameTest is TeeTestUtils { game.claimCredit(proposer); game.claimCredit(thirdPartyProver); + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); assertEq(thirdPartyProver.balance, proverBalanceBefore + CHALLENGER_BOND); } - function test_claimCredit_refundModeRefundsDeposits() public { + /// @notice CHALLENGER_WINS in NORMAL mode: challenger takes all bonds, proposer gets nothing. + /// @dev A CHALLENGER_WINS game is still "proper" in real ASR (registered, not blacklisted, + /// not retired, not paused), so closeGame → NORMAL mode → normalModeCredit only. + function test_claimCredit_challengerWinsNormalMode() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Timeout without proof → CHALLENGER_WINS + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + assertEq(uint8(game.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + + // CHALLENGER_WINS game is still proper → NORMAL mode + // (registered, respected, not blacklisted, not retired, finalized) + anchorStateRegistry.setGameFlags(game, true, true, false, false, true, true, false); + + // Challenger takes all bonds + uint256 challengerBalanceBefore = challenger.balance; + game.claimCredit(challenger); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(challenger.balance, challengerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + // Proposer has zero credit — lost their bond + assertEq(game.normalModeCredit(proposer), 0); + } + + /// @notice REFUND mode: only triggered by guardian blacklisting (not by CHALLENGER_WINS). + /// @dev In real ASR, isGameProper returns false only when the game is blacklisted, retired, + /// or the system is paused. Here we simulate a blacklisted DEFENDER_WINS game. + function test_claimCredit_refundModeWhenBlacklisted() public { bytes32 endBlockHash = keccak256("end-block"); bytes32 endStateHash = keccak256("end-state"); (TeeDisputeGame game,,) = @@ -583,19 +628,36 @@ contract TeeDisputeGameTest is TeeTestUtils { vm.prank(challenger); game.challenge{value: CHALLENGER_BOND}(); - vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); - assertEq(uint8(game.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + // Proposer proves — game would normally be DEFENDER_WINS + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); - anchorStateRegistry.setGameFlags(game, true, true, false, false, true, false, false); + // Guardian blacklists the game (e.g. discovered exploit) + // → isGameProper returns false → REFUND mode + anchorStateRegistry.setGameFlags(game, true, true, true, false, true, false, false); uint256 proposerBalanceBefore = proposer.balance; uint256 challengerBalanceBefore = challenger.balance; game.claimCredit(proposer); game.claimCredit(challenger); + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.REFUND)); assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); assertEq(challenger.balance, challengerBalanceBefore + CHALLENGER_BOND); - assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.REFUND)); } function test_closeGame_revertWhenNotFinalized() public { diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index 3d54501096601..6d9c2b3c40af1 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -70,7 +70,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { vm.createSelectFork(vm.envString("ETH_RPC_URL")); hasFork = true; xLayerFactory = DisputeGameFactory(XLAYER_FACTORY); - router = new DisputeGameFactoryRouter(); + router = new DisputeGameFactoryRouter(address(this)); router.setZone(ZONE_XLAYER, XLAYER_FACTORY); } From b6ce9b384d520023fc70f8cf905a773adff67047 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 15:06:49 +0800 Subject: [PATCH 04/24] test: add TEE dispute game integration tests with real contracts 9 integration tests covering the full TradeZone TEE dispute game lifecycle using real DisputeGameFactory, AnchorStateRegistry, TeeProofVerifier, and AccessManager (only MockRiscZeroVerifier and MockSystemConfig remain mocked). Covers: unchallenged DEFENDER_WINS, challenged + proposer/third-party prove, CHALLENGER_WINS (challenger takes all), guardian blacklist REFUND mode, parent-child game chains, short-circuit on parent failure, and Router pass-through. Runnable in CI without ETH_RPC_URL. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../test/dispute/tee/INTEGRATION_TEST_PLAN.md | 94 +-- .../tee/TeeDisputeGameIntegration.t.sol | 592 ++++++++++++++++++ 2 files changed, 648 insertions(+), 38 deletions(-) create mode 100644 packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol diff --git a/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md b/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md index ce29e39f61d6c..b7852192d6aab 100644 --- a/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md +++ b/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md @@ -1,4 +1,8 @@ -# TEE TEE Dispute Game — Integration Test Plan +# TEE Dispute Game — Integration Test Plan + +## Status: IMPLEMENTED + +**File**: `TeeDisputeGameIntegration.t.sol` — 9 tests, all passing. ## Background @@ -16,10 +20,6 @@ The integration layer only covers **one happy path** (unchallenged → prove → Critical paths involving **fund distribution (REFUND vs NORMAL)**, **parent-child game chains**, and **third-party prover bond splitting** have never been verified with real ASR + real Factory together. -## Goal - -Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite that verifies the TEE TEE dispute game full lifecycle with real contracts, runnable in CI without any RPC dependency. - ## Contract Setup ### Real contracts (deployed via Proxy where applicable) @@ -27,10 +27,10 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t | Contract | Deploy Method | Notes | |----------|--------------|-------| | `DisputeGameFactory` | Proxy + `initialize(owner)` | Replaces `MockDisputeGameFactory` | -| `AnchorStateRegistry` | Proxy + `initialize(...)` | Already real in current integration test | +| `AnchorStateRegistry` | Proxy + `initialize(...)` | DISPUTE_GAME_FINALITY_DELAY_SECONDS = 0 | | `TeeProofVerifier` | `new TeeProofVerifier(verifier, imageId, rootKey)` | With real enclave registration flow | | `TeeDisputeGame` | Implementation set in factory, cloned on `create()` | Real game logic | -| `AccessManager` | `new AccessManager(timeout, factory)` | Already real | +| `AccessManager` | `new AccessManager(timeout, factory)` | Manages proposer/challenger permissions | | `DisputeGameFactoryRouter` | `new DisputeGameFactoryRouter()` | For Router-based creation tests | ### Mocks (minimal, non-critical) @@ -38,7 +38,7 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t | Mock | Reason | |------|--------| | `MockRiscZeroVerifier` | ZK proof verification is out of scope; only need it to not revert during `register()` | -| `MockSystemConfig` | Provides `paused()` and `guardian`; no real SystemConfig needed for these tests | +| `MockSystemConfig` | Provides `paused()` and `guardian`; test contract acts as guardian for blacklist tests | ## Test Cases @@ -49,8 +49,8 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t **Verifies**: - Simplest happy path with real Factory + real ASR - `resolve()` returns `DEFENDER_WINS` when unchallenged and time expires -- `closeGame()` → `ASR.isGameFinalized()` passes → `bondDistributionMode = NORMAL` -- `setAnchorState` succeeds, `anchorGame` updates +- `closeGame()` reverts with `GameNotFinalized` before finality delay passes +- After finality: `bondDistributionMode = NORMAL`, `setAnchorState` succeeds - Proposer receives back `DEFENDER_BOND` --- @@ -62,7 +62,7 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t **Verifies**: - Challenge + prove flow with real TeeProofVerifier (registered enclave) - `resolve()` returns `DEFENDER_WINS` -- `closeGame()` → `bondDistributionMode = NORMAL` +- `bondDistributionMode = NORMAL` - Proposer receives `DEFENDER_BOND + CHALLENGER_BOND` (wins challenger's bond) - `setAnchorState` succeeds @@ -80,44 +80,70 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t --- -### Test 4: `test_lifecycle_challenged_timeout_challengerWins_refund` +### Test 4: `test_lifecycle_challenged_timeout_challengerWins` **Path**: create → challenge → (no prove) → wait MAX_PROVE_DURATION → resolve → closeGame → claimCredit **Verifies**: -- **REFUND mode** — the most critical untested path with real contracts - `resolve()` returns `CHALLENGER_WINS` -- `closeGame()` → `ASR.isGameProper()` returns false for CHALLENGER_WINS → `bondDistributionMode = REFUND` -- `setAnchorState` is attempted but silently fails (try-catch in `closeGame`) -- `anchorGame` does NOT update -- Proposer gets back `DEFENDER_BOND`, challenger gets back `CHALLENGER_BOND` (each refunded their own deposit) +- `bondDistributionMode = NORMAL` (game is still "proper" per real ASR — not blacklisted/retired/paused) +- Challenger receives `DEFENDER_BOND + CHALLENGER_BOND` (takes all) +- Proposer has zero credit — loses bond +- `setAnchorState` silently fails (requires DEFENDER_WINS), anchor does NOT update + +**Key finding during implementation**: Real ASR considers a CHALLENGER_WINS game "proper" (registered, not blacklisted, not retired, not paused). The unit test used MockASR with manually set flags to force REFUND, which masked this behavior. REFUND mode only occurs via guardian intervention (blacklist) or system pause. + +--- + +### Test 4b: `test_lifecycle_blacklisted_refund` + +**Path**: create → challenge → prove → resolve (DEFENDER_WINS) → guardian blacklists → closeGame → REFUND + +**Verifies**: +- Guardian blacklist triggers REFUND mode even for a DEFENDER_WINS game +- `isGameProper()` returns false after blacklisting +- Each party gets their deposit back: proposer gets `DEFENDER_BOND`, challenger gets `CHALLENGER_BOND` +- `setAnchorState` silently fails (blacklisted), anchor does NOT update --- ### Test 5: `test_lifecycle_parentChildChain_defenderWins` -**Path**: create parent → resolve parent (DEFENDER_WINS) → create child (parentIndex=0) → resolve child +**Path**: create parent → resolve parent (DEFENDER_WINS) → create child (parentIndex=0) → prove child → resolve child **Verifies**: - Child game's `startingOutputRoot` comes from parent's rootClaim (not anchor state) -- Child cannot resolve before parent resolves (revert `ParentGameNotResolved`) -- After parent resolves, child lifecycle works normally +- After parent resolves and becomes anchor, child lifecycle works normally - Real Factory's `gameAtIndex()` is used to look up parent — validates the full lookup chain +- Child becomes the new anchor (higher l2SequenceNumber) --- ### Test 6: `test_lifecycle_parentChallengerWins_childShortCircuits` -**Path**: create parent → challenge parent → parent timeout → resolve parent (CHALLENGER_WINS) → create child → challenge child → resolve child +**Path**: create parent → create child (while parent IN_PROGRESS) → challenge child → challenge parent → parent timeout → resolve parent (CHALLENGER_WINS) → resolve child **Verifies**: -- When parent is `CHALLENGER_WINS`, child's resolve short-circuits to `CHALLENGER_WINS` +- Child's resolve short-circuits to `CHALLENGER_WINS` when parent lost - Bond distribution for short-circuited child: challenger gets `DEFENDER_BOND + CHALLENGER_BOND` - Tests the cascading failure propagation through game chains +**Key finding during implementation**: `initialize()` checks `proxy.status() == GameStatus.CHALLENGER_WINS` and reverts with `InvalidParentGame`. The child MUST be created while parent is still `IN_PROGRESS`. The short-circuit only happens at `resolve()` time, not at creation time. + +--- + +### Test 7: `test_lifecycle_childCannotResolveBeforeParent` + +**Path**: create parent → create child → (fast forward) → child.resolve() reverts → parent.resolve() → child.resolve() succeeds + +**Verifies**: +- `ParentGameNotResolved` revert when parent is still `IN_PROGRESS` +- After parent resolves, child can resolve normally +- Ordering dependency between parent and child resolution + --- -### Test 7: `test_lifecycle_viaRouter_fullCycle` +### Test 8: `test_lifecycle_viaRouter_fullCycle` **Path**: Router.create → challenge → prove → resolve → closeGame → claimCredit @@ -126,28 +152,20 @@ Create `TeeDisputeGameIntegration.t.sol` — a non-fork integration test suite t - `proposer()` is `tx.origin` (transparent pass-through) - Full lifecycle works identically when created via Router vs direct Factory call - Bond accounting attributes correctly to tx.origin proposer, not Router +- `refundModeCredit(router)` is zero — Router doesn't capture any bonds + +## Key Findings from Implementation -## Shared Test Infrastructure +1. **REFUND mode requires guardian intervention**: A CHALLENGER_WINS game is still "proper" per real ASR. The unit test's MockASR with `setGameFlags` to force REFUND was misleading — in production, REFUND only triggers via blacklist or system pause. -Reuse `TeeTestUtils` as base contract. Add a shared `setUp()` helper that deploys the full real-contract stack: +2. **Child creation timing constraint**: `initialize()` rejects a parent with `CHALLENGER_WINS` status. Children must be created while parent is `IN_PROGRESS`. The cascading failure only manifests at `resolve()` time. -```solidity -function _deployFullStack() internal { - // 1. Deploy real DisputeGameFactory via Proxy - // 2. Deploy real AnchorStateRegistry via Proxy - // 3. Deploy real TeeProofVerifier (with MockRiscZeroVerifier) - // - Register enclave via real register() flow - // 4. Deploy real AccessManager - // 5. Deploy real TeeDisputeGame implementation - // 6. Register implementation + init bond in factory - // 7. (Optional) Deploy DisputeGameFactoryRouter + register zone -} -``` +3. **Finality delay is load-bearing**: `closeGame()` requires `isGameFinalized()` which checks `resolvedAt + DISPUTE_GAME_FINALITY_DELAY_SECONDS < block.timestamp`. Even with delay=0, `vm.warp(block.timestamp + 1)` is needed after resolve. ## Relationship to Existing Tests | File | Action | |------|--------| -| `AnchorStateRegistryCompatibility.t.sol` | Can be removed or kept as-is; the new integration tests fully subsume it | +| `AnchorStateRegistryCompatibility.t.sol` | Subsumed by the new integration tests; can be removed | | `DisputeGameFactoryRouterFork.t.sol` | Keep — it uniquely tests XLayer cross-zone interop on mainnet fork | | Unit test files | Keep — they test error paths and edge cases exhaustively with fast mock-based isolation | diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol new file mode 100644 index 0000000000000..8ff8378803477 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -0,0 +1,592 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import {Vm} from "forge-std/Vm.sol"; +import {Proxy} from "src/universal/Proxy.sol"; +import {AnchorStateRegistry} from "src/dispute/AnchorStateRegistry.sol"; +import {DisputeGameFactory} from "src/dispute/DisputeGameFactory.sol"; +import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; +import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; +import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; +import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; +import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; +import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; +import { + BondDistributionMode, + Claim, + Duration, + GameStatus, + GameType, + Hash, + Proposal +} from "src/dispute/lib/Types.sol"; +import {GameNotFinalized} from "src/dispute/lib/Errors.sol"; +import {ParentGameNotResolved} from "src/dispute/tee/lib/Errors.sol"; +import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; + +/// @title TeeDisputeGameIntegrationTest +/// @notice Integration tests for the full TEE dispute game lifecycle using real contracts. +/// Only MockRiscZeroVerifier and MockSystemConfig are mocked; all core contracts +/// (DisputeGameFactory, AnchorStateRegistry, TeeProofVerifier, AccessManager) are real. +contract TeeDisputeGameIntegrationTest is TeeTestUtils { + uint256 internal constant DEFENDER_BOND = 1 ether; + uint256 internal constant CHALLENGER_BOND = 2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; + uint64 internal constant MAX_PROVE_DURATION = 12 hours; + bytes32 internal constant IMAGE_ID = keccak256("integration-tee-image"); + bytes32 internal constant PCR_HASH = keccak256("integration-pcr-hash"); + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("anchor-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("anchor-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 10; + + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + DisputeGameFactory internal factory; + AnchorStateRegistry internal anchorStateRegistry; + TeeProofVerifier internal teeProofVerifier; + AccessManager internal accessManager; + TeeDisputeGame internal implementation; + + address internal proposer; + address internal challenger; + address internal executor; + address internal thirdPartyProver; + + function setUp() public { + proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; + challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; + executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; + thirdPartyProver = makeWallet(DEFAULT_THIRD_PARTY_PROVER_KEY, "third-party-prover").addr; + + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + // --- Deploy real DisputeGameFactory via Proxy --- + factory = _deployFactory(); + + // --- Deploy real AnchorStateRegistry via Proxy --- + anchorStateRegistry = _deployAnchorStateRegistry(factory); + + // --- Deploy real TeeProofVerifier (with MockRiscZeroVerifier) --- + teeProofVerifier = _deployTeeProofVerifier(); + + // --- Deploy real AccessManager --- + accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); + accessManager.setProposer(proposer, true); + accessManager.setChallenger(challenger, true); + + // --- Deploy TeeDisputeGame implementation --- + implementation = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(teeProofVerifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(anchorStateRegistry)), + accessManager + ); + + factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(implementation)), bytes("")); + factory.setInitBond(TEE_GAME_TYPE, DEFENDER_BOND); + + // Warp past the retirement timestamp so games are not retired. + vm.warp(block.timestamp + 1); + } + + //////////////////////////////////////////////////////////////// + // Test 1: Unchallenged DEFENDER_WINS // + //////////////////////////////////////////////////////////////// + + /// @notice create → (no challenge) → timeout → resolve → closeGame → claimCredit + function test_lifecycle_unchallenged_defenderWins() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + // Wait for challenge window to expire + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + + // Resolve — unchallenged, so DEFENDER_WINS + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + + // closeGame not yet callable — need finality delay + vm.expectRevert(GameNotFinalized.selector); + game.closeGame(); + + // Wait for finality delay (DISPUTE_GAME_FINALITY_DELAY_SECONDS = 0 in our ASR) + vm.warp(block.timestamp + 1); + assertTrue(anchorStateRegistry.isGameFinalized(game)); + + // claimCredit triggers closeGame → setAnchorState → NORMAL mode + uint256 proposerBalanceBefore = proposer.balance; + game.claimCredit(proposer); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + assertEq(address(anchorStateRegistry.anchorGame()), address(game)); + } + + //////////////////////////////////////////////////////////////// + // Test 2: Challenged + Proposer Proves → DEFENDER_WINS // + //////////////////////////////////////////////////////////////// + + /// @notice create → challenge → proposer proves → resolve → claimCredit + function test_lifecycle_challenged_proveByProposer_defenderWins() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + // Challenger challenges + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Proposer proves with real TeeProofVerifier + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // Resolve — challenged + proved by proposer → DEFENDER_WINS, proposer gets all + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + assertEq(game.normalModeCredit(proposer), DEFENDER_BOND + CHALLENGER_BOND); + + // Wait for finality + vm.warp(block.timestamp + 1); + + uint256 proposerBalanceBefore = proposer.balance; + game.claimCredit(proposer); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + assertEq(address(anchorStateRegistry.anchorGame()), address(game)); + } + + //////////////////////////////////////////////////////////////// + // Test 3: Challenged + Third-Party Proves → Bond Split // + //////////////////////////////////////////////////////////////// + + /// @notice create → challenge → third-party proves → resolve → claimCredit (proposer + prover) + function test_lifecycle_challenged_proveByThirdParty_bondSplit() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + // Challenger challenges + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Third-party prover proves + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.prank(thirdPartyProver); + game.prove(abi.encode(proofs)); + + // Resolve — third-party proved → DEFENDER_WINS with split + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + assertEq(game.normalModeCredit(proposer), DEFENDER_BOND); + assertEq(game.normalModeCredit(thirdPartyProver), CHALLENGER_BOND); + + // Wait for finality + vm.warp(block.timestamp + 1); + + // Both claim credit + uint256 proposerBalanceBefore = proposer.balance; + uint256 proverBalanceBefore = thirdPartyProver.balance; + game.claimCredit(proposer); + game.claimCredit(thirdPartyProver); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + assertEq(thirdPartyProver.balance, proverBalanceBefore + CHALLENGER_BOND); + assertEq(address(anchorStateRegistry.anchorGame()), address(game)); + } + + //////////////////////////////////////////////////////////////// + // Test 4: Challenged + Timeout → CHALLENGER_WINS → NORMAL // + //////////////////////////////////////////////////////////////// + + /// @notice create → challenge → (no prove) → timeout → resolve → NORMAL → challenger takes all + /// @dev A CHALLENGER_WINS game is still "proper" per ASR (registered, not blacklisted, + /// not retired, not paused), so closeGame → NORMAL mode. The challenger wins all bonds. + function test_lifecycle_challenged_timeout_challengerWins() public { + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + // Challenger challenges + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Nobody proves — wait for prove deadline + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + + // Resolve — challenged + no proof → CHALLENGER_WINS + assertEq(uint8(game.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + assertEq(game.normalModeCredit(challenger), DEFENDER_BOND + CHALLENGER_BOND); + + // Wait for finality + vm.warp(block.timestamp + 1); + assertTrue(anchorStateRegistry.isGameFinalized(game)); + + // Anchor should NOT update (setAnchorState requires DEFENDER_WINS) + address anchorBefore = address(anchorStateRegistry.anchorGame()); + + // Challenger claims all bonds + uint256 challengerBalanceBefore = challenger.balance; + game.claimCredit(challenger); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(challenger.balance, challengerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + + // Proposer has no credit — lost their bond + assertEq(game.normalModeCredit(proposer), 0); + + // Anchor state did NOT change + assertEq(address(anchorStateRegistry.anchorGame()), anchorBefore); + } + + //////////////////////////////////////////////////////////////// + // Test 4b: Blacklisted Game → REFUND // + //////////////////////////////////////////////////////////////// + + /// @notice Guardian blacklists a game → closeGame → REFUND → each gets deposit back + function test_lifecycle_blacklisted_refund() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + // Challenger challenges + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Proposer proves + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // Resolve — DEFENDER_WINS + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + + // Guardian blacklists the game before finalization + // (address(this) is the guardian via MockSystemConfig) + anchorStateRegistry.blacklistDisputeGame(game); + + // Wait for finality + vm.warp(block.timestamp + 1); + assertTrue(anchorStateRegistry.isGameFinalized(game)); + assertFalse(anchorStateRegistry.isGameProper(game)); + + // claimCredit → closeGame → isGameProper = false → REFUND mode + uint256 proposerBalanceBefore = proposer.balance; + uint256 challengerBalanceBefore = challenger.balance; + game.claimCredit(proposer); + game.claimCredit(challenger); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.REFUND)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + assertEq(challenger.balance, challengerBalanceBefore + CHALLENGER_BOND); + } + + //////////////////////////////////////////////////////////////// + // Test 5: Parent-Child Chain → DEFENDER_WINS // + //////////////////////////////////////////////////////////////// + + /// @notice create parent → resolve parent → create child (parentIndex=0) → resolve child + function test_lifecycle_parentChildChain_defenderWins() public { + bytes32 parentEndBlockHash = keccak256("parent-end-block"); + bytes32 parentEndStateHash = keccak256("parent-end-state"); + + // Create parent game (root game, parentIndex = max) + (TeeDisputeGame parent,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash + ); + + // Wait for challenge window and resolve parent + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + parent.resolve(); + + // Wait for parent finality so it can become anchor + vm.warp(block.timestamp + 1); + parent.claimCredit(proposer); + + // Create child game referencing parent (parentIndex = 0) + bytes32 childEndBlockHash = keccak256("child-end-block"); + bytes32 childEndStateHash = keccak256("child-end-state"); + (TeeDisputeGame child,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash + ); + + // Verify child's startingOutputRoot comes from parent + (Hash childStartRoot, uint256 childStartBlock) = child.startingOutputRoot(); + assertEq(childStartRoot.raw(), computeRootClaim(parentEndBlockHash, parentEndStateHash).raw()); + assertEq(childStartBlock, ANCHOR_L2_BLOCK + 5); + + // Prove and resolve child + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: parentEndBlockHash, + startStateHash: parentEndStateHash, + endBlockHash: childEndBlockHash, + endStateHash: childEndStateHash, + l2Block: child.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.prank(proposer); + child.prove(abi.encode(proofs)); + + assertEq(uint8(child.resolve()), uint8(GameStatus.DEFENDER_WINS)); + + // Wait for finality and claim + vm.warp(block.timestamp + 1); + child.claimCredit(proposer); + + assertEq(uint8(child.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + // Child should be the new anchor (higher l2SequenceNumber) + assertEq(address(anchorStateRegistry.anchorGame()), address(child)); + } + + //////////////////////////////////////////////////////////////// + // Test 6: Parent CHALLENGER_WINS → Child Short-Circuits // + //////////////////////////////////////////////////////////////// + + /// @notice parent CHALLENGER_WINS → child resolve short-circuits to CHALLENGER_WINS + /// @dev Child must be created while parent is still IN_PROGRESS (initialize rejects + /// a CHALLENGER_WINS parent). The short-circuit happens at resolve() time. + function test_lifecycle_parentChallengerWins_childShortCircuits() public { + bytes32 parentEndBlockHash = keccak256("parent-end-block"); + bytes32 parentEndStateHash = keccak256("parent-end-state"); + + // Create parent (still IN_PROGRESS) + (TeeDisputeGame parent,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash + ); + + // Create child BEFORE parent resolves (parentIndex = 0) + bytes32 childEndBlockHash = keccak256("child-end-block"); + bytes32 childEndStateHash = keccak256("child-end-state"); + (TeeDisputeGame child,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash + ); + + // Challenge child so there's a challenger to receive bonds + vm.prank(challenger); + child.challenge{value: CHALLENGER_BOND}(); + + // Now challenge parent and let it timeout → CHALLENGER_WINS + vm.prank(challenger); + parent.challenge{value: CHALLENGER_BOND}(); + + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + parent.resolve(); + assertEq(uint8(parent.status()), uint8(GameStatus.CHALLENGER_WINS)); + + // Child resolve short-circuits to CHALLENGER_WINS because parent lost + assertEq(uint8(child.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + + // Challenger gets all child bonds + assertEq(child.normalModeCredit(challenger), DEFENDER_BOND + CHALLENGER_BOND); + + // Wait for finality and claim + vm.warp(block.timestamp + 1); + uint256 challengerBalanceBefore = challenger.balance; + child.claimCredit(challenger); + + assertEq(uint8(child.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(challenger.balance, challengerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + } + + //////////////////////////////////////////////////////////////// + // Test 7: Child Cannot Resolve Before Parent // + //////////////////////////////////////////////////////////////// + + /// @notice child.resolve() reverts with ParentGameNotResolved when parent is IN_PROGRESS + function test_lifecycle_childCannotResolveBeforeParent() public { + // Create parent (unchallenged, still in progress) + (TeeDisputeGame parent,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("parent-end-block"), keccak256("parent-end-state") + ); + + // Create child referencing parent + (TeeDisputeGame child,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 10, 0, keccak256("child-end-block"), keccak256("child-end-state") + ); + + // Fast forward past child's challenge window + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + + // Child cannot resolve because parent is still IN_PROGRESS + vm.expectRevert(ParentGameNotResolved.selector); + child.resolve(); + + // Now resolve parent first + parent.resolve(); + + // Now child can resolve + assertEq(uint8(child.resolve()), uint8(GameStatus.DEFENDER_WINS)); + } + + //////////////////////////////////////////////////////////////// + // Test 8: Full Cycle via Router // + //////////////////////////////////////////////////////////////// + + /// @notice Router.create → challenge → prove → resolve → claimCredit + function test_lifecycle_viaRouter_fullCycle() public { + DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(address(this)); + uint256 zoneId = 1; + router.setZone(zoneId, address(factory)); + + bytes32 endBlockHash = keccak256("router-end-block"); + bytes32 endStateHash = keccak256("router-end-state"); + bytes memory extraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + Claim rootClaim = computeRootClaim(endBlockHash, endStateHash); + + // Create via router + vm.startPrank(proposer, proposer); + address proxy = router.create{value: DEFENDER_BOND}(zoneId, TEE_GAME_TYPE, rootClaim, extraData); + vm.stopPrank(); + + TeeDisputeGame game = TeeDisputeGame(payable(proxy)); + + // Verify creator/proposer attribution + assertEq(game.gameCreator(), address(router)); + assertEq(game.proposer(), proposer); + + // Challenge + vm.prank(challenger); + game.challenge{value: CHALLENGER_BOND}(); + + // Prove + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY + ); + + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // Resolve + assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); + + // Wait for finality + vm.warp(block.timestamp + 1); + + // claimCredit — proposer proved, gets all + uint256 proposerBalanceBefore = proposer.balance; + game.claimCredit(proposer); + + assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); + // Bond attributed to proposer (tx.origin), not to router + assertEq(game.refundModeCredit(address(router)), 0); + } + + //////////////////////////////////////////////////////////////// + // Infrastructure Helpers // + //////////////////////////////////////////////////////////////// + + function _deployFactory() internal returns (DisputeGameFactory) { + DisputeGameFactory impl = new DisputeGameFactory(); + Proxy proxy = new Proxy(address(this)); + proxy.upgradeToAndCall(address(impl), abi.encodeCall(impl.initialize, (address(this)))); + return DisputeGameFactory(address(proxy)); + } + + function _deployAnchorStateRegistry(DisputeGameFactory _factory) internal returns (AnchorStateRegistry) { + MockSystemConfig systemConfig = new MockSystemConfig(address(this)); + AnchorStateRegistry impl = new AnchorStateRegistry(0); + Proxy proxy = new Proxy(address(this)); + proxy.upgradeToAndCall( + address(impl), + abi.encodeCall( + impl.initialize, + ( + ISystemConfig(address(systemConfig)), + IDisputeGameFactory(address(_factory)), + Proposal({ + root: Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + TEE_GAME_TYPE + ) + ) + ); + return AnchorStateRegistry(address(proxy)); + } + + function _deployTeeProofVerifier() internal returns (TeeProofVerifier) { + MockRiscZeroVerifier riscZeroVerifier = new MockRiscZeroVerifier(); + bytes memory expectedRootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + TeeProofVerifier verifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); + + // Register the executor enclave via real register() flow + Vm.Wallet memory enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "integration-enclave"); + bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + verifier.register("", journal); + + return verifier; + } + + function _createGame( + address creator, + uint256 l2SequenceNumber, + uint32 parentIndex, + bytes32 blockHash_, + bytes32 stateHash_ + ) + internal + returns (TeeDisputeGame game, bytes memory extraData, Claim rootClaim) + { + extraData = buildExtraData(l2SequenceNumber, parentIndex, blockHash_, stateHash_); + rootClaim = computeRootClaim(blockHash_, stateHash_); + + vm.startPrank(creator, creator); + game = TeeDisputeGame( + payable( + address(factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, rootClaim, extraData)) + ) + ); + vm.stopPrank(); + } +} From 74944e7bcd8a11277fdd97b926e4c7ad954106ae Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 15:08:01 +0800 Subject: [PATCH 05/24] test: add TEE dispute game integration tests with real contracts 9 integration tests covering the full TradeZone TEE dispute game lifecycle using real DisputeGameFactory, AnchorStateRegistry, TeeProofVerifier, and AccessManager (only MockRiscZeroVerifier and MockSystemConfig remain mocked). Covers: unchallenged DEFENDER_WINS, challenged + proposer/third-party prove, CHALLENGER_WINS (challenger takes all), guardian blacklist REFUND mode, parent-child game chains, short-circuit on parent failure, and Router pass-through. Runnable in CI without ETH_RPC_URL. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../test/dispute/tee/INTEGRATION_TEST_PLAN.md | 171 ------------------ 1 file changed, 171 deletions(-) delete mode 100644 packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md diff --git a/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md b/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md deleted file mode 100644 index b7852192d6aab..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/INTEGRATION_TEST_PLAN.md +++ /dev/null @@ -1,171 +0,0 @@ -# TEE Dispute Game — Integration Test Plan - -## Status: IMPLEMENTED - -**File**: `TeeDisputeGameIntegration.t.sol` — 9 tests, all passing. - -## Background - -Current test coverage has three layers: - -| Layer | Files | Characteristics | -|-------|-------|-----------------| -| Unit tests | 5 files, ~50 tests | All dependencies mocked, isolated per contract | -| Integration test | `AnchorStateRegistryCompatibility.t.sol` (1 test) | Real ASR + Proxy, but Factory and TeeProofVerifier are mocked | -| Fork E2E | `DisputeGameFactoryRouterFork.t.sol` (3 tests) | Mainnet fork, requires `ETH_RPC_URL`, skipped otherwise | - -### Problem - -The integration layer only covers **one happy path** (unchallenged → prove → DEFENDER_WINS → setAnchorState). The fork tests cover a challenged DEFENDER_WINS path but are **conditional on `ETH_RPC_URL`** — if CI doesn't configure it, these paths have zero real-contract coverage. - -Critical paths involving **fund distribution (REFUND vs NORMAL)**, **parent-child game chains**, and **third-party prover bond splitting** have never been verified with real ASR + real Factory together. - -## Contract Setup - -### Real contracts (deployed via Proxy where applicable) - -| Contract | Deploy Method | Notes | -|----------|--------------|-------| -| `DisputeGameFactory` | Proxy + `initialize(owner)` | Replaces `MockDisputeGameFactory` | -| `AnchorStateRegistry` | Proxy + `initialize(...)` | DISPUTE_GAME_FINALITY_DELAY_SECONDS = 0 | -| `TeeProofVerifier` | `new TeeProofVerifier(verifier, imageId, rootKey)` | With real enclave registration flow | -| `TeeDisputeGame` | Implementation set in factory, cloned on `create()` | Real game logic | -| `AccessManager` | `new AccessManager(timeout, factory)` | Manages proposer/challenger permissions | -| `DisputeGameFactoryRouter` | `new DisputeGameFactoryRouter()` | For Router-based creation tests | - -### Mocks (minimal, non-critical) - -| Mock | Reason | -|------|--------| -| `MockRiscZeroVerifier` | ZK proof verification is out of scope; only need it to not revert during `register()` | -| `MockSystemConfig` | Provides `paused()` and `guardian`; test contract acts as guardian for blacklist tests | - -## Test Cases - -### Test 1: `test_lifecycle_unchallenged_defenderWins` - -**Path**: create → (no challenge) → wait MAX_CHALLENGE_DURATION → resolve → closeGame → claimCredit - -**Verifies**: -- Simplest happy path with real Factory + real ASR -- `resolve()` returns `DEFENDER_WINS` when unchallenged and time expires -- `closeGame()` reverts with `GameNotFinalized` before finality delay passes -- After finality: `bondDistributionMode = NORMAL`, `setAnchorState` succeeds -- Proposer receives back `DEFENDER_BOND` - ---- - -### Test 2: `test_lifecycle_challenged_proveByProposer_defenderWins` - -**Path**: create → challenge → proposer proves → resolve → closeGame → claimCredit - -**Verifies**: -- Challenge + prove flow with real TeeProofVerifier (registered enclave) -- `resolve()` returns `DEFENDER_WINS` -- `bondDistributionMode = NORMAL` -- Proposer receives `DEFENDER_BOND + CHALLENGER_BOND` (wins challenger's bond) -- `setAnchorState` succeeds - ---- - -### Test 3: `test_lifecycle_challenged_proveByThirdParty_bondSplit` - -**Path**: create → challenge → third-party proves → resolve → closeGame → claimCredit (proposer) + claimCredit (prover) - -**Verifies**: -- Third-party prover bond splitting with real ASR determining `bondDistributionMode` -- `bondDistributionMode = NORMAL` -- Proposer receives `DEFENDER_BOND`, prover receives `CHALLENGER_BOND` -- Both `claimCredit` calls succeed with correct amounts - ---- - -### Test 4: `test_lifecycle_challenged_timeout_challengerWins` - -**Path**: create → challenge → (no prove) → wait MAX_PROVE_DURATION → resolve → closeGame → claimCredit - -**Verifies**: -- `resolve()` returns `CHALLENGER_WINS` -- `bondDistributionMode = NORMAL` (game is still "proper" per real ASR — not blacklisted/retired/paused) -- Challenger receives `DEFENDER_BOND + CHALLENGER_BOND` (takes all) -- Proposer has zero credit — loses bond -- `setAnchorState` silently fails (requires DEFENDER_WINS), anchor does NOT update - -**Key finding during implementation**: Real ASR considers a CHALLENGER_WINS game "proper" (registered, not blacklisted, not retired, not paused). The unit test used MockASR with manually set flags to force REFUND, which masked this behavior. REFUND mode only occurs via guardian intervention (blacklist) or system pause. - ---- - -### Test 4b: `test_lifecycle_blacklisted_refund` - -**Path**: create → challenge → prove → resolve (DEFENDER_WINS) → guardian blacklists → closeGame → REFUND - -**Verifies**: -- Guardian blacklist triggers REFUND mode even for a DEFENDER_WINS game -- `isGameProper()` returns false after blacklisting -- Each party gets their deposit back: proposer gets `DEFENDER_BOND`, challenger gets `CHALLENGER_BOND` -- `setAnchorState` silently fails (blacklisted), anchor does NOT update - ---- - -### Test 5: `test_lifecycle_parentChildChain_defenderWins` - -**Path**: create parent → resolve parent (DEFENDER_WINS) → create child (parentIndex=0) → prove child → resolve child - -**Verifies**: -- Child game's `startingOutputRoot` comes from parent's rootClaim (not anchor state) -- After parent resolves and becomes anchor, child lifecycle works normally -- Real Factory's `gameAtIndex()` is used to look up parent — validates the full lookup chain -- Child becomes the new anchor (higher l2SequenceNumber) - ---- - -### Test 6: `test_lifecycle_parentChallengerWins_childShortCircuits` - -**Path**: create parent → create child (while parent IN_PROGRESS) → challenge child → challenge parent → parent timeout → resolve parent (CHALLENGER_WINS) → resolve child - -**Verifies**: -- Child's resolve short-circuits to `CHALLENGER_WINS` when parent lost -- Bond distribution for short-circuited child: challenger gets `DEFENDER_BOND + CHALLENGER_BOND` -- Tests the cascading failure propagation through game chains - -**Key finding during implementation**: `initialize()` checks `proxy.status() == GameStatus.CHALLENGER_WINS` and reverts with `InvalidParentGame`. The child MUST be created while parent is still `IN_PROGRESS`. The short-circuit only happens at `resolve()` time, not at creation time. - ---- - -### Test 7: `test_lifecycle_childCannotResolveBeforeParent` - -**Path**: create parent → create child → (fast forward) → child.resolve() reverts → parent.resolve() → child.resolve() succeeds - -**Verifies**: -- `ParentGameNotResolved` revert when parent is still `IN_PROGRESS` -- After parent resolves, child can resolve normally -- Ordering dependency between parent and child resolution - ---- - -### Test 8: `test_lifecycle_viaRouter_fullCycle` - -**Path**: Router.create → challenge → prove → resolve → closeGame → claimCredit - -**Verifies**: -- `gameCreator()` is the Router address -- `proposer()` is `tx.origin` (transparent pass-through) -- Full lifecycle works identically when created via Router vs direct Factory call -- Bond accounting attributes correctly to tx.origin proposer, not Router -- `refundModeCredit(router)` is zero — Router doesn't capture any bonds - -## Key Findings from Implementation - -1. **REFUND mode requires guardian intervention**: A CHALLENGER_WINS game is still "proper" per real ASR. The unit test's MockASR with `setGameFlags` to force REFUND was misleading — in production, REFUND only triggers via blacklist or system pause. - -2. **Child creation timing constraint**: `initialize()` rejects a parent with `CHALLENGER_WINS` status. Children must be created while parent is `IN_PROGRESS`. The cascading failure only manifests at `resolve()` time. - -3. **Finality delay is load-bearing**: `closeGame()` requires `isGameFinalized()` which checks `resolvedAt + DISPUTE_GAME_FINALITY_DELAY_SECONDS < block.timestamp`. Even with delay=0, `vm.warp(block.timestamp + 1)` is needed after resolve. - -## Relationship to Existing Tests - -| File | Action | -|------|--------| -| `AnchorStateRegistryCompatibility.t.sol` | Subsumed by the new integration tests; can be removed | -| `DisputeGameFactoryRouterFork.t.sol` | Keep — it uniquely tests XLayer cross-zone interop on mainnet fork | -| Unit test files | Keep — they test error paths and edge cases exhaustively with fast mock-based isolation | From 36830877ded536e420bddf1769f0cf8aab8fc0a8 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 19 Mar 2026 16:03:02 +0800 Subject: [PATCH 06/24] refactor: remove BatchGamesCreated event from IDisputeGameFactoryRouter and DisputeGameFactoryRouter Eliminated the BatchGamesCreated event as it was deemed unnecessary for the current implementation. This simplifies the event emissions related to game creation. --- .../interfaces/dispute/IDisputeGameFactoryRouter.sol | 2 -- .../contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol | 2 -- 2 files changed, 4 deletions(-) diff --git a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol index a225889361bde..ce5be8d20e179 100644 --- a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol +++ b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol @@ -19,8 +19,6 @@ interface IDisputeGameFactoryRouter { event ZoneSet(uint256 indexed zoneId, address indexed oldFactory, address indexed newFactory); event GameCreated(uint256 indexed zoneId, address indexed proxy); - event BatchGamesCreated(uint256 count); - // ============ Errors ============ error ZoneNotRegistered(uint256 zoneId); diff --git a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol index 6cfbd82176d5f..d9e0664e9e561 100644 --- a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol +++ b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol @@ -76,8 +76,6 @@ contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { proxies[i] = address(game); emit GameCreated(params[i].zoneId, proxies[i]); } - - emit BatchGamesCreated(params.length); } } From bcce3cbeba9b96076b641243607e978103dd370a Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 11:55:33 +0800 Subject: [PATCH 07/24] fix: cross-chain isolation, audit fixes, and spec docs for TeeDisputeGame - Add GameType check in initialize() to prevent cross-chain parent references in a shared DisputeGameFactory (XL vs TZ isolation) - Fix C-02: resolve() parent-loses path now credits proposer instead of address(0) when child game was never challenged - Fix H-03: add IN_PROGRESS status guard to prove() to prevent post-resolution state mutation - Document C-03: add NatSpec to prove() explaining TEE trust model and why early proving before challenges is by design - Add cross-chain isolation integration tests - Add C-02 regression test - Add audit findings report and TEE dispute game spec to book/ Co-Authored-By: Claude Opus 4.6 (1M context) --- .../book/src/dispute/tee/AUDIT_FINDINGS.md | 679 ++++++++++++++++++ .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 565 +++++++++++++++ .../src/dispute/tee/TeeDisputeGame.sol | 19 +- .../src/dispute/tee/lib/Errors.sol | 3 + .../tee/TeeDisputeGameIntegration.t.sol | 174 ++++- 5 files changed, 1436 insertions(+), 4 deletions(-) create mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md create mode 100644 packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md new file mode 100644 index 0000000000000..07d8948df56ed --- /dev/null +++ b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md @@ -0,0 +1,679 @@ +# TeeDisputeGame -- Security Audit Report + +**Auditor:** Senior Solidity Security Auditor +**Date:** 2026-03-20 +**Scope:** `TeeDisputeGame.sol`, `AccessManager.sol`, `TeeProofVerifier.sol`, `ITeeProofVerifier.sol`, `lib/Errors.sol` +**Branch:** `contract/tee-dispute-game` + +--- + +## 1. Executive Summary + +The TeeDisputeGame system implements an OP Stack dispute game that replaces ZK proofs with TEE (AWS Nitro Enclave) ECDSA signatures for batch state transition verification. It uses a Solady Clone (CWIA) proxy pattern, integrates with `DisputeGameFactory` and `AnchorStateRegistry`, and supports chained multi-batch proofs within `prove()`. + +**Overall Risk Assessment: HIGH** + +The contract has a well-structured state machine and correctly chains batch proofs with continuity checks. The Clone argument layout and calldatasize check (0xBE) are verified correct. However, several critical and high-severity issues were identified: + +- **4 Critical findings:** Proof overwrite via repeated `prove()`, bond loss via `address(0)` crediting, challenge window bypass enabling unchallenged claims, and cross-game signature replay. +- **4 High findings:** Raw digest signing, unbounded batch arrays, post-resolution prove(), and `tx.origin` phishing. +- **6 Medium findings:** DoS on `AccessManager`, silent error swallowing, unused state, timestamp overflow, cascade resolution, and misleading `credit()` view. +- **Several Low/Informational findings** covering ownership safety, gas optimizations, and code organization. + +--- + +## 2. Critical Findings + +### C-01: `prove()` Can Be Called Multiple Times -- Proof Overwrite Enables Bond Theft + +**Severity:** Critical +**File:** `src/dispute/tee/TeeDisputeGame.sol:261-333` + +**Description:** +The `prove()` function has no guard preventing repeated calls. There is no check on `claimData.status` to reject already-proven states, and no check on `claimData.prover` to reject overwrite. An attacker can call `prove()` after a legitimate prover has already submitted a valid proof, replacing `claimData.prover` with their own address. + +In the `ChallengedAndValidProofProvided` resolution path (lines 356-363), the prover receives `CHALLENGER_BOND`. By overwriting the prover address, an attacker steals the bond. + +Since proof data is submitted in calldata, it is publicly visible in the mempool, making extraction and replay trivial. + +**Proof of Concept:** +1. Proposer creates game with bond. +2. Challenger challenges with `CHALLENGER_BOND`. +3. Legitimate prover calls `prove()` with valid batch proofs. Status becomes `ChallengedAndValidProofProvided`. +4. Attacker observes the calldata, calls `prove()` again with identical proof bytes. `claimData.prover` is overwritten to attacker. +5. On `resolve()`, attacker (recorded as prover) receives `CHALLENGER_BOND`. + +**Root Cause:** No status guard in `prove()`. The function transitions from `Challenged` -> `ChallengedAndValidProofProvided` on first call, but on the second call, it sees `ChallengedAndValidProofProvided`, finds `counteredBy != address(0)`, and sets status to `ChallengedAndValidProofProvided` again -- succeeding silently while overwriting `prover`. + +**Recommendation:** +Add a status check at the beginning of `prove()`: +```solidity +if (claimData.status == ProposalStatus.UnchallengedAndValidProofProvided + || claimData.status == ProposalStatus.ChallengedAndValidProofProvided) { + revert ProofAlreadyProvided(); +} +``` + +> **Response: Not a bug.** The PoC at step 4 is incorrect — the second `prove()` call will revert. After the first successful `prove()`, `claimData.prover != address(0)`, which causes `gameOver()` (line 428) to return `true`. The second `prove()` hits `if (gameOver()) revert GameOver()` at line 262 and reverts. Double-prove is already prevented by the existing `gameOver()` guard. + +--- + +### C-02: `resolve()` Credits `address(0)` When Parent Loses and Child Is Unchallenged -- Permanent Fund Loss + +**Severity:** Critical +**File:** `src/dispute/tee/TeeDisputeGame.sol:341-343` + +**Description:** +When `_getParentGameStatus()` returns `CHALLENGER_WINS`, the child game sets: +```solidity +normalModeCredit[claimData.counteredBy] = address(this).balance; +``` +If the child game was never challenged, `claimData.counteredBy == address(0)`. The entire contract balance (the proposer's bond) is credited to `address(0)`. If someone calls `claimCredit(address(0))`, ETH is sent to the zero address and burned. If nobody claims, the funds are locked forever. + +**Impact:** The proposer permanently loses their bond through no fault of their own -- parent game invalidation cascades and burns the child proposer's bond. + +**Recommendation:** +When `counteredBy == address(0)` in the parent-loses path, refund the proposer: +```solidity +if (parentGameStatus == GameStatus.CHALLENGER_WINS) { + status = GameStatus.CHALLENGER_WINS; + address recipient = claimData.counteredBy != address(0) ? claimData.counteredBy : proposer; + normalModeCredit[recipient] = address(this).balance; +} +``` + +> **Response: Fixed.** Applied the recommended fix at line 341-347. When `counteredBy == address(0)`, the proposer's bond is now credited back to `proposer` (guaranteed non-zero via `tx.origin`). Regression test added: `test_lifecycle_parentChallengerWins_childUnchallenged_proposerRefunded`. + +--- + +### C-03: Challenge Window Can Be Completely Bypassed -- Proposer Can Prevent All Challenges + +**Severity:** Critical +**File:** `src/dispute/tee/TeeDisputeGame.sol:236-249, 261-333, 427-429` + +**Description:** +Three interacting design flaws combine to allow a proposer to completely bypass the challenge window: + +1. **`prove()` has no status restriction:** It can be called when status is `Unchallenged`, transitioning directly to `UnchallengedAndValidProofProvided`. +2. **`gameOver()` short-circuits on proof:** Returns `true` as soon as `claimData.prover != address(0)` (line 428), regardless of deadline. +3. **`challenge()` checks `gameOver()`:** Reverts if game is over (line 239). + +A colluding proposer + TEE enclave can submit `prove()` in the same block as game creation. After this, `gameOver()` returns true permanently, and `challenge()` always reverts. The game resolves as `DEFENDER_WINS` without any challenge opportunity. + +Additionally, `challenge()` only accepts `Unchallenged` status (line 237). Even if `gameOver()` were fixed, once `prove()` transitions status to `UnchallengedAndValidProofProvided`, no challenge is possible. + +**Proof of Concept:** +1. Proposer creates game via factory (block N) with a fraudulent root claim. +2. In the same block, co-conspirator calls `prove()` with a pre-computed TEE proof from a compromised enclave. +3. `claimData.prover != address(0)`, so `gameOver()` is now true. +4. Any `challenge()` call reverts with `GameOver()`. +5. After parent resolves, `resolve()` gives `DEFENDER_WINS` -- proposer takes all funds, no one could contest. + +**Impact:** The fundamental security assumption -- that challengers have a window to contest invalid claims -- is completely broken. A compromised TEE enclave + proposer can push through any claim. + +**Recommendation:** +Decouple proof submission from the challenge window: +- Option A: `prove()` should only be callable in `Challenged` state (after a challenge occurs). +- Option B: `gameOver()` should not consider `prover != address(0)` -- only the deadline should matter. +- Option C: Keep the challenge deadline independent and always enforce it: challenges should be allowed regardless of proof status. + +> **Response: Not a bug (by design), but documented per auditor recommendation.** The analysis is technically correct but the threat model assumption is wrong for this contract. In TeeDisputeGame, `challenge()` does not submit fraud proof data — it is simply a mechanism to request the TEE to prove, with a bond at stake. The TEE is trusted hardware. If the TEE produces a valid proof, the state transition IS correct — there is no "fraudulent root claim" scenario with a valid TEE signature. Early `prove()` before any challenge is a legitimate optimization that accelerates finality. The challenge window exists as an economic incentive for the TEE to prove on demand, not as a fraud-proof security layer. +> +> **Fix applied:** Added NatSpec documentation to `prove()` explicitly documenting the TEE trust model and that early proving is by design. + +--- + +### C-04: Missing Domain Separation in Batch Digest -- Cross-Game Signature Replay + +**Severity:** Critical +**File:** `src/dispute/tee/TeeDisputeGame.sol:295-303` + +**Description:** +The `batchDigest` is computed as: +```solidity +keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block)) +``` +This digest contains no game-specific or chain-specific identifier. A valid TEE signature for one game is valid for any other game covering the same L2 block range with the same state hashes. + +**Scenario:** Two TeeDisputeGames both cover blocks 100-200 with the same starting output root. A TEE executor signs proofs for game A. Those signatures are replayed on game B without the TEE ever verifying game B's state. This also applies cross-chain if two chains share identical L2 state ranges. + +While the final root claim check prevents proving an incorrect claim, this breaks the fundamental security assumption that each game's proof is independently verified by a TEE enclave. + +**Impact:** Proofs can be replayed across games sharing the same block range. The TEE verification guarantee is bypassed for replayed games. + +**Recommendation:** +Include `address(this)` and `block.chainid` in the digest: +```solidity +bytes32 batchDigest = keccak256(abi.encode( + block.chainid, address(this), + proofs[i].startBlockHash, proofs[i].startStateHash, + proofs[i].endBlockHash, proofs[i].endStateHash, + proofs[i].l2Block +)); +``` +The TEE enclave must also include these fields when signing. + +> **Response: Not a bug.** For replay to work, both games must have identical `startingOutputRoot`, `rootClaim`, and `l2SequenceNumber` — because `prove()` validates `proofs[0].start == startingOutputRoot`, `proofs[last].end == rootClaim`, and `proofs[last].l2Block == l2SequenceNumber`. In a deterministic L2, same start state + same block range = same end state. So replaying a proof across such games proves the same correct state transition. The proof is not "forged" — it's proving an identical truth. Additionally, `prove()` binds the entire proof chain to the game's specific start and end states, providing implicit domain separation. + +--- + +## 3. High Findings + +### H-01: `TeeProofVerifier.verifyBatch()` Uses Raw Digest Without EIP-191/EIP-712 + +**Severity:** High +**File:** `src/dispute/tee/TeeProofVerifier.sol:148` + +**Description:** +`verifyBatch()` calls `ECDSA.tryRecover(digest, signature)` with a raw `bytes32` hash. The digest has no EIP-191 (`\x19Ethereum Signed Message:\n32`) or EIP-712 prefix. + +This means: +1. The signature scheme is non-standard and cannot leverage standard wallet signing flows. +2. If the TEE enclave's private key is ever used in any other context that also does raw `ecrecover`, signatures could be cross-purpose replayed. +3. A raw `keccak256` digest could coincidentally match a valid Ethereum transaction hash, though this is astronomically unlikely. + +**Impact:** Signatures lack cryptographic domain separation, increasing cross-context replay risk. + +**Recommendation:** +Use EIP-712 structured data with a domain separator including the verifier address and chain ID: +```solidity +bytes32 prefixed = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, digest)); +``` + +> **Response: Acknowledged, won't fix.** TEE enclave private keys are generated inside the enclave and are purpose-specific — they are never used as standard Ethereum wallets or in any other signing context. The cross-context replay risk does not apply. Adding EIP-712 would require changes to both the on-chain contract and the TEE enclave signing logic with no practical security benefit. + +--- + +### H-02: Unbounded Batch Array in `prove()` -- Gas Griefing / DoS + +**Severity:** High +**File:** `src/dispute/tee/TeeDisputeGame.sol:264, 278` + +**Description:** +`prove()` decodes `proofBytes` into `BatchProof[]` with no upper bound. Each iteration performs: +- Two `keccak256` operations +- One external call to `TEE_PROOF_VERIFIER.verifyBatch()` (which includes `ecrecover`) +- Multiple storage reads and comparisons + +If the L2 block range is very large and split into many small batches, the gas cost could exceed block gas limits, preventing legitimate proofs from being submitted. + +**Impact:** Could prevent legitimate proofs from being submitted if the required batch count is too high, or could be used to submit transactions that fail unpredictably. + +**Recommendation:** +Add a maximum batch count: +```solidity +uint256 constant MAX_BATCH_COUNT = 256; +if (proofs.length > MAX_BATCH_COUNT) revert TooManyBatches(); +``` + +> **Response: Acknowledged, won't fix.** TEE proof submission is permissioned — only trusted operators submit proofs. They will not submit oversized arrays. Even in a permissionless context, the attacker pays their own gas for a failed transaction that does not affect anyone else. The practical batch count is 1-5 segments; gas limit is not a realistic concern. + +--- + +### H-03: `prove()` Missing `IN_PROGRESS` Status Guard -- Post-Resolution Mutation + +**Severity:** High +**File:** `src/dispute/tee/TeeDisputeGame.sol:261-333` + +**Description:** +`prove()` checks `gameOver()` but does not check `status == GameStatus.IN_PROGRESS`. In the parent-loses resolution path (lines 338-343), `resolve()` can be called before the deadline expires (it does not require `gameOver()`). If `prover` is still `address(0)` at that point, `gameOver()` returns false (deadline not passed), and `prove()` could be called on an already-resolved game, mutating `claimData.prover` and `claimData.status`. + +**Impact:** State mutation after resolution. While bond distribution was already assigned during `resolve()`, changing `claimData.prover` and `claimData.status` corrupts on-chain game state for any external readers. + +**Recommendation:** +Add `if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved();` at the start of `prove()`. + +> **Response: Fixed.** Added `if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved();` at the top of `prove()` (line 262). This prevents state mutation after resolution in all paths, including the parent-loses cascade where `resolve()` can be called before the deadline expires. + +--- + +### H-04: `tx.origin` Enables Proposer Phishing + +**Severity:** High +**File:** `src/dispute/tee/TeeDisputeGame.sol:174, 225` + +**Description:** +`initialize()` uses `tx.origin` for both authorization and identity: +```solidity +if (!ACCESS_MANAGER.isAllowedProposer(tx.origin)) revert BadAuth(); +... +proposer = tx.origin; +``` +A whitelisted proposer interacting with any malicious contract could have `factory.create()` called in the same transaction, creating a game with attacker-controlled parameters (root claim, extraData) under the proposer's identity. + +**Impact:** A whitelisted proposer can be tricked into creating games with invalid root claims. Their bond is at risk when the claim is challenged. + +**Recommendation:** +This is a known OP Stack pattern. Document the risk prominently. Proposers should be advised to never interact with untrusted contracts from their whitelisted EOA. Long-term, consider passing the proposer address explicitly from the factory. + +> **Response: Acknowledged, won't fix.** This is a known OP Stack pattern used across all permissioned dispute games (including `PermissionedDisputeGame`). `tx.origin` is necessary to attribute the proposer through intermediate contracts like `DisputeGameFactoryRouter`. Proposers are trusted operators that should use dedicated EOAs. + +--- + +## 4. Medium Findings + +### M-01: `AccessManager.getLastProposalTimestamp()` Unbounded Loop -- DoS Risk + +**Severity:** Medium +**File:** `src/dispute/tee/AccessManager.sol:86-106` + +**Description:** +`getLastProposalTimestamp()` iterates backward through all games in the factory. If many non-TEE games are created after the last TEE game, this loop's gas cost can exceed the block gas limit. + +This function is called during `isAllowedProposer()`, which is called during `initialize()`. A DoS here prevents new TEE game creation. + +**Attack vector:** Anyone can create cheap non-TEE games to inflate `gameCount()`, making `isAllowedProposer()` exceed gas limits. Eventually, `FALLBACK_TIMEOUT` expires, but `isProposalPermissionlessMode()` itself calls `getLastProposalTimestamp()`, so even permissionless mode may be DoS'd. + +**Impact:** Temporary DoS on TEE game creation, followed by permanent bypass of proposer access control (or permanent DoS if the loop always exceeds gas limits). + +**Recommendation:** +Cache the latest TEE game timestamp in a storage variable updated during game creation, or set a maximum scan depth with a fallback. + +> **Response: Acknowledged, known issue.** Will optimize in a future iteration by caching the latest TEE game timestamp in a storage variable. + +--- + +### M-02: Silent Error Swallowing in `closeGame()` Try-Catch + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:410` + +**Description:** +```solidity +try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} catch {} +``` +All errors from `setAnchorState()` are silently swallowed. If the call fails for a legitimate reason (e.g., the registry is paused or upgraded), the anchor state is not updated, potentially causing subsequent games to reference stale starting output roots. + +**Impact:** Anchor state may not be updated when it should be. No way for off-chain monitoring to detect failures. + +**Recommendation:** +Emit an event in the catch block: +```solidity +try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} +catch (bytes memory reason) { + emit AnchorStateUpdateFailed(reason); +} +``` + +> **Response: Acknowledged, won't fix.** This pattern is consistent with existing OP Stack dispute games. `setAnchorState()` failing is non-critical — the anchor state will be updated by the next successful game. Off-chain monitoring can detect this via the absence of anchor state changes. + +--- + +### M-03: `wasRespectedGameTypeWhenCreated` Is Set But Never Read + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:141, 228-229` + +**Description:** +This boolean is written during `initialize()` (costing ~20,000 gas for cold SSTORE) but never read by any function in this contract or apparent external caller. + +**Impact:** Wasted gas on every game initialization. If intended for external use by `AnchorStateRegistry`, it lacks documentation. + +**Recommendation:** +Remove if unused, or document its intended external consumer. + +> **Response: Acknowledged, won't fix.** This field is intended for external consumers (e.g., `AnchorStateRegistry.isGameRespected()`) and aligns with the OP Stack convention used in other dispute game implementations. + +--- + +### M-04: Timestamp Overflow Edge Case in Deadline Computation + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:221, 244` + +**Description:** +```solidity +Timestamp.wrap(uint64(block.timestamp + MAX_CHALLENGE_DURATION.raw())) +``` +If `MAX_CHALLENGE_DURATION` is misconfigured to a very large value, the `uint256` addition could exceed `type(uint64).max`, and the `uint64` cast silently truncates, potentially setting a deadline in the past. This would make the game instantly "over." + +**Impact:** Misconfigured durations could make games instantly expire. Low probability since durations are set at construction, but no protection exists. + +**Recommendation:** +Add a constructor validation: +```solidity +require(block.timestamp + _maxChallengeDuration.raw() <= type(uint64).max, "duration overflow"); +require(block.timestamp + _maxProveDuration.raw() <= type(uint64).max, "duration overflow"); +``` + +> **Response: Acknowledged, won't fix.** Constructor parameters are set by the deployer (trusted). Misconfiguration is an operational issue, not a contract vulnerability. The same pattern is used in other OP Stack contracts without overflow checks. + +--- + +### M-05: Cascade Resolution Bypasses Child Game's Challenge/Prove Period + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:338-343` + +**Description:** +When `parentGameStatus == CHALLENGER_WINS`, `resolve()` does not check `gameOver()`. A child game can be resolved as `CHALLENGER_WINS` immediately, even if its own challenge/prove period has not ended and a valid proof was about to be submitted. + +**Impact:** A child game's proposer loses their bond due to parent invalidation, even if their own claim was independently valid and provable. + +**Recommendation:** +This may be intentional (cascading invalidation should be immediate). Document the behavior. Consider using REFUND mode for parent-invalidated games so no party is unfairly penalized (see also C-02 fix). + +> **Response: By design.** Parent invalidation means the child's `startingOutputRoot` was derived from an invalid parent — the entire proof chain is based on incorrect state. Immediate cascade is the correct behavior. The C-02 fix ensures that when a child was never challenged, the proposer gets their bond refunded rather than losing it to `address(0)`. + +--- + +### M-06: `credit()` View Function Returns Misleading Data When `UNDECIDED` + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:431-437` + +**Description:** +```solidity +function credit(address _recipient) external view returns (uint256 credit_) { + if (bondDistributionMode == BondDistributionMode.REFUND) { + credit_ = refundModeCredit[_recipient]; + } else { + credit_ = normalModeCredit[_recipient]; + } +} +``` +When `bondDistributionMode == UNDECIDED`, the else branch returns `normalModeCredit`, which is 0 for all addresses before resolution. This could mislead off-chain consumers into believing there are no credits when in fact `refundModeCredit` holds deposited amounts. + +**Impact:** Front-end/off-chain confusion. Users may not see their refundable bonds when the game is still undecided. + +**Recommendation:** +Return 0 or revert when `bondDistributionMode == UNDECIDED`, or return both credit amounts. + +> **Response: Acknowledged, won't fix.** Low impact — only affects off-chain display before game resolution. `claimCredit()` correctly handles mode selection and reverts with `InvalidBondDistributionMode` if mode is still `UNDECIDED`. + +--- + +## 5. Low/Informational Findings + +### L-01: `TeeProofVerifier` Ownership Transfer Lacks Two-Step Pattern + +**Severity:** Low +**File:** `src/dispute/tee/TeeProofVerifier.sol:184-188` + +`transferOwnership()` immediately transfers ownership. If the wrong address is supplied, ownership is irrecoverably lost. The owner controls enclave registration and revocation. + +**Recommendation:** Use a two-step transfer pattern (propose + accept) or OpenZeppelin's `Ownable2Step`. + +> **Response: Acknowledged, won't fix.** Acceptable for admin operations with trusted deployers. + +--- + +### L-02: `TeeProofVerifier.transferOwnership()` Missing Zero-Address Check + +**Severity:** Low +**File:** `src/dispute/tee/TeeProofVerifier.sol:184` + +Transferring to `address(0)` permanently disables `register()` and `revoke()`. + +**Recommendation:** Add `require(newOwner != address(0))`. + +> **Response: Acknowledged, won't fix.** Operational risk managed by trusted admin. + +--- + +### L-03: `expectedRootKey` Is Not Enforced Immutable + +**Severity:** Low +**File:** `src/dispute/tee/TeeProofVerifier.sol:32` + +`expectedRootKey` is `bytes public` (Solidity does not support `immutable` for `bytes`). Only set in the constructor with no setter, but a future code change could accidentally add one, or the slot could be manipulated if this contract were behind a `delegatecall` proxy. + +**Recommendation:** Store `keccak256(expectedRootKey)` as an `immutable bytes32` and validate against it during registration. + +> **Response: Acknowledged, won't fix.** No setter exists and the contract is not used behind a delegatecall proxy. Safe by construction. + +--- + +### L-04: Custom Errors Defined Inline Instead of in Errors Library + +**Severity:** Informational +**File:** `src/dispute/tee/TeeDisputeGame.sol:101-107` + +Seven custom errors (`EmptyBatchProofs`, `StartHashMismatch`, `BatchChainBreak`, `BatchBlockNotIncreasing`, `FinalHashMismatch`, `FinalBlockMismatch`, `RootClaimMismatch`) are defined in the main contract file instead of `src/dispute/tee/lib/Errors.sol`. + +**Recommendation:** Move to the errors library for consistency and discoverability. + +> **Response: Acknowledged, won't fix.** Code organization preference. These errors are specific to `prove()` batch verification logic and are co-located with the code that uses them. + +--- + +### L-05: No `receive()` or `fallback()` Function + +**Severity:** Informational +**File:** `src/dispute/tee/TeeDisputeGame.sol` + +The contract has no `receive()` or `fallback()`. ETH can only enter via `initialize()` and `challenge()`. ETH force-sent via deprecated `selfdestruct` would inflate `address(this).balance` beyond tracked amounts. Since `resolve()` uses `address(this).balance` directly (e.g., line 349), forced ETH would be distributed to the winner -- a minor accounting discrepancy. + +**Recommendation:** Acceptable by design. Document that direct ETH transfers are not supported. + +> **Response: By design.** Consistent with OP Stack dispute game conventions. Force-sent ETH goes to the winner — a minor surplus, not a vulnerability. + +--- + +### L-06: `challenge()` Single-Challenger Model + +**Severity:** Low +**File:** `src/dispute/tee/TeeDisputeGame.sol:237` + +Only one challenger can participate (first caller wins). Competing challengers waste gas on reverted transactions. + +**Recommendation:** Document as intentional. + +> **Response: By design.** Single-challenger model is intentional — aligns with the TEE dispute game's simplified challenge-prove model. + +--- + +### L-07: Missing Detailed Events for Bond Credit Assignments + +**Severity:** Low +**File:** `src/dispute/tee/TeeDisputeGame.sol:335-374` + +The `Resolved` event only emits `GameStatus`. Credit assignments (who gets how much) are not emitted, making off-chain monitoring harder. + +**Recommendation:** Emit events with recipient addresses and amounts during credit assignment. + +> **Response: Acknowledged, won't fix.** Low priority. Credit assignments can be derived from `normalModeCredit`/`refundModeCredit` state reads after resolution. + +--- + +### I-01: Calldatasize Check (0xBE) Is Correct + +**File:** `src/dispute/tee/TeeDisputeGame.sol:177` + +The calldatasize check of `0xBE` (190 bytes) is verified correct: +- 4 bytes: function selector (`initialize()`) +- 184 bytes (0xB8): Solady Clone immutable args + - 0x00: `gameCreator` (address, 20 bytes) + - 0x14: `rootClaim` (bytes32, 32 bytes) + - 0x34: `l1Head` (bytes32, 32 bytes) + - 0x54: `l2SequenceNumber` (uint256, 32 bytes) + - 0x74: `parentIndex` (uint32, 4 bytes) + - 0x78: `blockHash` (bytes32, 32 bytes) + - 0x98: `stateHash` (bytes32, 32 bytes) +- 2 bytes: Solady Clone length suffix + +Total: 4 + 184 + 2 = 190 = 0xBE. **Correct.** + +> **Response: Confirmed.** + +--- + +### I-02: `claimCredit()` Follows CEI Pattern Correctly + +**File:** `src/dispute/tee/TeeDisputeGame.sol:376-395` + +The `claimCredit()` function zeroes out both `refundModeCredit` and `normalModeCredit` (lines 390-391) before making the external ETH transfer (line 393). This follows the Checks-Effects-Interactions pattern and prevents reentrancy even without a dedicated reentrancy guard. **Safe.** + +> **Response: Confirmed.** + +--- + +### I-03: `extraData()` Layout Verified Correct + +**File:** `src/dispute/tee/TeeDisputeGame.sol:454` + +`extraData()` returns `_getArgBytes(0x54, 0x64)` (100 bytes from offset 0x54): +- `l2SequenceNumber` (32 bytes at 0x54) +- `parentIndex` (4 bytes at 0x74) +- `blockHash` (32 bytes at 0x78) +- `stateHash` (32 bytes at 0x98) + +Total: 32 + 4 + 32 + 32 = 100 = 0x64. **Correct.** + +> **Response: Confirmed.** + +--- + +### I-04: `closeGame()` Is Correctly Idempotent + +**File:** `src/dispute/tee/TeeDisputeGame.sol:397-421` + +`closeGame()` returns early if `bondDistributionMode` is already `REFUND` or `NORMAL`. Combined with `claimCredit()` always calling `closeGame()` first, this makes the claim flow safe for repeated calls. + +> **Response: Confirmed.** + +--- + +## 6. Gas Optimizations + +### G-01: Cache `claimData` in Memory in `resolve()` + +`resolve()` reads `claimData.status`, `claimData.counteredBy`, `claimData.prover` multiple times from storage. Caching the struct in memory saves ~2100 gas per cold SLOAD. + +> **Response: Acknowledged, may optimize later.** + +### G-02: Use `unchecked` for Loop Increment in `prove()` + +```solidity +for (uint256 i = 0; i < proofs.length; ) { + ... + unchecked { ++i; } +} +``` +Saves ~40 gas per iteration since `i` is bounded by `proofs.length`. + +> **Response: Acknowledged, may optimize later.** + +### G-03: `_extractAddress` Byte-by-Byte Copy + +**File:** `src/dispute/tee/TeeProofVerifier.sol:229-234` + +The function copies 64 bytes one at a time. Assembly-based copy would save gas: +```solidity +function _extractAddress(bytes memory publicKey) internal pure returns (address) { + bytes32 hash; + assembly { + hash := keccak256(add(publicKey, 33), 64) + } + return address(uint160(uint256(hash))); +} +``` +Only called during `register()` (infrequent), so low impact. + +> **Response: Acknowledged, may optimize later.** + +--- + +## 7. State Machine Analysis + +### ProposalStatus Transitions + +``` +Unchallenged ----[challenge()]----> Challenged +Unchallenged ----[prove()]-------> UnchallengedAndValidProofProvided +Challenged ------[prove()]-------> ChallengedAndValidProofProvided +Any status ------[resolve()]-----> Resolved +``` + +**Issues in state machine:** +1. `prove()` can be called in ANY non-gameOver status, including after proof already provided (C-01). +2. `prove()` can be called in `Unchallenged` state, bypassing the challenge window entirely (C-03). +3. `challenge()` can only be called from `Unchallenged` -- once proved, challenging is impossible. +4. Once `prove()` is called, `gameOver()` returns true permanently, blocking all further `challenge()` calls (C-03). + +### GameStatus Transitions + +``` +IN_PROGRESS ----[resolve(), parent lost]----------> CHALLENGER_WINS +IN_PROGRESS ----[resolve(), Unchallenged]----------> DEFENDER_WINS +IN_PROGRESS ----[resolve(), Challenged, no proof]--> CHALLENGER_WINS +IN_PROGRESS ----[resolve(), Unchallenged+proof]----> DEFENDER_WINS +IN_PROGRESS ----[resolve(), Challenged+proof]------> DEFENDER_WINS +``` + +`resolve()` correctly prevents double-resolution via `status != GameStatus.IN_PROGRESS` check (line 336). + +> **Response: State machine analysis is correct. Points 1-4 under "Issues" are by design in the TEE trust model — see C-01 and C-03 responses above.** + +--- + +## 8. Bond Flow Analysis + +### Deposit Paths +| Action | Depositor | Amount | Credited To | +|--------|-----------|--------|-------------| +| `initialize()` | Proposer (`tx.origin`) | `msg.value` | `refundModeCredit[proposer]` | +| `challenge()` | Challenger (`msg.sender`) | `CHALLENGER_BOND` (exact) | `refundModeCredit[msg.sender]` | + +### Distribution Paths (Normal Mode) +| Scenario | Proposer | Challenger | Prover | +|----------|----------|------------|--------| +| Unchallenged, no proof | All balance | N/A | N/A | +| Unchallenged + proof | All balance | N/A | Nothing | +| Challenged, no proof (deadline) | Nothing | All balance | N/A | +| Challenged + proof, prover == proposer | All balance | Nothing | (same) | +| Challenged + proof, prover != proposer | Balance - CHALLENGER_BOND | Nothing | CHALLENGER_BOND | +| Parent lost, has challenger | Nothing | All balance | N/A | +| **Parent lost, no challenger** | **Nothing (BUG C-02)** | **N/A** | **N/A** | + +### Refund Mode +Each participant receives back exactly what they deposited via `refundModeCredit`. + +> **Response: Bond flow analysis is correct. The "Parent lost, no challenger" row has been fixed — proposer now receives their bond back. See C-02 fix.** + +--- + +## Summary Table + +| ID | Severity | Title | +|------|-------------|--------------------------------------------------------------------------| +| C-01 | Critical | `prove()` can be called multiple times -- proof overwrite enables theft | +| C-02 | Critical | `resolve()` credits `address(0)` when parent loses, child unchallenged | +| C-03 | Critical | Challenge window bypass -- proposer can prevent all challenges | +| C-04 | Critical | No domain separation in batch digest -- cross-game signature replay | +| H-01 | High | Raw digest signing without EIP-191/EIP-712 prefix | +| H-02 | High | Unbounded batch array in `prove()` -- gas griefing/DoS | +| H-03 | High | `prove()` missing `IN_PROGRESS` status guard -- post-resolution mutation | +| H-04 | High | `tx.origin` enables proposer phishing | +| M-01 | Medium | `AccessManager.getLastProposalTimestamp()` unbounded loop DoS | +| M-02 | Medium | Silent error swallowing in `closeGame()` try-catch | +| M-03 | Medium | `wasRespectedGameTypeWhenCreated` set but never read | +| M-04 | Medium | Timestamp overflow edge case in deadline computation | +| M-05 | Medium | Cascade resolution bypasses child game period | +| M-06 | Medium | `credit()` view returns misleading data when `UNDECIDED` | +| L-01 | Low | `TeeProofVerifier` ownership lacks two-step transfer | +| L-02 | Low | Missing zero-address check in `transferOwnership()` | +| L-03 | Low | `expectedRootKey` not enforced immutable | +| L-04 | Info | Custom errors defined inline instead of in Errors.sol | +| L-05 | Info | No `receive()`/`fallback()` -- force-sent ETH unaccounted | +| L-06 | Low | Single-challenger model enables front-running | +| L-07 | Low | Missing detailed events for bond credit assignments | + +**Priority Recommendations (before deployment):** +1. **Immediate:** Fix C-01 -- add status guard to `prove()` to prevent proof overwrite. +2. **Immediate:** Fix C-02 -- handle `counteredBy == address(0)` in parent-loses path. +3. **Immediate:** Fix C-03 -- enforce challenge window independently from proof submission. +4. **Immediate:** Fix C-04 -- add domain separation to `batchDigest`. +5. **High priority:** Add `IN_PROGRESS` check to `prove()` (H-03). +6. **High priority:** Add EIP-712 domain separator to TEE signing (H-01). +7. **Before mainnet:** Address AccessManager DoS vector (M-01). + +> **Response summary:** +> - **C-02: Fixed.** Bond now credited to proposer when `counteredBy == address(0)`. +> - **C-03: Documented.** Added NatSpec to `prove()` explicitly documenting TEE trust model and early prove design. +> - **C-01, C-04: Not bugs** under the TEE trust model — see individual responses above. +> - **H-01, H-02, H-04: Won't fix** — acceptable given permissioned TEE architecture. +> - **H-03: Fixed.** Added `IN_PROGRESS` status guard to `prove()`. +> - **M-01: Known issue** — will optimize in future iteration. +> - **M-02 through M-06: Won't fix / by design** — see individual responses. +> - **Additional fix (not from audit):** Cross-chain GameType isolation added in `initialize()` line 190-191. diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md new file mode 100644 index 0000000000000..5d49e31746e00 --- /dev/null +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -0,0 +1,565 @@ +# TEE Dispute Game Specification + +## 1. Overview + +TeeDisputeGame is a dispute game contract for the OP Stack that replaces interactive bisection (FaultDisputeGame) and ZK proof verification (hypothetical OPSuccinctFaultDisputeGame) with **TEE (Trusted Execution Environment) ECDSA signature verification** for batch state transition proofs. + +**Purpose:** Enable faster, cheaper dispute resolution by leveraging AWS Nitro Enclave attestations. A TEE executor runs the state transition inside an enclave, signs the result with a registered enclave key, and the on-chain contract verifies the ECDSA signature against the registered enclave set. + +**How it fits in the OP Stack:** +- Uses the standard `DisputeGameFactory` for game creation (via Clone pattern) +- Integrates with `AnchorStateRegistry` for anchor state management, finalization, and validity checks +- Uses `BondDistributionMode` (NORMAL/REFUND) from the shared Types library +- Implements `IDisputeGame` interface for compatibility with `OptimismPortal` and other OP infrastructure +- Adds a `DisputeGameFactoryRouter` for multi-zone game creation +- Game type constant: `1960` + +--- + +## 2. Architecture + +### Contract Relationship Diagram + +``` + +---------------------------+ + | DisputeGameFactoryRouter | + | (multi-zone routing) | + +------------+--------------+ + | + v + +---------------------------+ + | DisputeGameFactory | + | (creates Clone proxies) | + +-----+----------+----------+ + | | + create() | | gameAtIndex() + v v + +--------------------------+ + | TeeDisputeGame | + | (Clone proxy instance) | + +----+-------+-------+-----+ + | | | + +----------+ +----+----+ +----------+ + v v v v + +----------------+ +---------+ +------------------+ +---------------+ + | AccessManager | | Anchor | | TeeProofVerifier | | IDisputeGame | + | (proposer/ | | State | | (enclave ECDSA | | (interface) | + | challenger | | Registry| | verification) | | | + | whitelist) | | | +-------+----------+ +---------------+ + +----------------+ +---------+ | + v + +------------------+ + | IRiscZeroVerifier| + | (enclave | + | registration | + | only) | + +------------------+ +``` + +### Immutables (set in constructor, shared across all clones) + +| Immutable | Type | Description | +|--------------------------|-------------------------|--------------------------------------------------| +| `GAME_TYPE` | `GameType` | Always `GameType.wrap(1960)` | +| `MAX_CHALLENGE_DURATION` | `Duration` | Window for challenger to post challenge | +| `MAX_PROVE_DURATION` | `Duration` | Window for prover to submit proof after challenge | +| `DISPUTE_GAME_FACTORY` | `IDisputeGameFactory` | Factory that created this game | +| `TEE_PROOF_VERIFIER` | `ITeeProofVerifier` | TEE signature verification contract | +| `CHALLENGER_BOND` | `uint256` | Fixed bond amount required to challenge | +| `ANCHOR_STATE_REGISTRY` | `IAnchorStateRegistry` | Anchor state management | +| `ACCESS_MANAGER` | `AccessManager` | Proposer/challenger whitelist | + +### Clone (CWIA) Data Layout + +| Offset | Size | Field | Description | +|--------|---------|-------------------|-----------------------------------------------------| +| 0x00 | 20 bytes| `gameCreator` | Address of the game creator | +| 0x14 | 32 bytes| `rootClaim` | The proposed output root claim | +| 0x34 | 32 bytes| `l1Head` | L1 block hash at game creation | +| 0x54 | 32 bytes| `l2SequenceNumber`| Target L2 block number | +| 0x74 | 4 bytes | `parentIndex` | Index of parent game in factory (0xFFFFFFFF = root) | +| 0x78 | 32 bytes| `blockHash` | L2 block hash component of rootClaim | +| 0x98 | 32 bytes| `stateHash` | L2 state hash component of rootClaim | + +Total extraData: 100 bytes (0x64) starting at offset 0x54. Expected calldata size: `0xBE` (190 bytes). + +### State Variables + +| Variable | Type | Description | +|------------------------------------|-------------------------------|----------------------------------------------| +| `createdAt` | `Timestamp` | Block timestamp of initialization | +| `resolvedAt` | `Timestamp` | Block timestamp of resolution | +| `status` | `GameStatus` | IN_PROGRESS / DEFENDER_WINS / CHALLENGER_WINS| +| `proposer` | `address` | `tx.origin` of the initialize call | +| `initialized` | `bool` | Re-initialization guard | +| `claimData` | `ClaimData` | Single claim (not an array like FDG) | +| `normalModeCredit[addr]` | `mapping(address => uint256)` | Bonds distributed to winners | +| `refundModeCredit[addr]` | `mapping(address => uint256)` | Bonds refunded to original depositors | +| `startingOutputRoot` | `Proposal` | Starting anchor (root hash + block number) | +| `wasRespectedGameTypeWhenCreated` | `bool` | Was this game type respected at creation? | +| `bondDistributionMode` | `BondDistributionMode` | UNDECIDED / NORMAL / REFUND | + +--- + +## 3. Game Lifecycle + +### State Machine + +``` + initialize() + | + v + +---------------+ + | Unchallenged | <-- deadline = now + MAX_CHALLENGE_DURATION + +-------+-------+ + | + +------------------+------------------+ + | | + challenge() deadline expires + | | + v v + +-------------+ resolve() -> DEFENDER_WINS + | Challenged | <-- deadline = now + MAX_PROVE_DURATION + +------+------+ + | + +----------+----------+ + | | + prove() deadline expires + | | + v v ++---------------------------+ resolve() -> CHALLENGER_WINS +| ChallengedAndValid | +| ProofProvided | ++----------+---------------+ + | + v + resolve() -> DEFENDER_WINS +``` + +If `prove()` is called while Unchallenged: + +``` + Unchallenged --> prove() --> UnchallengedAndValidProofProvided --> resolve() --> DEFENDER_WINS +``` + +### ProposalStatus Transitions + +| From | Action | To | +|--------------------------------------|-------------|---------------------------------------| +| `Unchallenged` | `challenge()`| `Challenged` | +| `Unchallenged` | `prove()` | `UnchallengedAndValidProofProvided` | +| `Challenged` | `prove()` | `ChallengedAndValidProofProvided` | +| Any (on resolve) | `resolve()` | `Resolved` | + +### GameStatus Transitions + +| Condition | Result | +|----------------------------------------------------|--------------------| +| Parent game resolved as CHALLENGER_WINS | CHALLENGER_WINS | +| Unchallenged + deadline expired | DEFENDER_WINS | +| Challenged + deadline expired (no proof) | CHALLENGER_WINS | +| UnchallengedAndValidProofProvided | DEFENDER_WINS | +| ChallengedAndValidProofProvided | DEFENDER_WINS | + +### `gameOver()` Condition + +```solidity +gameOver_ = claimData.deadline.raw() < block.timestamp || claimData.prover != address(0); +``` + +The game is "over" (no more interactions) when the deadline passes OR a valid proof is submitted. + +--- + +## 4. Initialization + +`initialize()` is called by the `DisputeGameFactory` immediately after cloning. + +### Validation Checks (in order) + +1. **Not already initialized** -- reverts `AlreadyInitialized` +2. **Caller is the factory** -- reverts `IncorrectDisputeGameFactory` +3. **tx.origin is whitelisted proposer** (or permissionless mode active) -- reverts `BadAuth` +4. **Calldata size is exactly 0xBE (190 bytes)** -- reverts with selector `0x9824bdab` (BadExtraData) +5. **rootClaim == keccak256(abi.encode(blockHash, stateHash))** -- reverts `RootClaimMismatch` +6. **Parent game validation** (if parentIndex != type(uint32).max): + - Parent game type must match `GAME_TYPE` + - Parent must be respected, not blacklisted, not retired (via ASR) + - Parent must not have status CHALLENGER_WINS +7. **l2SequenceNumber > startingOutputRoot.l2SequenceNumber** -- reverts `UnexpectedRootClaim` + +### Parent Game Resolution + +- If `parentIndex == type(uint32).max`: uses anchor state from `AnchorStateRegistry.anchors(GAME_TYPE)` +- Otherwise: reads `rootClaim` and `l2SequenceNumber` from the parent TeeDisputeGame proxy + +### Initialization Side Effects + +- Sets `claimData` with deadline = `now + MAX_CHALLENGE_DURATION` +- Records `proposer = tx.origin` +- Credits `refundModeCredit[proposer] += msg.value` (the bond) +- Sets `createdAt` and `wasRespectedGameTypeWhenCreated` + +--- + +## 5. Challenge-Prove Model + +### Single-Round vs Multi-Round + +| Aspect | TeeDisputeGame | FaultDisputeGame | +|----------------------------|----------------------------------------------|---------------------------------------------------| +| Dispute model | Single-round: challenge + prove | Multi-round interactive bisection + step | +| Claim structure | Single `ClaimData` struct | Append-only `ClaimData[]` array (DAG) | +| Challenge mechanism | `challenge()` with fixed bond | `move()` (attack/defend) with position-based bonds | +| Proof | TEE ECDSA batch signatures | On-chain VM single instruction step | +| Resolution complexity | O(1) - single resolve call | O(n) - bottom-up subgame resolution | +| Time model | Fixed deadlines (challenge window, prove window) | Chess clock with extensions | + +### challenge() + +- Requires: `Unchallenged` status, whitelisted challenger, game not over, exact bond amount +- Effects: sets `counteredBy`, transitions to `Challenged`, resets deadline to `now + MAX_PROVE_DURATION` +- Bond: credited to `refundModeCredit[challenger]` + +### prove() + +- Can be called in both `Unchallenged` and `Challenged` states +- Accepts ABI-encoded `BatchProof[]` array +- Verifies chain of batch proofs (see Section 6) +- Records `prover = msg.sender` +- No bond required from prover +- Anyone can call prove() (no access control), but TEE signature must be from registered enclave + +--- + +## 6. Batch Proof Verification + +### BatchProof Structure + +```solidity +struct BatchProof { + bytes32 startBlockHash; + bytes32 startStateHash; + bytes32 endBlockHash; + bytes32 endStateHash; + uint256 l2Block; + bytes signature; // 65 bytes ECDSA (r + s + v) +} +``` + +### Verification Steps + +For a `BatchProof[] proofs` array: + +1. **Start anchor**: `keccak256(abi.encode(proofs[0].startBlockHash, proofs[0].startStateHash))` must equal `startingOutputRoot.root` +2. **Chain continuity** (for i > 0): `proofs[i].start{Block,State}Hash == proofs[i-1].end{Block,State}Hash` +3. **Monotonic blocks**: `proofs[i].l2Block > prevBlock` (starting from `startingOutputRoot.l2SequenceNumber`) +4. **TEE signature**: For each batch, compute `batchDigest = keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block))` and call `TEE_PROOF_VERIFIER.verifyBatch(batchDigest, signature)` +5. **End anchor**: `keccak256(abi.encode(proofs[last].endBlockHash, proofs[last].endStateHash))` must equal `rootClaim()` +6. **Final block**: `proofs[last].l2Block` must equal `l2SequenceNumber()` + +### batchDigest Computation + +``` +batchDigest = keccak256(abi.encode( + startBlockHash, // bytes32 + startStateHash, // bytes32 + endBlockHash, // bytes32 + endStateHash, // bytes32 + l2Block // uint256 +)) +``` + +### TeeProofVerifier.verifyBatch() + +1. `ECDSA.tryRecover(digest, signature)` to recover signer +2. Check `registeredEnclaves[recovered].registeredAt != 0` +3. Return signer address + +### Enclave Registration (TeeProofVerifier.register()) + +- Owner-only function +- Verifies RISC Zero ZK proof of AWS Nitro attestation +- Parses journal: timestamp, PCR hash, root key, secp256k1 public key, user data +- Validates root key matches AWS Nitro official root +- Extracts Ethereum address from public key +- Stores `EnclaveInfo{pcrHash, registeredAt}` mapping + +--- + +## 7. Bond Economics + +### Bond Flow + +| Actor | When | Amount | Credited To | +|-----------|-------------------|----------------------|---------------------------| +| Proposer | `initialize()` | `msg.value` (any) | `refundModeCredit[proposer]` | +| Challenger| `challenge()` | `CHALLENGER_BOND` | `refundModeCredit[challenger]` | + +### Bond Distribution on resolve() + +| ProposalStatus | Winner | Distribution | +|---------------------------------------|------------------|--------------------------------------------------------------------------------------------------| +| Unchallenged (deadline expired) | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | +| Challenged (deadline expired, no proof) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | +| UnchallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | +| ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | If prover == proposer: `normalModeCredit[prover] = balance`
Else: `normalModeCredit[prover] = CHALLENGER_BOND`, `normalModeCredit[proposer] = balance - CHALLENGER_BOND` | +| Parent game CHALLENGER_WINS | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | + +### closeGame() and BondDistributionMode + +Before credits can be claimed, `closeGame()` determines the distribution mode: + +1. Check `ANCHOR_STATE_REGISTRY.isGameFinalized()` (resolved + finality delay elapsed) +2. Try to set this game as the new anchor state +3. Check `ANCHOR_STATE_REGISTRY.isGameProper()` (registered, not blacklisted, not retired, not paused) +4. If proper: `NORMAL` mode (winners get bonds). If not: `REFUND` mode (everyone gets their deposit back) + +### claimCredit() + +1. Calls `closeGame()` (idempotent) +2. Reads credit based on `bondDistributionMode` +3. Zeroes both credit mappings +4. Transfers ETH via low-level `call` + +**Key difference from FaultDisputeGame:** FDG uses `DelayedWETH` (deposit/unlock/withdraw pattern) for bond custody. TeeDisputeGame holds ETH directly in the contract (`address(this).balance`). + +--- + +## 8. Parent-Child Chaining + +### How Games Reference Parents + +- `parentIndex` is a `uint32` stored in CWIA calldata at offset `0x74` +- `type(uint32).max` (0xFFFFFFFF) means "no parent" (uses anchor state from ASR) +- Any other value is an index into `DisputeGameFactory.gameAtIndex()` + +### Parent Validation (in initialize()) + +``` +parentIndex != type(uint32).max: + 1. parentGameType must == GAME_TYPE (cross-type isolation) + 2. Parent must be respected (ASR.isGameRespected) + 3. Parent must not be blacklisted (ASR.isGameBlacklisted) + 4. Parent must not be retired (ASR.isGameRetired) + 5. Parent must not be CHALLENGER_WINS + + startingOutputRoot = { + l2SequenceNumber: parent.l2SequenceNumber(), + root: Hash.wrap(parent.rootClaim().raw()) + } +``` + +### Cross-Chain Isolation + +The `GameType` check (`parentGameType == GAME_TYPE`) ensures TEE games can only chain to other TEE games. This prevents a compromised FaultDisputeGame from being used as a starting point for a TEE chain. + +### resolve() Parent Dependency + +- If parent exists and is still `IN_PROGRESS`: `resolve()` reverts with `ParentGameNotResolved` +- If parent resolved as `CHALLENGER_WINS`: child automatically resolves as `CHALLENGER_WINS` +- If parent resolved as `DEFENDER_WINS` (or no parent): normal resolution logic applies + +--- + +## 9. AnchorStateRegistry Integration + +### Functions Used by TeeDisputeGame + +| ASR Function | Where Used | Purpose | +|------------------------------|-------------------------|-------------------------------------------------| +| `anchors(GAME_TYPE)` | `initialize()` | Get starting anchor when no parent | +| `respectedGameType()` | `initialize()` | Check if this game type is respected at creation| +| `isGameRespected(proxy)` | `initialize()` | Validate parent game | +| `isGameBlacklisted(proxy)` | `initialize()` | Validate parent game | +| `isGameRetired(proxy)` | `initialize()` | Validate parent game | +| `isGameFinalized(this)` | `closeGame()` | Check resolution + finality delay | +| `setAnchorState(this)` | `closeGame()` | Try to update anchor game | +| `isGameProper(this)` | `closeGame()` | Determine NORMAL vs REFUND mode | + +### Anchor State Update Flow + +``` +claimCredit() -> closeGame() -> ASR.setAnchorState(this) [try/catch] + -> ASR.isGameProper(this) + -> set bondDistributionMode +``` + +`setAnchorState` will succeed only if: +- Game claim is valid (proper + respected + finalized + DEFENDER_WINS) +- Game's `l2SequenceNumber` > current anchor's block number + +### rootClaim Format + +``` +rootClaim = keccak256(abi.encode(blockHash, stateHash)) +``` + +This differs from FaultDisputeGame where rootClaim is an output root hash directly. The ASR stores this combined hash as the anchor root. + +--- + +## 10. Access Control + +### AccessManager Contract + +The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: + +| Role | Storage | Check Function | Fallback | +|-------------|--------------------------------|----------------------------|---------------------------------------| +| Proposer | `mapping(address => bool) proposers` | `isAllowedProposer()` | Permissionless after `FALLBACK_TIMEOUT` since last TEE game creation | +| Challenger | `mapping(address => bool) challengers` | `isAllowedChallenger()` | Permissionless if `challengers[address(0)] == true` | + +**Permissionless fallback for proposers:** +- `getLastProposalTimestamp()` iterates backwards through `DisputeGameFactory.gameAtIndex()` to find the most recent TEE game +- If `block.timestamp - lastProposalTimestamp > FALLBACK_TIMEOUT`, anyone can propose +- This prevents liveness failures if all whitelisted proposers go offline + +### TeeProofVerifier Roles + +| Role | Function | Description | +|----------|-------------------------|----------------------------------------------------| +| Owner | `register(seal, journal)` | Register enclave after ZK proof verification | +| Owner | `revoke(enclaveAddress)` | Remove enclave registration | +| Owner | `transferOwnership()` | Transfer ownership | +| Anyone | `verifyBatch()` | Verify batch signature (view, no state change) | + +### Comparison: TeeDisputeGame vs PermissionedDisputeGame Access Control + +| Aspect | TeeDisputeGame | PermissionedDisputeGame | +|----------------------------|----------------------------------------------|---------------------------------------------| +| Proposer check | `AccessManager.isAllowedProposer(tx.origin)` | `tx.origin == PROPOSER` (single address) | +| Challenger check | `AccessManager.isAllowedChallenger(msg.sender)` | `msg.sender == PROPOSER \|\| msg.sender == CHALLENGER` | +| Multiple proposers? | Yes (whitelist mapping) | No (single immutable address) | +| Permissionless fallback? | Yes (timeout-based) | No | +| Role management | External AccessManager contract | Immutable constructor params | + +--- + +## 11. Comparison with Existing Contracts + +### Feature Comparison Table + +| Feature | TeeDisputeGame | FaultDisputeGame | PermissionedDisputeGame | +|--------------------------------|----------------------------------------|-----------------------------------------|-----------------------------------------| +| **Proof mechanism** | TEE ECDSA batch signatures | Interactive bisection + VM step | Interactive bisection + VM step (gated) | +| **Dispute rounds** | 1 (challenge + prove) | Many (bisection tree) | Many (bisection tree, permissioned) | +| **Claims** | Single ClaimData struct | Append-only ClaimData[] array | Append-only ClaimData[] array | +| **Resolution** | O(1), single resolve() | O(n), bottom-up resolveClaim() | O(n), bottom-up resolveClaim() | +| **Bond custody** | Native ETH in contract | DelayedWETH | DelayedWETH | +| **Bond model** | Fixed challenger bond | Position-dependent bond curve | Position-dependent bond curve | +| **Time model** | Fixed deadlines (challenge, prove) | Chess clock with extensions | Chess clock with extensions | +| **Access control** | AccessManager (whitelist + fallback) | Permissionless | Single proposer + challenger addresses | +| **Parent chaining** | Explicit parentIndex in extraData | N/A (uses ASR anchor only) | N/A (uses ASR anchor only) | +| **L2 block challenge** | N/A (blockHash in extraData) | `challengeRootL2Block()` + RLP proof | `challengeRootL2Block()` + RLP proof | +| **ASR anchor source** | `anchors(GAME_TYPE)` (legacy path) | `getAnchorRoot()` (unified path) | `getAnchorRoot()` (unified path) | +| **Clone pattern** | Solady Clone | Solady Clone | Solady Clone (inherits FDG) | +| **Game type** | 1960 | Configurable | Configurable | +| **Pause handling** | Via ASR.isGameProper (closeGame) | ASR.paused() blocks closeGame | ASR.paused() blocks closeGame | +| **l2SequenceNumber source** | CWIA extraData | CWIA extraData (= l2BlockNumber) | CWIA extraData (= l2BlockNumber) | + +--- + +## 12. Security Considerations + +### Trust Model + +1. **TEE enclave integrity**: The system trusts that registered TEE enclaves correctly execute state transitions. If an enclave is compromised, it could sign invalid state transitions. + +2. **TeeProofVerifier owner**: The owner can register arbitrary addresses as enclaves (the ZK proof verification is a trust gate, but the owner controls registration). A compromised owner could register a non-enclave address. + +3. **AccessManager owner**: Controls who can propose and challenge. A compromised owner could remove all challengers, leaving invalid proposals unchallenged. + +4. **Single challenge model**: Unlike FaultDisputeGame's multi-round bisection, only ONE challenger can challenge a proposal. If the challenger fails to follow through with a proof, the proposal is accepted. There is no mechanism for a second challenger. + +5. **`tx.origin` usage**: `initialize()` checks `ACCESS_MANAGER.isAllowedProposer(tx.origin)`. Using `tx.origin` means the proposer's EOA is checked regardless of intermediate contracts, which is consistent with PermissionedDisputeGame but has known risks (e.g., meta-transaction relayers would inherit the tx.origin of the outer caller). + +### Potential Risks + +1. **Parent chain invalidation cascade**: If a parent game is resolved as CHALLENGER_WINS after child games are created, all children automatically resolve as CHALLENGER_WINS. This is correct behavior but could lead to unexpected bond losses if proposers build deep chains on top of an invalid parent. + +2. **No replay protection on prove()**: The same proof bytes can be submitted to different game instances if they happen to cover the same state range. This is not a vulnerability (the proof is still valid), but it means provers don't need unique proofs per game. + +3. **resolve() when parent not resolved**: If the parent game's status is IN_PROGRESS, `resolve()` reverts with `ParentGameNotResolved`. This blocks resolution until the parent resolves, which could delay credit claims. + +4. **Bond held as native ETH**: Unlike FaultDisputeGame which uses DelayedWETH for withdrawal delays, TeeDisputeGame holds ETH directly. The finality delay is enforced by `ASR.isGameFinalized()` instead. + +5. **AccessManager fallback iteration**: `getLastProposalTimestamp()` iterates backwards through ALL games in the factory to find the last TEE game. This is O(n) and could become gas-expensive if there are many non-TEE games after the last TEE game. + +6. **Enclave registration root key comparison**: `TeeProofVerifier.register()` compares root keys via `keccak256(rootKey) != keccak256(expectedRootKey)`, which is correct but uses dynamic memory allocation for the hash. The `expectedRootKey` is stored as `bytes` (storage-heavy) rather than a `bytes32` hash. + +--- + +## 13. Optimization Suggestions + +### 1. Use `getAnchorRoot()` instead of `anchors()` + +In `initialize()`, when `parentIndex == type(uint32).max`: + +```solidity +// Current (uses legacy function): +(startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = + IAnchorStateRegistry(ANCHOR_STATE_REGISTRY).anchors(GAME_TYPE); + +// Suggested (uses current function): +(startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = + ANCHOR_STATE_REGISTRY.getAnchorRoot(); +``` + +The `anchors()` function is explicitly marked `@custom:legacy` in AnchorStateRegistry and ignores the `GameType` parameter entirely. Using `getAnchorRoot()` is more correct and future-proof. + +### 2. Add pause check in closeGame() + +FaultDisputeGame's `closeGame()` explicitly checks `ANCHOR_STATE_REGISTRY.paused()` and reverts with `GamePaused()` to prevent games from entering REFUND mode during temporary pauses. TeeDisputeGame relies on `isGameProper()` returning false during pauses (which sends games to REFUND mode), but this means paused games permanently enter REFUND mode rather than waiting. Consider adding: + +```solidity +if (ANCHOR_STATE_REGISTRY.paused()) revert GamePaused(); +``` + +### 3. Add resolvedAt check in closeGame() + +FaultDisputeGame's `closeGame()` explicitly checks `resolvedAt.raw() != 0` before proceeding. TeeDisputeGame relies on `ASR.isGameFinalized()` to check this, but adding an explicit local check would be defensive: + +```solidity +if (resolvedAt.raw() == 0) revert GameNotResolved(); +``` + +### 4. Store expectedRootKey as bytes32 hash + +In TeeProofVerifier, storing `expectedRootKey` as `bytes` uses ~3 storage slots (96 bytes). Instead, store the keccak256 hash: + +```solidity +bytes32 public immutable expectedRootKeyHash; +// In register(): if (keccak256(rootKey) != expectedRootKeyHash) revert InvalidRootKey(); +``` + +### 5. Optimize AccessManager.getLastProposalTimestamp() + +The backward iteration through all factory games is O(n). Consider caching the last proposal timestamp: + +```solidity +uint256 public lastProposalTimestamp; +// Updated by TeeDisputeGame.initialize() via a callback +``` + +### 6. Consider allowing multiple challengers + +The current model allows only one challenger per game. If the first challenger colludes with the proposer (challenges but never provides proof), the game resolves in the challenger's favor, not a third party's. While the bond economics discourage this, allowing multiple challengers or a challenge-replacement mechanism would be more robust. + +### 7. Use EIP-712 typed data for batchDigest + +The current `batchDigest` is a plain `keccak256(abi.encode(...))`. Using EIP-712 structured data would: +- Prevent cross-contract replay if another contract uses the same digest scheme +- Provide better wallet UX for TEE key management + +### 8. Add explicit receive()/fallback() + +The contract accepts ETH via `initialize()` and `challenge()` (both `payable`), but has no `receive()` function. If ETH is accidentally sent directly, it will be lost. Consider adding a `receive()` that reverts. + +### 9. Consider reentrancy guard on claimCredit() + +`claimCredit()` makes a low-level `call` to `_recipient` before the function completes. While credits are zeroed before the call, a reentrancy guard would be a defense-in-depth measure consistent with best practices. + +### 10. Align resolve() checks with FaultDisputeGame + +FaultDisputeGame uses `GameNotInProgress` error for the "already resolved" check. TeeDisputeGame uses `ClaimAlreadyResolved`. Consider using the same error for consistency, or renaming to avoid confusion (since `ClaimAlreadyResolved` is also used in FDG's `resolveClaim` with a different semantic meaning). diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index 14a3807e6deb3..e4355bd41c97c 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -187,7 +187,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { } if (parentIndex() != type(uint32).max) { - (,, IDisputeGame proxy) = DISPUTE_GAME_FACTORY.gameAtIndex(parentIndex()); + (GameType parentGameType,, IDisputeGame proxy) = DISPUTE_GAME_FACTORY.gameAtIndex(parentIndex()); + if (GameType.unwrap(parentGameType) != GameType.unwrap(GAME_TYPE)) revert InvalidParentGame(); if ( !ANCHOR_STATE_REGISTRY.isGameRespected(proxy) || ANCHOR_STATE_REGISTRY.isGameBlacklisted(proxy) @@ -248,7 +249,14 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { } /// @notice Submit chained batch proofs to verify the full state transition. - /// @dev Each BatchProof covers a sub-range with (startBlockHash, startStateHash, endBlockHash, endStateHash). + /// @dev Can be called before or after challenge(). Early proving (before any challenge) is + /// intentional — TEE enclaves are trusted, so a valid proof means the claim is correct. + /// Once proved, gameOver() returns true, which blocks further challenges. The challenge + /// mechanism is an economic incentive for the TEE to prove on demand, not a fraud-proof + /// security layer. If the TEE is compromised, the system's security relies on enclave + /// revocation via TeeProofVerifier.revoke(), not on the challenge window. + /// + /// Each BatchProof covers a sub-range with (startBlockHash, startStateHash, endBlockHash, endStateHash). /// The contract verifies: /// 1. keccak256(proofs[0].startBlockHash, startStateHash) == startingOutputRoot.root /// 2. proofs[i].end{Block,State}Hash == proofs[i+1].start{Block,State}Hash (chain continuity) @@ -258,6 +266,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { /// 6. Each batch's TEE signature is valid (via TEE_PROOF_VERIFIER) /// @param proofBytes ABI-encoded BatchProof[] array function prove(bytes calldata proofBytes) external returns (ProposalStatus) { + if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved(); if (gameOver()) revert GameOver(); BatchProof[] memory proofs = abi.decode(proofBytes, (BatchProof[])); @@ -339,7 +348,11 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { if (parentGameStatus == GameStatus.CHALLENGER_WINS) { status = GameStatus.CHALLENGER_WINS; - normalModeCredit[claimData.counteredBy] = address(this).balance; + // If the child was challenged, the challenger gets the bonds. + // If the child was never challenged (counteredBy == address(0)), + // refund the proposer — they should not lose their bond due to parent invalidation. + address recipient = claimData.counteredBy != address(0) ? claimData.counteredBy : proposer; + normalModeCredit[recipient] = address(this).balance; } else { if (!gameOver()) revert GameNotOver(); diff --git a/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol b/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol index 9a758435f7321..d0a0224ebbc31 100644 --- a/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol +++ b/packages/contracts-bedrock/src/dispute/tee/lib/Errors.sol @@ -28,3 +28,6 @@ error InvalidProposalStatus(); /// @notice Thrown when the game is initialized by an incorrect factory. error IncorrectDisputeGameFactory(); + +/// @notice Thrown when prove() is called but the claim has not been challenged. +error ClaimNotChallenged(); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index 8ff8378803477..c26e8c9331da6 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -24,7 +24,7 @@ import { Proposal } from "src/dispute/lib/Types.sol"; import {GameNotFinalized} from "src/dispute/lib/Errors.sol"; -import {ParentGameNotResolved} from "src/dispute/tee/lib/Errors.sol"; +import {ParentGameNotResolved, InvalidParentGame} from "src/dispute/tee/lib/Errors.sol"; import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; @@ -430,6 +430,52 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { assertEq(challenger.balance, challengerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); } + //////////////////////////////////////////////////////////////// + // Test 6b: Parent Loses, Child Unchallenged → Proposer Refund // + //////////////////////////////////////////////////////////////// + + /// @notice When parent loses and child was never challenged, proposer should get their bond back + /// (regression test for C-02: resolve() previously credited address(0)) + function test_lifecycle_parentChallengerWins_childUnchallenged_proposerRefunded() public { + bytes32 parentEndBlockHash = keccak256("parent-end-block"); + bytes32 parentEndStateHash = keccak256("parent-end-state"); + + // Create parent (still IN_PROGRESS) + (TeeDisputeGame parent,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash + ); + + // Create child BEFORE parent resolves — child is NOT challenged + bytes32 childEndBlockHash = keccak256("child-end-block"); + bytes32 childEndStateHash = keccak256("child-end-state"); + (TeeDisputeGame child,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash + ); + + // Challenge parent and let it timeout → CHALLENGER_WINS + vm.prank(challenger); + parent.challenge{value: CHALLENGER_BOND}(); + + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + parent.resolve(); + assertEq(uint8(parent.status()), uint8(GameStatus.CHALLENGER_WINS)); + + // Child resolve short-circuits to CHALLENGER_WINS because parent lost + assertEq(uint8(child.resolve()), uint8(GameStatus.CHALLENGER_WINS)); + + // Proposer should get their bond back (not burned to address(0)) + assertEq(child.normalModeCredit(proposer), DEFENDER_BOND); + assertEq(child.normalModeCredit(address(0)), 0); + + // Wait for finality and claim + vm.warp(block.timestamp + 1); + uint256 proposerBalanceBefore = proposer.balance; + child.claimCredit(proposer); + + assertEq(uint8(child.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); + assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); + } + //////////////////////////////////////////////////////////////// // Test 7: Child Cannot Resolve Before Parent // //////////////////////////////////////////////////////////////// @@ -522,6 +568,107 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { assertEq(game.refundModeCredit(address(router)), 0); } + //////////////////////////////////////////////////////////////// + // Test 9: Cross-Chain — Parent Game Wrong GameType // + //////////////////////////////////////////////////////////////// + + /// @notice Creating a TZ game with a parent of a different GameType reverts + function test_initialize_revertParentGameWrongGameType() public { + // Register a second game type (XL = GameType 1) using the same implementation + GameType XL_GAME_TYPE = GameType.wrap(1); + factory.setImplementation(XL_GAME_TYPE, IDisputeGame(address(implementation)), bytes("")); + factory.setInitBond(XL_GAME_TYPE, DEFENDER_BOND); + + // Create an XL game (index 0) — factory records it as GameType 1 + bytes memory xlExtraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); + Claim xlRootClaim = computeRootClaim(keccak256("xl-block"), keccak256("xl-state")); + + vm.startPrank(proposer, proposer); + factory.create{value: DEFENDER_BOND}(XL_GAME_TYPE, xlRootClaim, xlExtraData); + vm.stopPrank(); + + // Try to create a TZ game (GameType 1960) with parentIndex=0 (the XL game) + // This should revert because parent's GameType (1) != child's GAME_TYPE (1960) + bytes memory tzExtraData = buildExtraData(ANCHOR_L2_BLOCK + 10, 0, keccak256("tz-block"), keccak256("tz-state")); + Claim tzRootClaim = computeRootClaim(keccak256("tz-block"), keccak256("tz-state")); + + vm.startPrank(proposer, proposer); + vm.expectRevert(InvalidParentGame.selector); + factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, tzRootClaim, tzExtraData); + vm.stopPrank(); + } + + //////////////////////////////////////////////////////////////// + // Test 10: Cross-Chain — Anchor Isolation // + //////////////////////////////////////////////////////////////// + + /// @notice A resolved TZ game cannot update XL's AnchorStateRegistry + function test_crossChain_anchorIsolation() public { + // Deploy a second ASR for the "XL" chain with its own respectedGameType + GameType XL_GAME_TYPE = GameType.wrap(1); + AnchorStateRegistry xlAnchorStateRegistry = _deployAnchorStateRegistryForType(factory, XL_GAME_TYPE); + + // Create and resolve a TZ game (DEFENDER_WINS) + bytes32 endBlockHash = keccak256("tz-end-block"); + bytes32 endStateHash = keccak256("tz-end-state"); + (TeeDisputeGame tzGame,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + tzGame.resolve(); + vm.warp(block.timestamp + 1); + + // TZ game CAN update TZ's ASR (via claimCredit → closeGame → setAnchorState) + tzGame.claimCredit(proposer); + assertEq(address(anchorStateRegistry.anchorGame()), address(tzGame)); + + // TZ game CANNOT update XL's ASR — isGameRegistered fails because + // the game was created by a factory that XL's ASR recognizes, but + // setAnchorState checks respectedGameType which is XL_GAME_TYPE (1), not 1960 + vm.expectRevert(); + xlAnchorStateRegistry.setAnchorState(IDisputeGame(address(tzGame))); + } + + //////////////////////////////////////////////////////////////// + // Test 11: Cross-Chain — Parent Chain Isolation // + //////////////////////////////////////////////////////////////// + + /// @notice In a shared Factory, a child game can reference a same-type parent + /// but NOT a different-type parent + function test_crossChain_parentChainIsolation() public { + // Register XL game type in the same factory + GameType XL_GAME_TYPE = GameType.wrap(1); + factory.setImplementation(XL_GAME_TYPE, IDisputeGame(address(implementation)), bytes("")); + factory.setInitBond(XL_GAME_TYPE, DEFENDER_BOND); + + // Create XL game (index 0) + bytes memory xlExtraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); + Claim xlRootClaim = computeRootClaim(keccak256("xl-block"), keccak256("xl-state")); + + vm.startPrank(proposer, proposer); + factory.create{value: DEFENDER_BOND}(XL_GAME_TYPE, xlRootClaim, xlExtraData); + vm.stopPrank(); + + // Create TZ game (index 1) + (TeeDisputeGame tzParent,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("tz-block"), keccak256("tz-state") + ); + + // TZ child referencing TZ parent (index 1, same type) — should succeed + (TeeDisputeGame tzChild,,) = _createGame( + proposer, ANCHOR_L2_BLOCK + 10, 1, keccak256("tz-child-block"), keccak256("tz-child-state") + ); + assertEq(uint8(tzChild.status()), uint8(GameStatus.IN_PROGRESS)); + + // TZ child referencing XL parent (index 0, wrong type) — should revert + bytes memory badExtraData = buildExtraData(ANCHOR_L2_BLOCK + 15, 0, keccak256("bad-block"), keccak256("bad-state")); + Claim badRootClaim = computeRootClaim(keccak256("bad-block"), keccak256("bad-state")); + + vm.startPrank(proposer, proposer); + vm.expectRevert(InvalidParentGame.selector); + factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, badRootClaim, badExtraData); + vm.stopPrank(); + } + //////////////////////////////////////////////////////////////// // Infrastructure Helpers // //////////////////////////////////////////////////////////////// @@ -568,6 +715,31 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { return verifier; } + function _deployAnchorStateRegistryForType(DisputeGameFactory _factory, GameType _gameType) + internal + returns (AnchorStateRegistry) + { + MockSystemConfig systemConfig = new MockSystemConfig(address(this)); + AnchorStateRegistry impl = new AnchorStateRegistry(0); + Proxy proxy = new Proxy(address(this)); + proxy.upgradeToAndCall( + address(impl), + abi.encodeCall( + impl.initialize, + ( + ISystemConfig(address(systemConfig)), + IDisputeGameFactory(address(_factory)), + Proposal({ + root: Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + _gameType + ) + ) + ); + return AnchorStateRegistry(address(proxy)); + } + function _createGame( address creator, uint256 l2SequenceNumber, From f4f097f7b14ee98c0df60819c4b8aa568267c4a9 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 14:20:22 +0800 Subject: [PATCH 08/24] docs: update TEE dispute game spec with audit fix details - Update bond distribution table: parent-loses path now has two rows (child challenged vs child unchallenged) - Document prove() IN_PROGRESS guard and early prove design - Update parent chain invalidation cascade description - Clarify resolve() parent dependency bond handling Co-Authored-By: Claude Opus 4.6 (1M context) --- .../book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index 5d49e31746e00..728711d3de72b 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -223,12 +223,14 @@ The game is "over" (no more interactions) when the deadline passes OR a valid pr ### prove() -- Can be called in both `Unchallenged` and `Challenged` states +- Can be called in both `Unchallenged` and `Challenged` states (early proving is by design — TEE is trusted) +- Requires game status `IN_PROGRESS` (cannot prove after resolution) - Accepts ABI-encoded `BatchProof[]` array - Verifies chain of batch proofs (see Section 6) - Records `prover = msg.sender` - No bond required from prover - Anyone can call prove() (no access control), but TEE signature must be from registered enclave +- Once proved, `gameOver()` returns true, which blocks further `challenge()` calls — this is intentional since a valid TEE proof confirms the claim is correct --- @@ -304,7 +306,8 @@ batchDigest = keccak256(abi.encode( | Challenged (deadline expired, no proof) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | | UnchallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | | ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | If prover == proposer: `normalModeCredit[prover] = balance`
Else: `normalModeCredit[prover] = CHALLENGER_BOND`, `normalModeCredit[proposer] = balance - CHALLENGER_BOND` | -| Parent game CHALLENGER_WINS | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | +| Parent game CHALLENGER_WINS (child challenged) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | +| Parent game CHALLENGER_WINS (child unchallenged) | Proposer refunded (CHALLENGER_WINS) | `normalModeCredit[proposer] = balance` | ### closeGame() and BondDistributionMode @@ -357,7 +360,7 @@ The `GameType` check (`parentGameType == GAME_TYPE`) ensures TEE games can only ### resolve() Parent Dependency - If parent exists and is still `IN_PROGRESS`: `resolve()` reverts with `ParentGameNotResolved` -- If parent resolved as `CHALLENGER_WINS`: child automatically resolves as `CHALLENGER_WINS` +- If parent resolved as `CHALLENGER_WINS`: child automatically resolves as `CHALLENGER_WINS`. If the child was challenged, the challenger gets all bonds. If the child was never challenged, the proposer's bond is refunded. - If parent resolved as `DEFENDER_WINS` (or no parent): normal resolution logic applies --- @@ -476,7 +479,7 @@ The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: ### Potential Risks -1. **Parent chain invalidation cascade**: If a parent game is resolved as CHALLENGER_WINS after child games are created, all children automatically resolve as CHALLENGER_WINS. This is correct behavior but could lead to unexpected bond losses if proposers build deep chains on top of an invalid parent. +1. **Parent chain invalidation cascade**: If a parent game is resolved as CHALLENGER_WINS after child games are created, all children automatically resolve as CHALLENGER_WINS. If the child was challenged, the challenger gets all bonds. If the child was never challenged, the proposer's bond is refunded (not burned to address(0)). 2. **No replay protection on prove()**: The same proof bytes can be submitted to different game instances if they happen to cover the same state range. This is not a vulnerability (the proof is still valid), but it means provers don't need unique proofs per game. From bd3c50d1b6838bb4c6f10e41772c7ede04df3888 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 14:36:33 +0800 Subject: [PATCH 09/24] refactor: replace AccessManager with inline PROPOSER/CHALLENGER immutables Simplify TeeDisputeGame access control to match PermissionedDisputeGame's pattern. Remove the external AccessManager contract (Ownable, whitelist mappings, O(n) fallback iteration) in favor of two immutable addresses set in the constructor with inline checks. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 69 ++++----- .../scripts/deploy/DeployTee.s.sol | 34 +---- .../src/dispute/tee/AccessManager.sol | 135 ------------------ .../src/dispute/tee/TeeDisputeGame.sol | 22 +-- .../test/dispute/tee/AccessManager.t.sol | 108 -------------- .../AnchorStateRegistryCompatibility.t.sol | 11 +- .../test/dispute/tee/TeeDisputeGame.t.sol | 11 +- .../tee/TeeDisputeGameIntegration.t.sol | 14 +- .../fork/DisputeGameFactoryRouterFork.t.sol | 11 +- 9 files changed, 60 insertions(+), 355 deletions(-) delete mode 100644 packages/contracts-bedrock/src/dispute/tee/AccessManager.sol delete mode 100644 packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index 728711d3de72b..2fe3dc90d8db1 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -42,10 +42,10 @@ TeeDisputeGame is a dispute game contract for the OP Stack that replaces interac +----------+ +----+----+ +----------+ v v v v +----------------+ +---------+ +------------------+ +---------------+ - | AccessManager | | Anchor | | TeeProofVerifier | | IDisputeGame | - | (proposer/ | | State | | (enclave ECDSA | | (interface) | - | challenger | | Registry| | verification) | | | - | whitelist) | | | +-------+----------+ +---------------+ + | PROPOSER / | | Anchor | | TeeProofVerifier | | IDisputeGame | + | CHALLENGER | | State | | (enclave ECDSA | | (interface) | + | (immutable | | Registry| | verification) | | | + | addresses) | | | +-------+----------+ +---------------+ +----------------+ +---------+ | v +------------------+ @@ -67,7 +67,8 @@ TeeDisputeGame is a dispute game contract for the OP Stack that replaces interac | `TEE_PROOF_VERIFIER` | `ITeeProofVerifier` | TEE signature verification contract | | `CHALLENGER_BOND` | `uint256` | Fixed bond amount required to challenge | | `ANCHOR_STATE_REGISTRY` | `IAnchorStateRegistry` | Anchor state management | -| `ACCESS_MANAGER` | `AccessManager` | Proposer/challenger whitelist | +| `PROPOSER` | `address` | Single allowed proposer address | +| `CHALLENGER` | `address` | Single allowed challenger address | ### Clone (CWIA) Data Layout @@ -179,7 +180,7 @@ The game is "over" (no more interactions) when the deadline passes OR a valid pr 1. **Not already initialized** -- reverts `AlreadyInitialized` 2. **Caller is the factory** -- reverts `IncorrectDisputeGameFactory` -3. **tx.origin is whitelisted proposer** (or permissionless mode active) -- reverts `BadAuth` +3. **tx.origin == PROPOSER** -- reverts `BadAuth` 4. **Calldata size is exactly 0xBE (190 bytes)** -- reverts with selector `0x9824bdab` (BadExtraData) 5. **rootClaim == keccak256(abi.encode(blockHash, stateHash))** -- reverts `RootClaimMismatch` 6. **Parent game validation** (if parentIndex != type(uint32).max): @@ -404,19 +405,16 @@ This differs from FaultDisputeGame where rootClaim is an output root hash direct ## 10. Access Control -### AccessManager Contract +### Inline Immutable Pattern -The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: +TeeDisputeGame uses simple immutable addresses for access control, matching PermissionedDisputeGame's pattern: -| Role | Storage | Check Function | Fallback | -|-------------|--------------------------------|----------------------------|---------------------------------------| -| Proposer | `mapping(address => bool) proposers` | `isAllowedProposer()` | Permissionless after `FALLBACK_TIMEOUT` since last TEE game creation | -| Challenger | `mapping(address => bool) challengers` | `isAllowedChallenger()` | Permissionless if `challengers[address(0)] == true` | +| Role | Storage | Check | +|-------------|-------------------------------|---------------------------------------------| +| Proposer | `address internal immutable PROPOSER` | `initialize()`: `if (tx.origin != PROPOSER) revert BadAuth();` | +| Challenger | `address internal immutable CHALLENGER` | `challenge()`: `if (msg.sender != CHALLENGER) revert BadAuth();` | -**Permissionless fallback for proposers:** -- `getLastProposalTimestamp()` iterates backwards through `DisputeGameFactory.gameAtIndex()` to find the most recent TEE game -- If `block.timestamp - lastProposalTimestamp > FALLBACK_TIMEOUT`, anyone can propose -- This prevents liveness failures if all whitelisted proposers go offline +Both addresses are set in the constructor and shared across all Clone instances. No external contract calls are needed for access control checks. ### TeeProofVerifier Roles @@ -431,11 +429,11 @@ The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: | Aspect | TeeDisputeGame | PermissionedDisputeGame | |----------------------------|----------------------------------------------|---------------------------------------------| -| Proposer check | `AccessManager.isAllowedProposer(tx.origin)` | `tx.origin == PROPOSER` (single address) | -| Challenger check | `AccessManager.isAllowedChallenger(msg.sender)` | `msg.sender == PROPOSER \|\| msg.sender == CHALLENGER` | -| Multiple proposers? | Yes (whitelist mapping) | No (single immutable address) | -| Permissionless fallback? | Yes (timeout-based) | No | -| Role management | External AccessManager contract | Immutable constructor params | +| Proposer check | `tx.origin != PROPOSER` (single address) | `tx.origin == PROPOSER` (single address) | +| Challenger check | `msg.sender != CHALLENGER` (single address) | `msg.sender == PROPOSER \|\| msg.sender == CHALLENGER` | +| Multiple proposers? | No (single immutable address) | No (single immutable address) | +| Permissionless fallback? | No | No | +| Role management | Immutable constructor params | Immutable constructor params | --- @@ -452,7 +450,7 @@ The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: | **Bond custody** | Native ETH in contract | DelayedWETH | DelayedWETH | | **Bond model** | Fixed challenger bond | Position-dependent bond curve | Position-dependent bond curve | | **Time model** | Fixed deadlines (challenge, prove) | Chess clock with extensions | Chess clock with extensions | -| **Access control** | AccessManager (whitelist + fallback) | Permissionless | Single proposer + challenger addresses | +| **Access control** | Single proposer + challenger addresses | Permissionless | Single proposer + challenger addresses | | **Parent chaining** | Explicit parentIndex in extraData | N/A (uses ASR anchor only) | N/A (uses ASR anchor only) | | **L2 block challenge** | N/A (blockHash in extraData) | `challengeRootL2Block()` + RLP proof | `challengeRootL2Block()` + RLP proof | | **ASR anchor source** | `anchors(GAME_TYPE)` (legacy path) | `getAnchorRoot()` (unified path) | `getAnchorRoot()` (unified path) | @@ -471,11 +469,11 @@ The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: 2. **TeeProofVerifier owner**: The owner can register arbitrary addresses as enclaves (the ZK proof verification is a trust gate, but the owner controls registration). A compromised owner could register a non-enclave address. -3. **AccessManager owner**: Controls who can propose and challenge. A compromised owner could remove all challengers, leaving invalid proposals unchallenged. +3. **Proposer/Challenger immutability**: The PROPOSER and CHALLENGER addresses are immutable constructor params. Changing them requires deploying a new implementation contract. 4. **Single challenge model**: Unlike FaultDisputeGame's multi-round bisection, only ONE challenger can challenge a proposal. If the challenger fails to follow through with a proof, the proposal is accepted. There is no mechanism for a second challenger. -5. **`tx.origin` usage**: `initialize()` checks `ACCESS_MANAGER.isAllowedProposer(tx.origin)`. Using `tx.origin` means the proposer's EOA is checked regardless of intermediate contracts, which is consistent with PermissionedDisputeGame but has known risks (e.g., meta-transaction relayers would inherit the tx.origin of the outer caller). +5. **`tx.origin` usage**: `initialize()` checks `tx.origin != PROPOSER`. Using `tx.origin` means the proposer's EOA is checked regardless of intermediate contracts, which is consistent with PermissionedDisputeGame but has known risks (e.g., meta-transaction relayers would inherit the tx.origin of the outer caller). ### Potential Risks @@ -487,9 +485,7 @@ The `AccessManager` (inherits OZ `Ownable`) manages two permission sets: 4. **Bond held as native ETH**: Unlike FaultDisputeGame which uses DelayedWETH for withdrawal delays, TeeDisputeGame holds ETH directly. The finality delay is enforced by `ASR.isGameFinalized()` instead. -5. **AccessManager fallback iteration**: `getLastProposalTimestamp()` iterates backwards through ALL games in the factory to find the last TEE game. This is O(n) and could become gas-expensive if there are many non-TEE games after the last TEE game. - -6. **Enclave registration root key comparison**: `TeeProofVerifier.register()` compares root keys via `keccak256(rootKey) != keccak256(expectedRootKey)`, which is correct but uses dynamic memory allocation for the hash. The `expectedRootKey` is stored as `bytes` (storage-heavy) rather than a `bytes32` hash. +5. **Enclave registration root key comparison**: `TeeProofVerifier.register()` compares root keys via `keccak256(rootKey) != keccak256(expectedRootKey)`, which is correct but uses dynamic memory allocation for the hash. The `expectedRootKey` is stored as `bytes` (storage-heavy) rather than a `bytes32` hash. --- @@ -536,33 +532,24 @@ bytes32 public immutable expectedRootKeyHash; // In register(): if (keccak256(rootKey) != expectedRootKeyHash) revert InvalidRootKey(); ``` -### 5. Optimize AccessManager.getLastProposalTimestamp() - -The backward iteration through all factory games is O(n). Consider caching the last proposal timestamp: - -```solidity -uint256 public lastProposalTimestamp; -// Updated by TeeDisputeGame.initialize() via a callback -``` - -### 6. Consider allowing multiple challengers +### 5. Consider allowing multiple challengers The current model allows only one challenger per game. If the first challenger colludes with the proposer (challenges but never provides proof), the game resolves in the challenger's favor, not a third party's. While the bond economics discourage this, allowing multiple challengers or a challenge-replacement mechanism would be more robust. -### 7. Use EIP-712 typed data for batchDigest +### 6. Use EIP-712 typed data for batchDigest The current `batchDigest` is a plain `keccak256(abi.encode(...))`. Using EIP-712 structured data would: - Prevent cross-contract replay if another contract uses the same digest scheme - Provide better wallet UX for TEE key management -### 8. Add explicit receive()/fallback() +### 7. Add explicit receive()/fallback() The contract accepts ETH via `initialize()` and `challenge()` (both `payable`), but has no `receive()` function. If ETH is accidentally sent directly, it will be lost. Consider adding a `receive()` that reverts. -### 9. Consider reentrancy guard on claimCredit() +### 8. Consider reentrancy guard on claimCredit() `claimCredit()` makes a low-level `call` to `_recipient` before the function completes. While credits are zeroed before the call, a reentrancy guard would be a defense-in-depth measure consistent with best practices. -### 10. Align resolve() checks with FaultDisputeGame +### 9. Align resolve() checks with FaultDisputeGame FaultDisputeGame uses `GameNotInProgress` error for the "already resolved" check. TeeDisputeGame uses `ClaimAlreadyResolved`. Consider using the same error for consistency, or renaming to avoid confusion (since `ClaimAlreadyResolved` is also used in FDG's `resolveClaim` with a different semantic meaning). diff --git a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol index 673aeeaac13c6..99dcad897ed31 100644 --- a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol +++ b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol @@ -7,7 +7,6 @@ import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol" import {Duration} from "src/dispute/lib/Types.sol"; import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {AccessManager} from "src/dispute/tee/AccessManager.sol"; import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; @@ -24,11 +23,10 @@ contract Deploy is Script { uint64 maxChallengeDuration; uint64 maxProveDuration; uint256 challengerBond; - uint256 fallbackTimeout; bool deployRouter; address proofVerifierOwner; - address[] proposers; - address[] challengers; + address proposer; + address challenger; uint256[] zoneIds; address[] routerFactories; address routerOwner; @@ -38,7 +36,6 @@ contract Deploy is Script { external returns ( TeeProofVerifier teeProofVerifier, - AccessManager accessManager, TeeDisputeGame teeDisputeGame, DisputeGameFactoryRouter router ) @@ -56,9 +53,6 @@ contract Deploy is Script { teeProofVerifier.transferOwnership(cfg.proofVerifierOwner); } - accessManager = new AccessManager(cfg.fallbackTimeout, cfg.disputeGameFactory); - _applyAllowlist(accessManager, cfg.proposers, cfg.challengers); - teeDisputeGame = new TeeDisputeGame( Duration.wrap(cfg.maxChallengeDuration), Duration.wrap(cfg.maxProveDuration), @@ -66,7 +60,8 @@ contract Deploy is Script { ITeeProofVerifier(address(teeProofVerifier)), cfg.challengerBond, cfg.anchorStateRegistry, - accessManager + cfg.proposer, + cfg.challenger ); if (cfg.deployRouter) { @@ -77,7 +72,6 @@ contract Deploy is Script { console2.log("deployer", cfg.deployer); console2.log("teeProofVerifier", address(teeProofVerifier)); - console2.log("accessManager", address(accessManager)); console2.log("teeDisputeGame", address(teeDisputeGame)); if (cfg.deployRouter) { console2.log("router", address(router)); @@ -95,31 +89,15 @@ contract Deploy is Script { cfg.maxChallengeDuration = uint64(vm.envUint("MAX_CHALLENGE_DURATION")); cfg.maxProveDuration = uint64(vm.envUint("MAX_PROVE_DURATION")); cfg.challengerBond = vm.envUint("CHALLENGER_BOND"); - cfg.fallbackTimeout = vm.envUint("FALLBACK_TIMEOUT"); cfg.deployRouter = vm.envOr("DEPLOY_ROUTER", false); cfg.proofVerifierOwner = vm.envOr("PROOF_VERIFIER_OWNER", cfg.deployer); - cfg.proposers = _envAddressArray("PROPOSERS"); - cfg.challengers = _envAddressArray("CHALLENGERS"); + cfg.proposer = vm.envAddress("PROPOSER"); + cfg.challenger = vm.envAddress("CHALLENGER"); cfg.zoneIds = _envUintArray("ROUTER_ZONE_IDS"); cfg.routerFactories = _envAddressArray("ROUTER_FACTORIES"); cfg.routerOwner = vm.envOr("ROUTER_OWNER", cfg.deployer); } - function _applyAllowlist( - AccessManager accessManager, - address[] memory proposers, - address[] memory challengers - ) - internal - { - for (uint256 i = 0; i < proposers.length; i++) { - accessManager.setProposer(proposers[i], true); - } - for (uint256 i = 0; i < challengers.length; i++) { - accessManager.setChallenger(challengers[i], true); - } - } - function _deployRouter( address routerOwner, address, diff --git a/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol b/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol deleted file mode 100644 index a28e1ae39e420..0000000000000 --- a/packages/contracts-bedrock/src/dispute/tee/AccessManager.sol +++ /dev/null @@ -1,135 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {GameType, Timestamp} from "src/dispute/lib/Types.sol"; - -/// @dev Game type constant for TEE Dispute Game. -uint32 constant TEE_DISPUTE_GAME_TYPE = 1960; - -/// @title AccessManager -/// @notice Manages permissions for dispute game proposers and challengers. -contract AccessManager is Ownable { - //////////////////////////////////////////////////////////////// - // Events // - //////////////////////////////////////////////////////////////// - - /// @notice Event emitted when proposer permissions are updated. - event ProposerPermissionUpdated(address indexed proposer, bool allowed); - - /// @notice Event emitted when challenger permissions are updated. - event ChallengerPermissionUpdated(address indexed challenger, bool allowed); - - //////////////////////////////////////////////////////////////// - // State Vars // - //////////////////////////////////////////////////////////////// - - /// @notice Tracks whitelisted proposers. - mapping(address => bool) public proposers; - - /// @notice Tracks whitelisted challengers. - mapping(address => bool) public challengers; - - /// @notice The timeout (in seconds) after which permissionless proposing is allowed (immutable). - uint256 public immutable FALLBACK_TIMEOUT; - - /// @notice The dispute game factory address. - IDisputeGameFactory public immutable DISPUTE_GAME_FACTORY; - - /// @notice The timestamp of this contract's creation. Used for permissionless fallback proposals. - uint256 public immutable DEPLOYMENT_TIMESTAMP; - - //////////////////////////////////////////////////////////////// - // Constructor // - //////////////////////////////////////////////////////////////// - - /// @notice Constructor sets the fallback timeout and initializes timestamp. - /// @param _fallbackTimeout The timeout in seconds after last proposal when permissionless mode activates. - /// @param _disputeGameFactory The dispute game factory address. - constructor(uint256 _fallbackTimeout, IDisputeGameFactory _disputeGameFactory) { - FALLBACK_TIMEOUT = _fallbackTimeout; - DISPUTE_GAME_FACTORY = _disputeGameFactory; - DEPLOYMENT_TIMESTAMP = block.timestamp; - } - - //////////////////////////////////////////////////////////////// - // Functions // - //////////////////////////////////////////////////////////////// - - /// @notice Allows the owner to whitelist or un-whitelist proposers. - /// @param _proposer The address to set in the proposers mapping. - /// @param _allowed True if whitelisting, false otherwise. - function setProposer(address _proposer, bool _allowed) external onlyOwner { - proposers[_proposer] = _allowed; - emit ProposerPermissionUpdated(_proposer, _allowed); - } - - /// @notice Allows the owner to whitelist or un-whitelist challengers. - /// @param _challenger The address to set in the challengers mapping. - /// @param _allowed True if whitelisting, false otherwise. - function setChallenger(address _challenger, bool _allowed) external onlyOwner { - challengers[_challenger] = _allowed; - emit ChallengerPermissionUpdated(_challenger, _allowed); - } - - /// @notice Returns the last proposal timestamp. - /// @return The last proposal timestamp. - function getLastProposalTimestamp() public view returns (uint256) { - GameType gameType = GameType.wrap(TEE_DISPUTE_GAME_TYPE); - uint256 numGames = DISPUTE_GAME_FACTORY.gameCount(); - - if (numGames == 0) { - return DEPLOYMENT_TIMESTAMP; - } - - uint256 i = numGames - 1; - while (true) { - (GameType gameTypeAtIndex, Timestamp timestamp,) = DISPUTE_GAME_FACTORY.gameAtIndex(i); - uint256 gameTimestamp = uint256(timestamp.raw()); - - if (gameTimestamp < DEPLOYMENT_TIMESTAMP) { - return DEPLOYMENT_TIMESTAMP; - } - - if (gameTypeAtIndex.raw() == gameType.raw()) { - return gameTimestamp; - } - - if (i == 0) { - break; - } - - unchecked { - --i; - } - } - - return DEPLOYMENT_TIMESTAMP; - } - - /// @notice Returns whether proposal fallback timeout has elapsed. - /// @return Whether permissionless proposing is active. - function isProposalPermissionlessMode() public view returns (bool) { - if (proposers[address(0)]) { - return true; - } - - uint256 lastProposalTimestamp = getLastProposalTimestamp(); - return block.timestamp - lastProposalTimestamp > FALLBACK_TIMEOUT; - } - - /// @notice Checks if an address is allowed to propose. - /// @param _proposer The address to check. - /// @return allowed_ Whether the address is allowed to propose. - function isAllowedProposer(address _proposer) external view returns (bool allowed_) { - allowed_ = proposers[_proposer] || isProposalPermissionlessMode(); - } - - /// @notice Checks if an address is allowed to challenge. - /// @param _challenger The address to check. - /// @return allowed_ Whether the address is allowed to challenge. - function isAllowedChallenger(address _challenger) external view returns (bool allowed_) { - allowed_ = challengers[address(0)] || challengers[_challenger]; - } -} diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index e4355bd41c97c..a72051d0db720 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -33,15 +33,15 @@ import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -// Contracts -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +/// @dev Game type constant for TEE Dispute Game. +uint32 constant TEE_DISPUTE_GAME_TYPE = 1960; /// @title TeeDisputeGame /// @notice A dispute game that uses TEE (AWS Nitro Enclave) ECDSA signatures /// instead of SP1 ZK proofs for batch state transition verification. /// @dev Mirrors OPSuccinctFaultDisputeGame architecture but replaces /// SP1_VERIFIER.verifyProof() with TEE_PROOF_VERIFIER.verifyBatch(). -/// Uses the same DisputeGameFactory, AnchorStateRegistry, and AccessManager +/// Uses the same DisputeGameFactory and AnchorStateRegistry /// infrastructure from OP Stack. /// /// prove() accepts multiple chained batch proofs to support the scenario @@ -117,7 +117,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { ITeeProofVerifier internal immutable TEE_PROOF_VERIFIER; uint256 internal immutable CHALLENGER_BOND; IAnchorStateRegistry internal immutable ANCHOR_STATE_REGISTRY; - AccessManager internal immutable ACCESS_MANAGER; + address internal immutable PROPOSER; + address internal immutable CHALLENGER; //////////////////////////////////////////////////////////////// // State Vars // @@ -152,7 +153,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { ITeeProofVerifier _teeProofVerifier, uint256 _challengerBond, IAnchorStateRegistry _anchorStateRegistry, - AccessManager _accessManager + address _proposer, + address _challenger ) { GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); MAX_CHALLENGE_DURATION = _maxChallengeDuration; @@ -161,7 +163,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { TEE_PROOF_VERIFIER = _teeProofVerifier; CHALLENGER_BOND = _challengerBond; ANCHOR_STATE_REGISTRY = _anchorStateRegistry; - ACCESS_MANAGER = _accessManager; + PROPOSER = _proposer; + CHALLENGER = _challenger; } //////////////////////////////////////////////////////////////// @@ -171,7 +174,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { function initialize() external payable virtual { if (initialized) revert AlreadyInitialized(); if (address(DISPUTE_GAME_FACTORY) != msg.sender) revert IncorrectDisputeGameFactory(); - if (!ACCESS_MANAGER.isAllowedProposer(tx.origin)) revert BadAuth(); + if (tx.origin != PROPOSER) revert BadAuth(); assembly { if iszero(eq(calldatasize(), 0xBE)) { @@ -235,7 +238,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { function challenge() external payable returns (ProposalStatus) { if (claimData.status != ProposalStatus.Unchallenged) revert ClaimAlreadyChallenged(); - if (!ACCESS_MANAGER.isAllowedChallenger(msg.sender)) revert BadAuth(); + if (msg.sender != CHALLENGER) revert BadAuth(); if (gameOver()) revert GameOver(); if (msg.value != CHALLENGER_BOND) revert IncorrectBondAmount(); @@ -481,7 +484,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { function teeProofVerifier() external view returns (ITeeProofVerifier) { return TEE_PROOF_VERIFIER; } function challengerBond() external view returns (uint256) { return CHALLENGER_BOND; } function anchorStateRegistry() external view returns (IAnchorStateRegistry) { return ANCHOR_STATE_REGISTRY; } - function accessManager() external view returns (AccessManager) { return ACCESS_MANAGER; } + function proposer_() external view returns (address) { return PROPOSER; } + function challenger_() external view returns (address) { return CHALLENGER; } //////////////////////////////////////////////////////////////// // Internal Functions // diff --git a/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol b/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol deleted file mode 100644 index 101ff6bfdbe2a..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/AccessManager.t.sol +++ /dev/null @@ -1,108 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Test} from "forge-std/Test.sol"; -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; -import {GameType, Claim, GameStatus} from "src/dispute/lib/Types.sol"; -import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; -import {MockStatusDisputeGame} from "test/dispute/tee/mocks/MockStatusDisputeGame.sol"; - -contract AccessManagerTest is Test { - uint256 internal constant FALLBACK_TIMEOUT = 7 days; - - MockDisputeGameFactory internal factory; - AccessManager internal accessManager; - - function setUp() public { - factory = new MockDisputeGameFactory(); - accessManager = new AccessManager(FALLBACK_TIMEOUT, IDisputeGameFactory(address(factory))); - } - - function test_getLastProposalTimestamp_returnsDeploymentTimestampWhenNoGames() public view { - assertEq(accessManager.getLastProposalTimestamp(), accessManager.DEPLOYMENT_TIMESTAMP()); - } - - function test_getLastProposalTimestamp_scansBackwardForLatestTeeGame() public { - factory.pushGame( - GameType.wrap(100), - uint64(block.timestamp + 1), - IDisputeGame(address(_mockGame(GameType.wrap(100), 1))), - Claim.wrap(bytes32(uint256(1))), - bytes("") - ); - factory.pushGame( - GameType.wrap(TEE_DISPUTE_GAME_TYPE), - uint64(block.timestamp + 2), - IDisputeGame(address(_mockGame(GameType.wrap(TEE_DISPUTE_GAME_TYPE), 2))), - Claim.wrap(bytes32(uint256(2))), - bytes("") - ); - factory.pushGame( - GameType.wrap(200), - uint64(block.timestamp + 3), - IDisputeGame(address(_mockGame(GameType.wrap(200), 3))), - Claim.wrap(bytes32(uint256(3))), - bytes("") - ); - - assertEq(accessManager.getLastProposalTimestamp(), block.timestamp + 2); - } - - function test_getLastProposalTimestamp_returnsDeploymentTimestampWhenLatestTeeGameIsOlderThanDeployment() - public - { - factory.pushGame( - GameType.wrap(TEE_DISPUTE_GAME_TYPE), - uint64(accessManager.DEPLOYMENT_TIMESTAMP() - 1), - IDisputeGame(address(_mockGame(GameType.wrap(TEE_DISPUTE_GAME_TYPE), 1))), - Claim.wrap(bytes32(uint256(1))), - bytes("") - ); - - assertEq(accessManager.getLastProposalTimestamp(), accessManager.DEPLOYMENT_TIMESTAMP()); - } - - function test_isProposalPermissionlessMode_activatesAfterFallbackTimeout() public { - vm.warp(block.timestamp + FALLBACK_TIMEOUT + 1); - assertTrue(accessManager.isProposalPermissionlessMode()); - } - - function test_isProposalPermissionlessMode_zeroAddressOverride() public { - accessManager.setProposer(address(0), true); - assertTrue(accessManager.isProposalPermissionlessMode()); - } - - function test_isAllowedProposer_returnsTrueForWhitelistedProposer() public { - address proposer = makeAddr("proposer"); - accessManager.setProposer(proposer, true); - assertTrue(accessManager.isAllowedProposer(proposer)); - } - - function test_isAllowedChallenger_respectsZeroAddressWildcard() public { - address challenger = makeAddr("challenger"); - accessManager.setChallenger(address(0), true); - assertTrue(accessManager.isAllowedChallenger(challenger)); - } - - function test_isAllowedChallenger_returnsFalseForUnlistedChallenger() public { - assertFalse(accessManager.isAllowedChallenger(makeAddr("challenger"))); - } - - function _mockGame(GameType gameType_, uint256 nonce) internal returns (MockStatusDisputeGame) { - return new MockStatusDisputeGame({ - creator_: vm.addr(nonce + 1), - gameType_: gameType_, - rootClaim_: Claim.wrap(bytes32(nonce)), - l2SequenceNumber_: nonce, - extraData_: bytes(""), - status_: GameStatus.IN_PROGRESS, - createdAt_: uint64(block.timestamp), - resolvedAt_: 0, - respected_: true, - anchorStateRegistry_: IAnchorStateRegistry(address(0)) - }); - } -} diff --git a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol index 7426c95c997dc..e5138037da835 100644 --- a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol @@ -7,8 +7,7 @@ import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; import {Claim, Duration, GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; @@ -28,7 +27,6 @@ contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { MockDisputeGameFactory internal factory; MockSystemConfig internal systemConfig; MockTeeProofVerifier internal teeProofVerifier; - AccessManager internal accessManager; TeeDisputeGame internal implementation; IAnchorStateRegistry internal anchorStateRegistry; @@ -67,10 +65,6 @@ contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { ); anchorStateRegistry = IAnchorStateRegistry(address(anchorStateRegistryProxy)); - accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); - accessManager.setProposer(proposer, true); - accessManager.setChallenger(challenger, true); - implementation = new TeeDisputeGame( Duration.wrap(MAX_CHALLENGE_DURATION), Duration.wrap(MAX_PROVE_DURATION), @@ -78,7 +72,8 @@ contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { ITeeProofVerifier(address(teeProofVerifier)), CHALLENGER_BOND, anchorStateRegistry, - accessManager + proposer, + challenger ); factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 627d68367575a..f50ffd54a68de 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -6,8 +6,7 @@ import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; +import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; import {BadAuth, GameNotFinalized, IncorrectBondAmount, UnexpectedRootClaim} from "src/dispute/lib/Errors.sol"; import { ClaimAlreadyChallenged, @@ -35,7 +34,6 @@ contract TeeDisputeGameTest is TeeTestUtils { MockDisputeGameFactory internal factory; MockAnchorStateRegistry internal anchorStateRegistry; MockTeeProofVerifier internal teeProofVerifier; - AccessManager internal accessManager; TeeDisputeGame internal implementation; address internal proposer; @@ -56,10 +54,6 @@ contract TeeDisputeGameTest is TeeTestUtils { anchorStateRegistry = new MockAnchorStateRegistry(); teeProofVerifier = new MockTeeProofVerifier(); - accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); - accessManager.setProposer(proposer, true); - accessManager.setChallenger(challenger, true); - implementation = new TeeDisputeGame( Duration.wrap(MAX_CHALLENGE_DURATION), Duration.wrap(MAX_PROVE_DURATION), @@ -67,7 +61,8 @@ contract TeeDisputeGameTest is TeeTestUtils { ITeeProofVerifier(address(teeProofVerifier)), CHALLENGER_BOND, IAnchorStateRegistry(address(anchorStateRegistry)), - accessManager + proposer, + challenger ); factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index c26e8c9331da6..0f36064f9c973 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -10,9 +10,8 @@ import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; import { BondDistributionMode, @@ -32,7 +31,7 @@ import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; /// @title TeeDisputeGameIntegrationTest /// @notice Integration tests for the full TEE dispute game lifecycle using real contracts. /// Only MockRiscZeroVerifier and MockSystemConfig are mocked; all core contracts -/// (DisputeGameFactory, AnchorStateRegistry, TeeProofVerifier, AccessManager) are real. +/// (DisputeGameFactory, AnchorStateRegistry, TeeProofVerifier) are real. contract TeeDisputeGameIntegrationTest is TeeTestUtils { uint256 internal constant DEFENDER_BOND = 1 ether; uint256 internal constant CHALLENGER_BOND = 2 ether; @@ -50,7 +49,6 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { DisputeGameFactory internal factory; AnchorStateRegistry internal anchorStateRegistry; TeeProofVerifier internal teeProofVerifier; - AccessManager internal accessManager; TeeDisputeGame internal implementation; address internal proposer; @@ -76,11 +74,6 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // --- Deploy real TeeProofVerifier (with MockRiscZeroVerifier) --- teeProofVerifier = _deployTeeProofVerifier(); - // --- Deploy real AccessManager --- - accessManager = new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(factory))); - accessManager.setProposer(proposer, true); - accessManager.setChallenger(challenger, true); - // --- Deploy TeeDisputeGame implementation --- implementation = new TeeDisputeGame( Duration.wrap(MAX_CHALLENGE_DURATION), @@ -89,7 +82,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { ITeeProofVerifier(address(teeProofVerifier)), CHALLENGER_BOND, IAnchorStateRegistry(address(anchorStateRegistry)), - accessManager + proposer, + challenger ); factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(implementation)), bytes("")); diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index 6d9c2b3c40af1..126eaab72d9d9 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -13,9 +13,8 @@ import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; -import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; -import {AccessManager, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/AccessManager.sol"; import {Claim, Duration, GameStatus, GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; @@ -205,11 +204,6 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { secondZone.anchorStateRegistry = _deployRealAnchorStateRegistry(secondZone.factory); (secondZone.teeProofVerifier, secondZone.registeredExecutor) = _deployRealTeeProofVerifier(); - AccessManager accessManager = - new AccessManager(MAX_CHALLENGE_DURATION, IDisputeGameFactory(address(secondZone.factory))); - accessManager.setProposer(allowedProposer, true); - accessManager.setChallenger(challenger, true); - secondZone.implementation = new TeeDisputeGame( Duration.wrap(MAX_CHALLENGE_DURATION), Duration.wrap(MAX_PROVE_DURATION), @@ -217,7 +211,8 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { ITeeProofVerifier(address(secondZone.teeProofVerifier)), CHALLENGER_BOND, IAnchorStateRegistry(address(secondZone.anchorStateRegistry)), - accessManager + allowedProposer, + challenger ); secondZone.factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(secondZone.implementation)), bytes("")); From 6f12abbcc8e39a8b649ee56871992cb49c1c090f Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 16:47:04 +0800 Subject: [PATCH 10/24] fix: restrict prove() to proposer and replace custom ownership with OZ Ownable M-01: Add `msg.sender != proposer` check to prove(), preventing frontrunning of prover credit. Simplify resolve() bond distribution since prover == proposer is now guaranteed. M-02: Replace TeeProofVerifier's custom ownership (state var, modifier, event, transferOwnership) with OpenZeppelin Ownable v4, which provides zero-address validation on transferOwnership out of the box. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../dispute/tee/AUDIT_REPORT_POST_REFACTOR.md | 278 ++++++++++++++++++ .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 4 +- .../src/dispute/tee/TeeDisputeGame.sol | 8 +- .../src/dispute/tee/TeeProofVerifier.sol | 25 +- .../AnchorStateRegistryCompatibility.t.sol | 1 + .../test/dispute/tee/TeeDisputeGame.t.sol | 38 +-- .../tee/TeeDisputeGameIntegration.t.sol | 54 +--- .../test/dispute/tee/TeeProofVerifier.t.sol | 7 +- 8 files changed, 306 insertions(+), 109 deletions(-) create mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md new file mode 100644 index 0000000000000..1f1dcf334190b --- /dev/null +++ b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md @@ -0,0 +1,278 @@ +# TeeDisputeGame -- Post-Refactor Security Audit Report + +**Audit Date:** 2026-03-23 +**Auditor:** Senior Solidity Security Review +**Commit:** `bd3c50d1b6` (branch `contract/tee-dispute-game`) +**Scope:** Post-refactor audit after replacing external `AccessManager` with inline immutable `PROPOSER`/`CHALLENGER` pattern. + +--- + +## 1. Scope + +| File | Description | +|------|-------------| +| `src/dispute/tee/TeeDisputeGame.sol` | Core dispute game contract | +| `src/dispute/tee/TeeProofVerifier.sol` | TEE enclave registration and batch signature verification | +| `src/dispute/tee/lib/Errors.sol` | Custom error definitions | +| `interfaces/dispute/ITeeProofVerifier.sol` | Verifier interface | +| `scripts/deploy/DeployTee.s.sol` | Deployment script | +| `test/dispute/tee/TeeDisputeGame.t.sol` | Unit tests | +| `test/dispute/tee/TeeDisputeGameIntegration.t.sol` | Integration tests | +| `test/dispute/tee/helpers/TeeTestUtils.sol` | Test utilities | +| `test/dispute/tee/mocks/MockTeeProofVerifier.sol` | Mock verifier | +| `test/dispute/tee/mocks/MockDisputeGameFactory.sol` | Mock factory | + +--- + +## 2. Executive Summary + +The TeeDisputeGame system implements a dispute game for OP Stack that substitutes traditional ZK proofs with TEE (Trusted Execution Environment) ECDSA signatures. The architecture is sound and follows established OP Stack dispute game patterns. + +The recent refactor replaced an external `AccessManager` contract (Ownable, whitelist mappings, O(n) fallback iteration) with inline immutable `PROPOSER`/`CHALLENGER` address checks, matching the `PermissionedDisputeGame` pattern. The refactor has been cleanly executed with **no remaining `AccessManager` references** in any TEE-related source file, test, or deploy script. + +The codebase demonstrates good security awareness: rootClaim integrity is verified at initialization, parent-child game chaining is properly validated, batch proof continuity is enforced on-chain, and bond distribution handles edge cases (including the previously-fixed C-02 parent-loses-child-unchallenged scenario). + +**Findings: 0 Critical | 0 High | 2 Medium | 3 Low | 5 Informational** + +--- + +## 3. Findings + +### M-01: `prove()` is Permissionless -- Any Account Can Claim Prover Credit + +**Severity:** Medium +**File:** `src/dispute/tee/TeeDisputeGame.sol:271-344` + +**Description:** +The `prove()` function has no access control. Any address can call it and become `claimData.prover`. While the TEE signature within each `BatchProof` must be valid (signed by a registered enclave), the `msg.sender` who submits the transaction is recorded as the prover and receives the challenger's bond in the `ChallengedAndValidProofProvided` resolution path. This means anyone who observes a valid proof in the mempool can frontrun the intended prover's transaction and steal the prover reward. + +**Impact:** +A MEV bot or frontrunner can extract the proof data from a pending transaction, submit it in their own transaction with higher gas, and receive the `CHALLENGER_BOND` reward that was meant for the legitimate prover. The proposer is unaffected (they still get their bond back), but the third-party prover economic incentive is undermined. + +**Affected Code:** Line 334: `claimData.prover = msg.sender` + +**Recommendation:** +Consider one of: +1. Require that the prover is either the proposer or a registered enclave address recovered from the signature. +2. Use a commit-reveal scheme for proof submission. +3. Document the frontrunning risk as accepted, since the proposer (who is likely the intended prover) can always prove as themselves. + +--- + +### M-02: `TeeProofVerifier.transferOwnership()` Lacks Zero-Address Check + +**Severity:** Medium +**File:** `src/dispute/tee/TeeProofVerifier.sol:184-188` + +**Description:** +The `transferOwnership()` function does not validate that `newOwner != address(0)`. If the owner accidentally passes `address(0)`, ownership is irrecoverably lost, and no new enclaves can be registered or revoked. + +**Impact:** +Permanent loss of admin control over the verifier contract. No new TEE enclaves can be registered, and compromised enclaves cannot be revoked. This effectively bricks the security model of the entire system since enclave lifecycle management is the critical trust boundary. + +**Recommendation:** +Add a zero-address check: +```solidity +function transferOwnership(address newOwner) external onlyOwner { + if (newOwner == address(0)) revert Unauthorized(); + address oldOwner = owner; + owner = newOwner; + emit OwnerTransferred(oldOwner, newOwner); +} +``` + +--- + +### L-01: `tx.origin` Used for Proposer Authentication + +**Severity:** Low +**File:** `src/dispute/tee/TeeDisputeGame.sol:177,228` + +**Description:** +The `initialize()` function uses `tx.origin` for access control (`if (tx.origin != PROPOSER) revert BadAuth()`) and bond credit attribution (`proposer = tx.origin`). While `tx.origin` is necessary to identify the proposer EOA through intermediate contracts (Factory, Router), it means smart contract wallets (e.g., Safe multisigs, ERC-4337 account abstractions) cannot act as proposers. + +**Impact:** +Deliberate design choice aligned with OP Stack permissioned games, but limits future flexibility. The `tx.origin` usage is safe against reentrancy in this context since it's only checked during initialization. + +**Recommendation:** +This is documented and intentional. For future-proofing, consider supporting an alternative authentication mechanism (e.g., an optional `_proposer` parameter in the factory's `create()` calldata) to allow smart contract wallets. + +--- + +### L-02: `_extractAddress` Uses Memory Loop Instead of Assembly + +**Severity:** Low (Gas) +**File:** `src/dispute/tee/TeeProofVerifier.sol:229-235` + +**Description:** +`TeeProofVerifier._extractAddress()` copies 64 bytes from the public key using a Solidity for-loop, which is significantly more expensive than an assembly-based approach. + +**Impact:** +Wasted gas on every `register()` call. The function is owner-only and called infrequently, so the practical impact is minimal. + +**Recommendation:** +Replace the loop with: +```solidity +function _extractAddress(bytes memory publicKey) internal pure returns (address) { + bytes32 hash; + assembly { + hash := keccak256(add(publicKey, 33), 64) + } + return address(uint160(uint256(hash))); +} +``` + +--- + +### L-03: `expectedRootKey` Is Not Immutable + +**Severity:** Low +**File:** `src/dispute/tee/TeeProofVerifier.sol:32` + +**Description:** +`expectedRootKey` is declared as `bytes public` rather than as an immutable. While it is only set in the constructor and has no setter, it occupies storage slots and requires SLOAD on every `register()` call. + +**Impact:** +Minor gas overhead on `register()` calls. No security impact since there is no setter. + +**Recommendation:** +Since `bytes` cannot be `immutable` in Solidity, consider storing `keccak256(expectedRootKey)` as an `immutable bytes32` and comparing against that hash in `register()`, avoiding the storage read entirely. + +--- + +### I-01: Unused Error `ClaimNotChallenged` in `lib/Errors.sol` + +**Severity:** Informational +**File:** `src/dispute/tee/lib/Errors.sol:33` + +**Description:** +The error `ClaimNotChallenged()` is defined but never used in `TeeDisputeGame.sol`. Appears to be a remnant from a previous design. + +**Recommendation:** Remove the unused error. + +--- + +### I-02: Unused Error `UnexpectedGameType` in `lib/Errors.sol` + +**Severity:** Informational +**File:** `src/dispute/tee/lib/Errors.sol:12` + +**Description:** +The error `UnexpectedGameType()` is defined but never referenced. The game type mismatch during initialization uses `InvalidParentGame` instead. + +**Recommendation:** Remove the unused error. + +--- + +### I-03: `closeGame()` Silently Ignores `setAnchorState` Failures + +**Severity:** Informational +**File:** `src/dispute/tee/TeeDisputeGame.sol:425` + +**Description:** +The call to `ANCHOR_STATE_REGISTRY.setAnchorState()` is wrapped in a try-catch that silently swallows all errors. This is intentional (a `CHALLENGER_WINS` game should not update the anchor), but unexpected revert reasons are also silently ignored. + +**Recommendation:** Consider emitting an event on failure for off-chain observability, or adding a comment clarifying the expected failure cases. + +--- + +### I-04: No `receive()` / `fallback()` Function + +**Severity:** Informational +**File:** `src/dispute/tee/TeeDisputeGame.sol` + +**Description:** +The contract has no `receive()` or `fallback()`. ETH enters only through `initialize()` and `challenge()`. This prevents accidental ETH deposits, which is the correct behavior. + +**Impact:** None in the current design. + +**Recommendation:** No change needed. This is the correct design. + +--- + +### I-05: AccessManager Refactor Completeness + +**Severity:** Informational + +**Description:** +A comprehensive search for `AccessManager` across all TEE-related source files (`src/dispute/tee/`, `test/dispute/tee/`, `scripts/deploy/DeployTee.s.sol`) returned **zero matches**. The only `AccessManager` references in the repository are in OpenZeppelin's own library files (`lib/openzeppelin-contracts-v5/`), which are unrelated third-party code. + +The refactor from an external `AccessManager` to inline immutable `PROPOSER`/`CHALLENGER` checks is complete and clean. + +**Recommendation:** No action needed. + +--- + +## 4. Architecture Review + +### Overall Design + +The system follows a well-established pattern from the OP Stack dispute game framework: + +1. **Clone (CWIA) Pattern**: Games are deployed as minimal clones via `LibClone.clone()` with immutable arguments appended to the bytecode. The calldatasize check at line 180 requires exactly `0xBE` (190 bytes), which is verified correct: 4-byte selector + 0xB8 bytes clone data + 0x02 Solady length suffix. + +2. **Two-Layer Trust Model**: TEE enclave identity is established via ZK proof of Nitro attestation (one-time registration), while batch correctness is verified via ECDSA signature (per-game). This separation is clean and appropriate. + +3. **State Machine**: The `ProposalStatus` enum has five states with well-defined transitions: + - `Unchallenged` -> `Challenged` (via `challenge()`) + - `Unchallenged` -> `UnchallengedAndValidProofProvided` (via `prove()`) + - `Challenged` -> `ChallengedAndValidProofProvided` (via `prove()`) + - Any non-Resolved -> `Resolved` (via `resolve()`) + + Transitions are correctly enforced. There is no way to go from a proved state back to unproved. + +4. **Parent-Child Chaining**: The parent game validation in `initialize()` correctly checks game type, respected/blacklisted/retired status, and rejects `CHALLENGER_WINS` parents. The `resolve()` function properly short-circuits when a parent has been invalidated, with the fix for C-02 (crediting proposer instead of `address(0)` when child is unchallenged and parent loses). + +5. **Bond Distribution**: The dual `normalModeCredit`/`refundModeCredit` pattern with lazy `closeGame()` determination is sound. Credits are zeroed before ETH transfer, preventing reentrancy. + +### Positive Security Properties + +- **Reentrancy-safe**: `claimCredit()` follows checks-effects-interactions -- zeroes both credit mappings *before* the ETH transfer. +- **Double-resolve prevention**: `resolve()` checks `status != GameStatus.IN_PROGRESS` at entry. +- **Double-prove prevention**: `gameOver()` returns true once `claimData.prover != address(0)`, so `prove()` cannot be called twice. +- **Cross-chain isolation**: Parent games are validated by `GameType`, preventing cross-type parent references. Integration tests explicitly verify this. +- **Bond accounting**: `address(this).balance` is used as the total pool in `resolve()`, correctly capturing all deposited bonds. +- **Access control refactor**: The new inline `PROPOSER`/`CHALLENGER` immutable pattern is simpler, cheaper (no external call overhead), and eliminates the O(n) `getLastProposalTimestamp()` DoS vector from the prior `AccessManager`. + +--- + +## 5. Gas Optimizations + +| ID | Description | Estimated Savings | Location | +|----|-------------|-------------------|----------| +| G-01 | `_extractAddress` loop can be replaced with assembly (see L-02) | ~400 gas per `register()` | `TeeProofVerifier.sol:230-233` | +| G-02 | `prove()` recomputes `proofs.length` on every loop iteration; cache in a local variable | ~20 gas per batch | `TeeDisputeGame.sol:289` | +| G-03 | `keccak256(rootKey) != keccak256(expectedRootKey)` computes two hashes; store `keccak256(expectedRootKey)` as immutable `bytes32` | ~200 gas per `register()` | `TeeProofVerifier.sol:114` | +| G-04 | `claimData` is read from storage multiple times in `resolve()`; cache the full struct in memory | ~200 gas per `resolve()` | `TeeDisputeGame.sol:346-389` | +| G-05 | In `prove()`, `startingOutputRoot` is an SLOAD; consider caching it | ~100 gas | `TeeDisputeGame.sol:281,287` | + +Overall gas efficiency is reasonable. The primary gas cost is in the `prove()` loop which involves per-batch `keccak256` + external call to `TEE_PROOF_VERIFIER.verifyBatch()` + `ecrecover`. These are inherent to the verification logic and cannot be meaningfully reduced. + +--- + +## 6. Summary Table + +| ID | Severity | Title | Status | +|------|----------------|--------------------------------------------------------------------|---------------| +| M-01 | Medium | `prove()` is permissionless -- prover credit is frontrunnable | Fixed | +| M-02 | Medium | `TeeProofVerifier.transferOwnership()` lacks zero-address check | Fixed | +| L-01 | Low | `tx.origin` used for proposer authentication | Acknowledged | +| L-02 | Low | `_extractAddress` uses memory loop instead of assembly | Open | +| L-03 | Low | `expectedRootKey` is not immutable | Open | +| I-01 | Informational | Unused error `ClaimNotChallenged` in `lib/Errors.sol` | Open | +| I-02 | Informational | Unused error `UnexpectedGameType` in `lib/Errors.sol` | Open | +| I-03 | Informational | `closeGame()` silently ignores `setAnchorState` failures | Acknowledged | +| I-04 | Informational | No `receive()`/`fallback()` function | By Design | +| I-05 | Informational | AccessManager refactor completeness -- zero remaining references | Confirmed | + +--- + +## 7. Conclusion + +The TeeDisputeGame system is well-designed and demonstrates strong security engineering. The codebase is clean, well-commented, and follows established OP Stack patterns. The AccessManager-to-immutable refactor has been executed completely with no residual references. + +The two Medium findings (frontrunnable prover credit and missing zero-address check on ownership transfer) are the most actionable. The Low and Informational findings are minor improvements. + +Test coverage is comprehensive, including both unit tests with mocks and integration tests with real contracts, covering the full game lifecycle, parent-child chains, cross-chain isolation, bond distribution modes, and error paths. + +**Overall Assessment: The contract is well-suited for deployment with the recommended mitigations applied.** The core security properties -- bond safety, state machine correctness, proof verification integrity, and access control -- are sound. diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index 2fe3dc90d8db1..d44f81bc454ff 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -230,7 +230,7 @@ The game is "over" (no more interactions) when the deadline passes OR a valid pr - Verifies chain of batch proofs (see Section 6) - Records `prover = msg.sender` - No bond required from prover -- Anyone can call prove() (no access control), but TEE signature must be from registered enclave +- Only the proposer can call `prove()` (`if (msg.sender != proposer) revert BadAuth()`) — this prevents frontrunning attacks where a third party could steal prover credit by submitting observed proof data - Once proved, `gameOver()` returns true, which blocks further `challenge()` calls — this is intentional since a valid TEE proof confirms the claim is correct --- @@ -306,7 +306,7 @@ batchDigest = keccak256(abi.encode( | Unchallenged (deadline expired) | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | | Challenged (deadline expired, no proof) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | | UnchallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | -| ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | If prover == proposer: `normalModeCredit[prover] = balance`
Else: `normalModeCredit[prover] = CHALLENGER_BOND`, `normalModeCredit[proposer] = balance - CHALLENGER_BOND` | +| ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` (proposer gets all bonds since only proposer can prove) | | Parent game CHALLENGER_WINS (child challenged) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | | Parent game CHALLENGER_WINS (child unchallenged) | Proposer refunded (CHALLENGER_WINS) | `normalModeCredit[proposer] = balance` | diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index a72051d0db720..16e94eaa8ec73 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -269,6 +269,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { /// 6. Each batch's TEE signature is valid (via TEE_PROOF_VERIFIER) /// @param proofBytes ABI-encoded BatchProof[] array function prove(bytes calldata proofBytes) external returns (ProposalStatus) { + if (msg.sender != proposer) revert BadAuth(); if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved(); if (gameOver()) revert GameOver(); @@ -370,12 +371,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { normalModeCredit[proposer] = address(this).balance; } else if (claimData.status == ProposalStatus.ChallengedAndValidProofProvided) { status = GameStatus.DEFENDER_WINS; - if (claimData.prover == proposer) { - normalModeCredit[claimData.prover] = address(this).balance; - } else { - normalModeCredit[claimData.prover] = CHALLENGER_BOND; - normalModeCredit[proposer] = address(this).balance - CHALLENGER_BOND; - } + normalModeCredit[proposer] = address(this).balance; } else { revert InvalidProposalStatus(); } diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol index 9b1713d39fe2b..b887cdbf37a22 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -3,6 +3,7 @@ pragma solidity ^0.8.15; import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; +import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; /// @title TEE Proof Verifier for OP Stack DisputeGame /// @notice Verifies TEE enclave identity via ZK proof (owner-gated registration) and @@ -19,7 +20,7 @@ import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; /// - pubkey_len bytes: pubkey (secp256k1 uncompressed, 65 bytes) /// - 2 bytes: user_data_len (big-endian uint16) /// - user_data_len bytes: user_data -contract TeeProofVerifier { +contract TeeProofVerifier is Ownable { // ============ Immutables ============ /// @notice RISC Zero Groth16 verifier (only called during registration) @@ -41,9 +42,6 @@ contract TeeProofVerifier { /// @notice Registered enclaves: EOA address => enclave info mapping(address => EnclaveInfo) public registeredEnclaves; - /// @notice Contract owner (can register and revoke enclaves) - address public owner; - // ============ Events ============ event EnclaveRegistered( @@ -52,8 +50,6 @@ contract TeeProofVerifier { event EnclaveRevoked(address indexed enclaveAddress); - event OwnerTransferred(address indexed oldOwner, address indexed newOwner); - // ============ Errors ============ error InvalidProof(); @@ -62,14 +58,6 @@ contract TeeProofVerifier { error EnclaveAlreadyRegistered(); error EnclaveNotRegistered(); error InvalidSignature(); - error Unauthorized(); - - // ============ Modifiers ============ - - modifier onlyOwner() { - if (msg.sender != owner) revert Unauthorized(); - _; - } // ============ Constructor ============ @@ -84,7 +72,6 @@ contract TeeProofVerifier { riscZeroVerifier = _riscZeroVerifier; imageId = _imageId; expectedRootKey = _rootKey; - owner = msg.sender; } // ============ Registration (Owner Only) ============ @@ -179,14 +166,6 @@ contract TeeProofVerifier { emit EnclaveRevoked(enclaveAddress); } - /// @notice Transfer ownership - /// @param newOwner The new owner address - function transferOwnership(address newOwner) external onlyOwner { - address oldOwner = owner; - owner = newOwner; - emit OwnerTransferred(oldOwner, newOwner); - } - // ============ Internal Functions ============ /// @notice Parse the journal bytes into attestation fields diff --git a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol index e5138037da835..25e1fd87e331e 100644 --- a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol @@ -101,6 +101,7 @@ contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); game.prove(abi.encode(proofs)); game.resolve(); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index f50ffd54a68de..8b90f7ba6fcd4 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -39,13 +39,11 @@ contract TeeDisputeGameTest is TeeTestUtils { address internal proposer; address internal challenger; address internal executor; - address internal thirdPartyProver; function setUp() public { proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; - thirdPartyProver = makeWallet(DEFAULT_THIRD_PARTY_PROVER_KEY, "third-party-prover").addr; vm.deal(proposer, 100 ether); vm.deal(challenger, 100 ether); @@ -241,9 +239,10 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); TeeDisputeGame.ProposalStatus status = game.prove(abi.encode(proofs)); (, , address prover,, TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); - assertEq(prover, address(this)); + assertEq(prover, proposer); assertEq(uint8(status), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); assertEq(uint8(storedStatus), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); } @@ -280,6 +279,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); TeeDisputeGame.ProposalStatus status = game.prove(abi.encode(proofs)); assertEq(uint8(status), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); } @@ -287,6 +287,7 @@ contract TeeDisputeGameTest is TeeTestUtils { function test_prove_revertEmptyBatchProofs() public { (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + vm.prank(proposer); vm.expectRevert(TeeDisputeGame.EmptyBatchProofs.selector); game.prove(abi.encode(new TeeDisputeGame.BatchProof[](0))); } @@ -310,6 +311,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); vm.expectRevert( abi.encodeWithSelector( TeeDisputeGame.StartHashMismatch.selector, @@ -349,6 +351,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); vm.expectRevert(abi.encodeWithSelector(TeeDisputeGame.BatchChainBreak.selector, 1)); game.prove(abi.encode(proofs)); } @@ -384,6 +387,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); vm.expectRevert(abi.encodeWithSelector(TeeDisputeGame.BatchBlockNotIncreasing.selector, 1, ANCHOR_L2_BLOCK + 4, ANCHOR_L2_BLOCK + 4)); game.prove(abi.encode(proofs)); } @@ -407,6 +411,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); vm.expectRevert( abi.encodeWithSelector( TeeDisputeGame.FinalHashMismatch.selector, @@ -439,6 +444,7 @@ contract TeeDisputeGameTest is TeeTestUtils { vm.expectRevert( abi.encodeWithSelector(TeeDisputeGame.FinalBlockMismatch.selector, game.l2SequenceNumber(), game.l2SequenceNumber() - 1) ); + vm.prank(proposer); game.prove(abi.encode(proofs)); } @@ -460,6 +466,7 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); + vm.prank(proposer); vm.expectRevert(MockTeeProofVerifier.EnclaveNotRegistered.selector); game.prove(abi.encode(proofs)); } @@ -541,15 +548,12 @@ contract TeeDisputeGameTest is TeeTestUtils { assertEq(child.normalModeCredit(challenger), DEFENDER_BOND + CHALLENGER_BOND); } - function test_resolve_challengedWithThirdPartyProverSplitsCreditAndClaimCredit() public { + function test_prove_revertUnauthorizedProver() public { bytes32 endBlockHash = keccak256("end-block"); bytes32 endStateHash = keccak256("end-state"); (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); - vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); - teeProofVerifier.setRegistered(executor, true); TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); proofs[0] = buildBatchProof( @@ -563,24 +567,10 @@ contract TeeDisputeGameTest is TeeTestUtils { DEFAULT_EXECUTOR_KEY ); - vm.prank(thirdPartyProver); + address unauthorized = makeAddr("unauthorized"); + vm.prank(unauthorized); + vm.expectRevert(BadAuth.selector); game.prove(abi.encode(proofs)); - - assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); - assertEq(game.normalModeCredit(thirdPartyProver), CHALLENGER_BOND); - assertEq(game.normalModeCredit(proposer), DEFENDER_BOND); - - // Simulate finality: game is proper and finalized (DEFENDER_WINS, not blacklisted) - anchorStateRegistry.setGameFlags(game, true, true, false, false, true, true, true); - - uint256 proposerBalanceBefore = proposer.balance; - uint256 proverBalanceBefore = thirdPartyProver.balance; - game.claimCredit(proposer); - game.claimCredit(thirdPartyProver); - - assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); - assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); - assertEq(thirdPartyProver.balance, proverBalanceBefore + CHALLENGER_BOND); } /// @notice CHALLENGER_WINS in NORMAL mode: challenger takes all bonds, proposer gets nothing. diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index 0f36064f9c973..5ac8cba87a985 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -54,13 +54,11 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { address internal proposer; address internal challenger; address internal executor; - address internal thirdPartyProver; function setUp() public { proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; - thirdPartyProver = makeWallet(DEFAULT_THIRD_PARTY_PROVER_KEY, "third-party-prover").addr; vm.deal(proposer, 100 ether); vm.deal(challenger, 100 ether); @@ -170,57 +168,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { } //////////////////////////////////////////////////////////////// - // Test 3: Challenged + Third-Party Proves → Bond Split // - //////////////////////////////////////////////////////////////// - - /// @notice create → challenge → third-party proves → resolve → claimCredit (proposer + prover) - function test_lifecycle_challenged_proveByThirdParty_bondSplit() public { - bytes32 endBlockHash = keccak256("end-block"); - bytes32 endStateHash = keccak256("end-state"); - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); - - // Challenger challenges - vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); - - // Third-party prover proves - TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); - proofs[0] = buildBatchProof( - BatchInput({ - startBlockHash: ANCHOR_BLOCK_HASH, - startStateHash: ANCHOR_STATE_HASH, - endBlockHash: endBlockHash, - endStateHash: endStateHash, - l2Block: game.l2SequenceNumber() - }), - DEFAULT_EXECUTOR_KEY - ); - - vm.prank(thirdPartyProver); - game.prove(abi.encode(proofs)); - - // Resolve — third-party proved → DEFENDER_WINS with split - assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); - assertEq(game.normalModeCredit(proposer), DEFENDER_BOND); - assertEq(game.normalModeCredit(thirdPartyProver), CHALLENGER_BOND); - - // Wait for finality - vm.warp(block.timestamp + 1); - - // Both claim credit - uint256 proposerBalanceBefore = proposer.balance; - uint256 proverBalanceBefore = thirdPartyProver.balance; - game.claimCredit(proposer); - game.claimCredit(thirdPartyProver); - - assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); - assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND); - assertEq(thirdPartyProver.balance, proverBalanceBefore + CHALLENGER_BOND); - assertEq(address(anchorStateRegistry.anchorGame()), address(game)); - } - - //////////////////////////////////////////////////////////////// - // Test 4: Challenged + Timeout → CHALLENGER_WINS → NORMAL // + // Test 3: Challenged + Timeout → CHALLENGER_WINS → NORMAL // //////////////////////////////////////////////////////////////// /// @notice create → challenge → (no prove) → timeout → resolve → NORMAL → challenger takes all diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol index 2ab9d04482384..7254b8982acb5 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -37,7 +37,7 @@ contract TeeProofVerifierTest is TeeTestUtils { bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); vm.prank(makeAddr("attacker")); - vm.expectRevert(TeeProofVerifier.Unauthorized.selector); + vm.expectRevert("Ownable: caller is not the owner"); verifier.register(hex"1234", journal); } @@ -123,4 +123,9 @@ contract TeeProofVerifierTest is TeeTestUtils { verifier.transferOwnership(newOwner); assertEq(verifier.owner(), newOwner); } + + function test_transferOwnership_revertZeroAddress() public { + vm.expectRevert("Ownable: new owner is the zero address"); + verifier.transferOwnership(address(0)); + } } From 1caba777663707adb3decb4cc0383f6858585523 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 17:50:54 +0800 Subject: [PATCH 11/24] docs: add final audit report for M-01 and M-02 fix verification Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/AUDIT_REPORT_FINAL.md | 191 ++++++++++++++++++ 1 file changed, 191 insertions(+) create mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md new file mode 100644 index 0000000000000..3803ba9eddb41 --- /dev/null +++ b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md @@ -0,0 +1,191 @@ +# TeeDisputeGame -- Final Audit Report (Fix Verification) + +**Audit Date:** 2026-03-23 +**Auditor:** Senior Solidity Security Review +**Fix Commit:** `6f12abbcc8` (branch `contract/tee-dispute-game`) +**Base Audit:** Post-Refactor Audit Report at commit `bd3c50d1b6` +**Scope:** Verification of fixes for findings M-01 and M-02 from the post-refactor audit, plus review for newly introduced issues. + +--- + +## 1. Executive Summary + +The post-refactor audit identified two Medium-severity findings: + +- **M-01**: `prove()` was permissionless, allowing frontrunning of prover credit (CHALLENGER_BOND). +- **M-02**: `TeeProofVerifier.transferOwnership()` lacked a zero-address check; the custom ownership pattern was fragile. + +Both findings have been **fully and correctly fixed** in commit `6f12abbcc8`. The M-01 fix restricts `prove()` to the proposer via `msg.sender` check and simplifies the `resolve()` bond distribution. The M-02 fix replaces the custom ownership implementation with OpenZeppelin Ownable v4, which provides built-in zero-address validation and a battle-tested ownership model. + +One new low-severity observation is noted regarding the inherited `renounceOwnership()` function. No critical, high, or medium issues were introduced by the fixes. + +**Verdict: All Medium findings are resolved. The fixes are correct, complete, and well-tested.** + +--- + +## 2. Finding Verification + +### M-01: `prove()` is Permissionless -- Prover Credit Frontrunnable + +**Original Finding:** Any address could call `prove()` and be recorded as `claimData.prover`, allowing MEV bots to frontrun legitimate provers and steal the CHALLENGER_BOND reward in the `ChallengedAndValidProofProvided` resolution path. + +**Fix Applied:** + +In `TeeDisputeGame.sol`, line 272: + +```solidity +function prove(bytes calldata proofBytes) external returns (ProposalStatus) { + if (msg.sender != proposer) revert BadAuth(); + ... +``` + +The `proposer` state variable is set to `tx.origin` during `initialize()`, so only the original proposer EOA can call `prove()`. + +Additionally, `resolve()` bond distribution was simplified. Since `prover == proposer` is now guaranteed, the `ChallengedAndValidProofProvided` case awards `normalModeCredit[proposer] = address(this).balance` -- the proposer receives both their own bond and the challenger's bond. There is no longer a need for a separate prover/proposer split or third-party prover logic. + +**Verification:** + +1. **Access control correctness**: The `msg.sender != proposer` check uses the `proposer` state variable (set from `tx.origin` in `initialize()`), not the `PROPOSER` immutable. This is correct because it checks against the actual proposer of this specific game instance. The `BadAuth` error is the same error used for other access control checks in the contract, maintaining consistency. + +2. **State machine interaction**: The `BadAuth` revert occurs before any state mutation, so a rejected `prove()` call has no side effects. The check is positioned after `status != GameStatus.IN_PROGRESS` and before `gameOver()`, which is the correct ordering -- rejecting unauthorized callers early. + +3. **Bond distribution correctness in all resolve() paths**: + - `Unchallenged`: proposer gets `balance` (only proposer bond in contract). Correct. + - `Challenged` (no proof, timeout): challenger gets `balance` (proposer bond + challenger bond). Correct. + - `UnchallengedAndValidProofProvided`: proposer gets `balance`. Correct. + - `ChallengedAndValidProofProvided`: proposer gets `balance` (proposer bond + challenger bond). Correct -- proposer proved, so they win the challenger's bond. + - Parent `CHALLENGER_WINS` with child challenged: challenger gets `balance`. Correct. + - Parent `CHALLENGER_WINS` with child unchallenged: proposer gets `balance` (refund). Correct. + +4. **No remaining third-party prover references**: Searched for `thirdPartyProver`, `bond split`, and related terms across all TEE source and test files -- zero matches. + +5. **Test coverage**: `test_prove_revertUnauthorizedProver` explicitly tests that a non-proposer address receives `BadAuth`. The existing `test_prove_succeedsWithSingleBatch` and `test_prove_succeedsWithChainedBatches` tests call `prove()` via `vm.prank(proposer)`, confirming the happy path. Integration tests (`test_lifecycle_challenged_proveByProposer_defenderWins`, `test_lifecycle_viaRouter_fullCycle`) exercise the full lifecycle with proposer-only proving. + +**Status: FIXED** -- The fix fully addresses the finding with no residual risk. + +--- + +### M-02: `TeeProofVerifier.transferOwnership()` Lacks Zero-Address Check + +**Original Finding:** The custom `transferOwnership()` function did not validate `newOwner != address(0)`, risking irrecoverable loss of admin control over enclave registration and revocation. + +**Fix Applied:** + +The entire custom ownership implementation (state variable `owner`, `Unauthorized` error, `OwnerTransferred` event, `onlyOwner` modifier, and `transferOwnership()` function) was removed and replaced with inheritance from OpenZeppelin Ownable v4 (`@openzeppelin/contracts/access/Ownable.sol`): + +```solidity +import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; + +contract TeeProofVerifier is Ownable { + ... +} +``` + +**Verification:** + +1. **Zero-address protection**: OpenZeppelin Ownable v4's `transferOwnership()` includes `require(newOwner != address(0), "Ownable: new owner is the zero address")`. This is tested in `test_transferOwnership_revertZeroAddress` which expects the revert string `"Ownable: new owner is the zero address"`. + +2. **Constructor behavior**: OZ Ownable v4's constructor calls `_transferOwnership(_msgSender())`, setting the deployer as the initial owner. Since `TeeProofVerifier`'s constructor does not pass an explicit owner, the deployer address is used. This matches the previous behavior where `owner = msg.sender` was set in the constructor. + +3. **Storage layout**: OZ Ownable v4 uses a single `address private _owner` slot. The previous custom implementation also used a single `address public owner` slot. Since `TeeProofVerifier` is not upgradeable (no proxy), storage layout conflicts are not a concern. The visibility change from `public` to `private` (with a `public owner()` getter) is functionally equivalent. + +4. **Event name change**: The custom `OwnerTransferred(address, address)` event is replaced by OZ's `OwnershipTransferred(address indexed, address indexed)`. This is a breaking change for off-chain indexers monitoring the old event name. Since the contract is being deployed fresh (not upgraded), this is acceptable. + +5. **`onlyOwner` modifier**: OZ Ownable's `onlyOwner` modifier uses `require(owner() == _msgSender(), "Ownable: caller is not the owner")`. The `register()` and `revoke()` functions use `onlyOwner`, which is consistent with the previous behavior. Test `test_register_revertUnauthorizedCaller` validates this by expecting `"Ownable: caller is not the owner"`. + +6. **No remaining custom ownership references**: Searched for `Unauthorized`, `OwnerTransferred`, and custom ownership patterns across all TEE source files -- zero matches in source code. Test files reference `"Ownable: caller is not the owner"` (the OZ error string), confirming the migration. + +**Status: FIXED** -- The fix fully addresses the finding. OZ Ownable v4 is a well-audited, battle-tested implementation that provides zero-address validation, standard event names, and a clean API. + +--- + +## 3. New Findings + +### N-01: `renounceOwnership()` Is Inherited and Not Disabled + +**Severity:** Low +**File:** `src/dispute/tee/TeeProofVerifier.sol` + +**Description:** +OpenZeppelin Ownable v4 exposes `renounceOwnership()`, which sets the owner to `address(0)`. If the owner accidentally calls this function, all admin capabilities (enclave registration and revocation) are permanently lost. The `transferOwnership()` zero-address check does not protect against `renounceOwnership()`, which deliberately bypasses it via the internal `_transferOwnership(address(0))`. + +**Impact:** +Same as original M-02 -- permanent loss of admin control. However, the risk is lower because `renounceOwnership()` requires an explicit, deliberate call (not an accidental zero-address parameter), and the function name clearly communicates its intent. + +**Recommendation:** +Override `renounceOwnership()` to revert unconditionally: +```solidity +function renounceOwnership() public override onlyOwner { + revert("TeeProofVerifier: renounce disabled"); +} +``` +Alternatively, document that `renounceOwnership()` should never be called and rely on operational procedures. + +--- + +## 4. Test Coverage Assessment + +### M-01 Fix Tests + +| Test | File | What It Verifies | +|------|------|------------------| +| `test_prove_revertUnauthorizedProver` | `TeeDisputeGame.t.sol:551` | Non-proposer address gets `BadAuth` | +| `test_prove_succeedsWithSingleBatch` | `TeeDisputeGame.t.sol:223` | Proposer can prove, recorded as prover | +| `test_prove_succeedsWithChainedBatches` | `TeeDisputeGame.t.sol:250` | Multi-batch proving by proposer | +| `test_lifecycle_challenged_proveByProposer_defenderWins` | `TeeDisputeGameIntegration.t.sol:130` | Full lifecycle: challenge + proposer proves + resolve + claim | +| `test_lifecycle_viaRouter_fullCycle` | `TeeDisputeGameIntegration.t.sol:456` | Prove via router with proposer attribution | +| `test_claimCredit_challengerWinsNormalMode` | `TeeDisputeGame.t.sol:579` | Simplified bond distribution (challenger takes all) | +| `test_claimCredit_refundModeWhenBlacklisted` | `TeeDisputeGame.t.sol:607` | REFUND mode with proposer proving | + +**Assessment:** Excellent coverage. Both the access control rejection and the happy-path with simplified bond distribution are tested. Integration tests cover end-to-end flows. + +### M-02 Fix Tests + +| Test | File | What It Verifies | +|------|------|------------------| +| `test_transferOwnership_updatesOwner` | `TeeProofVerifier.t.sol:121` | Standard ownership transfer works | +| `test_transferOwnership_revertZeroAddress` | `TeeProofVerifier.t.sol:127` | Zero-address transfer is rejected | +| `test_register_revertUnauthorizedCaller` | `TeeProofVerifier.t.sol:36` | Non-owner cannot register (uses OZ error string) | + +**Assessment:** Good coverage for the ownership fix. The zero-address rejection test directly validates the M-02 fix. A test for `renounceOwnership()` behavior would strengthen coverage (see N-01). + +### Overall Test Quality + +- **4 test files** cover the TEE dispute game system: unit tests (`TeeDisputeGame.t.sol`), verifier tests (`TeeProofVerifier.t.sol`), integration tests (`TeeDisputeGameIntegration.t.sol`), and ASR compatibility tests (`AnchorStateRegistryCompatibility.t.sol`). +- Integration tests use real `DisputeGameFactory`, `AnchorStateRegistry`, and `TeeProofVerifier` contracts (only `RiscZeroVerifier` and `SystemConfig` are mocked). +- All game lifecycle paths are covered: unchallenged timeout, challenged + proved, challenged + timeout, blacklisted/refund, parent-child chaining, parent-loses scenarios, cross-chain isolation. +- Error paths are well-tested with `vm.expectRevert` for all custom errors. + +--- + +## 5. Residual Items from Post-Refactor Audit + +| ID | Severity | Title | Status Post-Fix | +|------|----------------|----------------------------------------------------------|---------------------| +| M-01 | Medium | `prove()` permissionless -- prover credit frontrunnable | **Fixed** | +| M-02 | Medium | `transferOwnership()` lacks zero-address check | **Fixed** | +| L-01 | Low | `tx.origin` for proposer authentication | Acknowledged (by design) | +| L-02 | Low | `_extractAddress` memory loop | Open | +| L-03 | Low | `expectedRootKey` not immutable | Open | +| I-01 | Informational | Unused error `ClaimNotChallenged` | Open | +| I-02 | Informational | Unused error `UnexpectedGameType` | Open | +| I-03 | Informational | `closeGame()` silently ignores `setAnchorState` failures | Acknowledged | +| I-04 | Informational | No `receive()`/`fallback()` | By Design | +| I-05 | Informational | AccessManager refactor completeness | Confirmed | +| N-01 | Low (New) | `renounceOwnership()` inherited, not disabled | Open | + +--- + +## 6. Conclusion + +Both Medium-severity findings from the post-refactor audit have been correctly and completely fixed: + +- **M-01** is resolved by restricting `prove()` to the proposer via `msg.sender` check, eliminating the frontrunning vector entirely. The `resolve()` bond distribution was properly simplified to reflect the proposer-only proving model. + +- **M-02** is resolved by replacing the custom ownership implementation with OpenZeppelin Ownable v4, which provides built-in zero-address validation on `transferOwnership()`, a standard `onlyOwner` modifier, and the well-known `OwnershipTransferred` event. + +The fixes are clean, minimal, and do not introduce storage layout issues or breaking behavioral changes. Test coverage adequately validates both the fix correctness and the absence of regressions. + +One new low-severity observation (N-01: inherited `renounceOwnership()` is not disabled) is noted for consideration but does not block deployment. + +**Final Assessment: The TeeDisputeGame system is ready for deployment. All Medium findings are resolved, and the codebase maintains its strong security posture.** From 79258dcc45bd49828a9e1694166927ce679d7a59 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 23 Mar 2026 18:25:00 +0800 Subject: [PATCH 12/24] fix: add pause check in closeGame, use getAnchorRoot, and EIP-712 typed batchDigest - closeGame() now reverts with GamePaused() when ASR is paused, preventing games from permanently entering REFUND mode during temporary pauses - Replace legacy anchors(GAME_TYPE) with getAnchorRoot() in initialize() - Migrate batchDigest from plain keccak256 to EIP-712 typed data hash with domain separator (chainId + TEE_PROOF_VERIFIER address) to prevent cross-chain and cross-contract signature replay - Expose domainSeparator() and batchProofTypehash() getters for off-chain TEE signers Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TeeDisputeGame.sol | 42 ++++++++++++++++--- .../AnchorStateRegistryCompatibility.t.sol | 3 +- .../test/dispute/tee/TeeDisputeGame.t.sol | 40 ++++++++++++------ .../tee/TeeDisputeGameIntegration.t.sol | 12 ++++-- .../fork/DisputeGameFactoryRouterFork.t.sol | 3 +- .../test/dispute/tee/helpers/TeeTestUtils.sol | 26 ++++++++++-- 6 files changed, 98 insertions(+), 28 deletions(-) diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index 16e94eaa8ec73..7b54d1eb5a7f8 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -19,6 +19,7 @@ import { BondTransferFailed, ClaimAlreadyResolved, GameNotFinalized, + GamePaused, IncorrectBondAmount, InvalidBondDistributionMode, NoCreditToClaim, @@ -47,8 +48,9 @@ uint32 constant TEE_DISPUTE_GAME_TYPE = 1960; /// prove() accepts multiple chained batch proofs to support the scenario /// where different TEE executors handle different sub-ranges within a single game. /// Each batch carries (startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block). -/// batchDigest = keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block)) -/// is computed on-chain and verified via TEE ECDSA signature. +/// batchDigest is computed on-chain as an EIP-712 typed data hash +/// (domain: name="TeeDisputeGame", version="1", chainId, verifyingContract=TEE_PROOF_VERIFIER) +/// and verified via TEE ECDSA signature. /// /// rootClaim = keccak256(abi.encode(blockHash, stateHash)) where blockHash and stateHash /// are passed via extraData. The anchor state stores this combined hash. @@ -106,6 +108,18 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { error FinalBlockMismatch(uint256 expectedBlock, uint256 actualBlock); error RootClaimMismatch(bytes32 expectedRootClaim, bytes32 actualRootClaim); + //////////////////////////////////////////////////////////////// + // EIP-712 Constants // + //////////////////////////////////////////////////////////////// + + bytes32 private constant DOMAIN_TYPEHASH = + keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"); + bytes32 private constant DOMAIN_NAME_HASH = keccak256("TeeDisputeGame"); + bytes32 private constant DOMAIN_VERSION_HASH = keccak256("1"); + bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( + "BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)" + ); + //////////////////////////////////////////////////////////////// // Immutables // //////////////////////////////////////////////////////////////// @@ -208,7 +222,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { if (proxy.status() == GameStatus.CHALLENGER_WINS) revert InvalidParentGame(); } else { (startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = - IAnchorStateRegistry(ANCHOR_STATE_REGISTRY).anchors(GAME_TYPE); + ANCHOR_STATE_REGISTRY.getAnchorRoot(); } if (l2SequenceNumber() <= startingOutputRoot.l2SequenceNumber) { @@ -266,7 +280,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { /// 3. proofs[i].l2Block < proofs[i+1].l2Block (monotonically increasing) /// 4. keccak256(proofs[last].endBlockHash, endStateHash) == rootClaim /// 5. proofs[last].l2Block == l2SequenceNumber - /// 6. Each batch's TEE signature is valid (via TEE_PROOF_VERIFIER) + /// 6. Each batch's EIP-712 typed digest + TEE signature is valid (via TEE_PROOF_VERIFIER) /// @param proofBytes ABI-encoded BatchProof[] array function prove(bytes calldata proofBytes) external returns (ProposalStatus) { if (msg.sender != proposer) revert BadAuth(); @@ -303,9 +317,10 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { revert BatchBlockNotIncreasing(i, prevBlock, proofs[i].l2Block); } - // Compute batchDigest on-chain and verify TEE signature - bytes32 batchDigest = keccak256( + // Compute EIP-712 typed batchDigest on-chain and verify TEE signature + bytes32 structHash = keccak256( abi.encode( + BATCH_PROOF_TYPEHASH, proofs[i].startBlockHash, proofs[i].startStateHash, proofs[i].endBlockHash, @@ -313,6 +328,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { proofs[i].l2Block ) ); + bytes32 batchDigest = keccak256(abi.encodePacked("\x19\x01", _domainSeparator(), structHash)); TEE_PROOF_VERIFIER.verifyBatch(batchDigest, proofs[i].signature); prevBlock = proofs[i].l2Block; @@ -413,6 +429,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { revert InvalidBondDistributionMode(); } + if (ANCHOR_STATE_REGISTRY.paused()) revert GamePaused(); + bool finalized = ANCHOR_STATE_REGISTRY.isGameFinalized(IDisputeGame(address(this))); if (!finalized) { revert GameNotFinalized(); @@ -474,6 +492,8 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // Immutable Getters // //////////////////////////////////////////////////////////////// + function domainSeparator() external view returns (bytes32) { return _domainSeparator(); } + function batchProofTypehash() external pure returns (bytes32) { return BATCH_PROOF_TYPEHASH; } function maxChallengeDuration() external view returns (Duration) { return MAX_CHALLENGE_DURATION; } function maxProveDuration() external view returns (Duration) { return MAX_PROVE_DURATION; } function disputeGameFactory() external view returns (IDisputeGameFactory) { return DISPUTE_GAME_FACTORY; } @@ -487,6 +507,16 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // Internal Functions // //////////////////////////////////////////////////////////////// + /// @notice Computes the EIP-712 domain separator. + /// @dev Computed dynamically to support chain ID changes (e.g., hard forks). + /// Uses TEE_PROOF_VERIFIER as verifyingContract since it is the signature + /// verification endpoint and is unique per chain deployment. + function _domainSeparator() private view returns (bytes32) { + return keccak256( + abi.encode(DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, address(TEE_PROOF_VERIFIER)) + ); + } + function _getParentGameStatus() private view returns (GameStatus) { if (parentIndex() != type(uint32).max) { (,, IDisputeGame parentGame) = DISPUTE_GAME_FACTORY.gameAtIndex(parentIndex()); diff --git a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol index 25e1fd87e331e..e4424c19f4d51 100644 --- a/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/AnchorStateRegistryCompatibility.t.sol @@ -98,7 +98,8 @@ contract AnchorStateRegistryCompatibilityTest is TeeTestUtils { endStateHash: keccak256("end-state"), l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 8b90f7ba6fcd4..564b7e9e54d2c 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -236,7 +236,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -257,6 +258,7 @@ contract TeeDisputeGameTest is TeeTestUtils { teeProofVerifier.setRegistered(executor, true); + bytes32 domainSep = game.domainSeparator(); TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](2); proofs[0] = buildBatchProof( BatchInput({ @@ -266,7 +268,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: middleStateHash, l2Block: ANCHOR_L2_BLOCK + 4 }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + domainSep ); proofs[1] = buildBatchProof( BatchInput({ @@ -276,7 +279,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + domainSep ); vm.prank(proposer); @@ -308,7 +312,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -338,7 +343,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: keccak256("middle-state"), l2Block: ANCHOR_L2_BLOCK + 4 }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); proofs[1] = buildBatchProof( BatchInput({ @@ -348,7 +354,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -374,7 +381,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: middleStateHash, l2Block: ANCHOR_L2_BLOCK + 4 }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); proofs[1] = buildBatchProof( BatchInput({ @@ -384,7 +392,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: ANCHOR_L2_BLOCK + 4 }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -408,7 +417,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -438,7 +448,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() - 1 }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.expectRevert( @@ -463,7 +474,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -564,7 +576,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); address unauthorized = makeAddr("unauthorized"); @@ -624,7 +637,8 @@ contract TeeDisputeGameTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); game.prove(abi.encode(proofs)); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index 5ac8cba87a985..1dda8d592fbbc 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -146,7 +146,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); @@ -233,7 +234,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); game.prove(abi.encode(proofs)); @@ -305,7 +307,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { endStateHash: childEndStateHash, l2Block: child.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + child.domainSeparator() ); vm.prank(proposer); @@ -488,7 +491,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); vm.prank(proposer); diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index 126eaab72d9d9..0becf85b3c213 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -264,7 +264,8 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { endStateHash: endStateHash, l2Block: game.l2SequenceNumber() }), - DEFAULT_EXECUTOR_KEY + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() ); address gameProposer = game.proposer(); diff --git a/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol index 70cddc92a8f59..6e990077f7c41 100644 --- a/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol +++ b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol @@ -37,9 +37,19 @@ abstract contract TeeTestUtils is Test { return Claim.wrap(keccak256(abi.encode(blockHash_, stateHash_))); } - function computeBatchDigest(BatchInput memory batch) internal pure returns (bytes32) { + bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( + "BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)" + ); + + bytes32 private constant DOMAIN_TYPEHASH = + keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"); + bytes32 private constant DOMAIN_NAME_HASH = keccak256("TeeDisputeGame"); + bytes32 private constant DOMAIN_VERSION_HASH = keccak256("1"); + + function computeBatchStructHash(BatchInput memory batch) internal pure returns (bytes32) { return keccak256( abi.encode( + BATCH_PROOF_TYPEHASH, batch.startBlockHash, batch.startStateHash, batch.endBlockHash, @@ -49,12 +59,22 @@ abstract contract TeeTestUtils is Test { ); } + function computeDomainSeparator(address verifier) internal view returns (bytes32) { + return keccak256( + abi.encode(DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, verifier) + ); + } + + function computeEIP712Digest(BatchInput memory batch, bytes32 domainSeparator) internal pure returns (bytes32) { + return keccak256(abi.encodePacked("\x19\x01", domainSeparator, computeBatchStructHash(batch))); + } + function signDigest(uint256 privateKey, bytes32 digest) internal pure returns (bytes memory) { (uint8 v, bytes32 r, bytes32 s) = vm.sign(privateKey, digest); return abi.encodePacked(r, s, v); } - function buildBatchProof(BatchInput memory batch, uint256 privateKey) + function buildBatchProof(BatchInput memory batch, uint256 privateKey, bytes32 domainSeparator) internal returns (TeeDisputeGame.BatchProof memory) { @@ -64,7 +84,7 @@ abstract contract TeeTestUtils is Test { endBlockHash: batch.endBlockHash, endStateHash: batch.endStateHash, l2Block: batch.l2Block, - signature: signDigest(privateKey, computeBatchDigest(batch)) + signature: signDigest(privateKey, computeEIP712Digest(batch, domainSeparator)) }); } From d39ab324f0120990b225aba0fd92939c2b8ebe0a Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Tue, 24 Mar 2026 11:43:49 +0800 Subject: [PATCH 13/24] refactor: generation-based revocation, journal rebuild, and parameter setters for TeeProofVerifier Borrow patterns from DKIMOracle to improve TeeProofVerifier: - Replace per-address EnclaveInfo mapping with generation counter for O(1) bulk revocation via revokeAll() - Replace _parseJournal with AttestationData struct + abi.encodePacked journal reconstruction (rootKey baked into digest, eliminating explicit comparison) - Make riscZeroVerifier, imageId, expectedRootKey mutable with owner-gated setters to avoid redeployment - Add constructor parameter validation Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TeeProofVerifier.sol | 204 ++++++++------- .../tee/TeeDisputeGameIntegration.t.sol | 9 +- .../test/dispute/tee/TeeProofVerifier.t.sol | 239 +++++++++++++++--- .../fork/DisputeGameFactoryRouterFork.t.sol | 10 +- 4 files changed, 327 insertions(+), 135 deletions(-) diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol index b887cdbf37a22..b98fc12bbe0eb 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -9,55 +9,64 @@ import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; /// @notice Verifies TEE enclave identity via ZK proof (owner-gated registration) and /// batch state transitions via ECDSA signature (permissionless verification). /// @dev Two core responsibilities: -/// 1. register(): Owner verifies ZK proof of Nitro attestation, binds EOA <-> PCR on-chain +/// 1. register(): Owner verifies ZK proof of Nitro attestation, binds EOA on-chain /// 2. verifyBatch(): ecrecover signature, check signer is a registered enclave /// -/// Journal format (from RISC Zero guest program): -/// - 8 bytes: timestamp_ms (big-endian uint64) -/// - 32 bytes: pcr_hash = SHA256(PCR0) -/// - 96 bytes: root_pubkey (P384 without 0x04 prefix) -/// - 1 byte: pubkey_len -/// - pubkey_len bytes: pubkey (secp256k1 uncompressed, 65 bytes) -/// - 2 bytes: user_data_len (big-endian uint16) -/// - user_data_len bytes: user_data +/// Uses generation-based revocation: incrementing enclaveGeneration invalidates +/// all previously registered enclaves in O(1). +/// +/// Journal is reconstructed on-chain from AttestationData + expectedRootKey, +/// so rootKey mismatch causes ZK verify failure without explicit comparison. contract TeeProofVerifier is Ownable { - // ============ Immutables ============ + // ============ Structs ============ + + /// @notice Attestation data from the RISC Zero guest program + struct AttestationData { + uint64 timestampMs; + bytes32 pcrHash; + bytes publicKey; // 65 bytes secp256k1 uncompressed (0x04 + x + y) + bytes userData; + } + + // ============ State ============ /// @notice RISC Zero Groth16 verifier (only called during registration) - IRiscZeroVerifier public immutable riscZeroVerifier; + IRiscZeroVerifier public riscZeroVerifier; /// @notice RISC Zero guest image ID (hash of the attestation verification guest ELF) - bytes32 public immutable imageId; + bytes32 public imageId; /// @notice Expected AWS Nitro root public key (96 bytes, P384 without 0x04 prefix) bytes public expectedRootKey; - // ============ State ============ + /// @notice Current enclave generation (starts at 1, increments on bulk revocation) + uint256 public enclaveGeneration; - struct EnclaveInfo { - bytes32 pcrHash; - uint64 registeredAt; - } + /// @notice Generation at which each enclave was registered + mapping(address => uint256) public enclaveRegisteredGeneration; - /// @notice Registered enclaves: EOA address => enclave info - mapping(address => EnclaveInfo) public registeredEnclaves; + /// @notice PCR hash recorded for each enclave (on-chain record only, not validated) + mapping(address => bytes32) public enclavePcrHash; // ============ Events ============ - event EnclaveRegistered( - address indexed enclaveAddress, bytes32 indexed pcrHash, uint64 timestampMs - ); - + event EnclaveRegistered(address indexed enclaveAddress, bytes32 indexed pcrHash, uint64 timestampMs); event EnclaveRevoked(address indexed enclaveAddress); + event AllEnclavesRevoked(uint256 previousGeneration, uint256 newGeneration); + event RiscZeroVerifierUpdated(IRiscZeroVerifier indexed oldVerifier, IRiscZeroVerifier indexed newVerifier); + event ImageIdUpdated(bytes32 indexed oldImageId, bytes32 indexed newImageId); + event ExpectedRootKeyUpdated(bytes oldKey, bytes newKey); // ============ Errors ============ error InvalidProof(); - error InvalidRootKey(); error InvalidPublicKey(); error EnclaveAlreadyRegistered(); error EnclaveNotRegistered(); error InvalidSignature(); + error InvalidVerifierAddress(); + error InvalidImageId(); + error InvalidRootKeyLength(); // ============ Constructor ============ @@ -69,55 +78,63 @@ contract TeeProofVerifier is Ownable { bytes32 _imageId, bytes memory _rootKey ) { + if (address(_riscZeroVerifier) == address(0)) revert InvalidVerifierAddress(); + if (_imageId == bytes32(0)) revert InvalidImageId(); + if (_rootKey.length != 96) revert InvalidRootKeyLength(); + riscZeroVerifier = _riscZeroVerifier; imageId = _imageId; expectedRootKey = _rootKey; + enclaveGeneration = 1; } // ============ Registration (Owner Only) ============ /// @notice Register a TEE enclave by verifying its ZK attestation proof. - /// @dev Only callable by the owner. The owner calling register() is the trust gate -- - /// the PCR and EOA from the proof are automatically trusted upon registration. + /// @dev Only callable by the owner. The journal is reconstructed on-chain from + /// attestationData + expectedRootKey. If the rootKey in the original attestation + /// differs from expectedRootKey, the reconstructed digest won't match and + /// the ZK proof verification will fail. /// @param seal The RISC Zero proof seal (Groth16) - /// @param journal The journal output from the guest program - function register(bytes calldata seal, bytes calldata journal) external onlyOwner { - // 1. Verify ZK proof - bytes32 journalDigest = sha256(journal); - try riscZeroVerifier.verify(seal, imageId, journalDigest) {} - catch { - revert InvalidProof(); + /// @param attestationData Attestation fields from the guest program + function register(bytes calldata seal, AttestationData calldata attestationData) external onlyOwner { + // 1. Validate public key length + if (attestationData.publicKey.length != 65) { + revert InvalidPublicKey(); } - // 2. Parse journal - ( - uint64 timestampMs, - bytes32 pcrHash, - bytes memory rootKey, - bytes memory publicKey, - ) = _parseJournal(journal); - - // 3. Verify root key matches AWS Nitro official root - if (keccak256(rootKey) != keccak256(expectedRootKey)) { - revert InvalidRootKey(); - } + // 2. Extract EOA address from secp256k1 public key + address enclaveAddress = _extractAddress(attestationData.publicKey); - // 4. Extract EOA address from secp256k1 public key (65 bytes: 0x04 + x + y) - if (publicKey.length != 65) { - revert InvalidPublicKey(); + // 3. Check not already registered in current generation + if (enclaveRegisteredGeneration[enclaveAddress] == enclaveGeneration) { + revert EnclaveAlreadyRegistered(); } - address enclaveAddress = _extractAddress(publicKey); - // 5. Check not already registered - if (registeredEnclaves[enclaveAddress].registeredAt != 0) { - revert EnclaveAlreadyRegistered(); + // 4. Reconstruct journal digest (rootKey baked in from chain state) + bytes32 journalDigest = sha256( + abi.encodePacked( + attestationData.timestampMs, + attestationData.pcrHash, + expectedRootKey, + uint8(attestationData.publicKey.length), + attestationData.publicKey, + uint16(attestationData.userData.length), + attestationData.userData + ) + ); + + // 5. Verify ZK proof + try riscZeroVerifier.verify(seal, imageId, journalDigest) {} + catch { + revert InvalidProof(); } - // 6. Store registration (PCR is implicitly trusted by owner's approval) - registeredEnclaves[enclaveAddress] = - EnclaveInfo({pcrHash: pcrHash, registeredAt: timestampMs}); + // 6. Store registration + enclaveRegisteredGeneration[enclaveAddress] = enclaveGeneration; + enclavePcrHash[enclaveAddress] = attestationData.pcrHash; - emit EnclaveRegistered(enclaveAddress, pcrHash, timestampMs); + emit EnclaveRegistered(enclaveAddress, attestationData.pcrHash, attestationData.timestampMs); } // ============ Batch Verification (Permissionless) ============ @@ -131,14 +148,12 @@ contract TeeProofVerifier is Ownable { view returns (address signer) { - // 1. Recover signer from signature (address recovered, ECDSA.RecoverError err) = ECDSA.tryRecover(digest, signature); if (err != ECDSA.RecoverError.NoError || recovered == address(0)) { revert InvalidSignature(); } - // 2. Check signer is a registered enclave - if (registeredEnclaves[recovered].registeredAt == 0) { + if (enclaveRegisteredGeneration[recovered] != enclaveGeneration) { revert EnclaveNotRegistered(); } @@ -148,61 +163,54 @@ contract TeeProofVerifier is Ownable { // ============ Query Functions ============ /// @notice Check if an address is a registered enclave - /// @param enclaveAddress The address to check - /// @return True if the address is registered function isRegistered(address enclaveAddress) external view returns (bool) { - return registeredEnclaves[enclaveAddress].registeredAt != 0; + return enclaveRegisteredGeneration[enclaveAddress] == enclaveGeneration; } // ============ Admin Functions ============ - /// @notice Revoke a registered enclave - /// @param enclaveAddress The enclave address to revoke + /// @notice Revoke a single registered enclave function revoke(address enclaveAddress) external onlyOwner { - if (registeredEnclaves[enclaveAddress].registeredAt == 0) { + if (enclaveRegisteredGeneration[enclaveAddress] != enclaveGeneration) { revert EnclaveNotRegistered(); } - delete registeredEnclaves[enclaveAddress]; + enclaveRegisteredGeneration[enclaveAddress] = 0; emit EnclaveRevoked(enclaveAddress); } - // ============ Internal Functions ============ - - /// @notice Parse the journal bytes into attestation fields - function _parseJournal(bytes calldata journal) - internal - pure - returns ( - uint64 timestampMs, - bytes32 pcrHash, - bytes memory rootKey, - bytes memory publicKey, - bytes memory userData - ) - { - uint256 offset = 0; - - timestampMs = uint64(bytes8(journal[offset:offset + 8])); - offset += 8; - - pcrHash = bytes32(journal[offset:offset + 32]); - offset += 32; - - rootKey = journal[offset:offset + 96]; - offset += 96; - - uint8 pubkeyLen = uint8(journal[offset]); - offset += 1; + /// @notice Revoke all registered enclaves by incrementing the generation counter + function revokeAll() external onlyOwner { + uint256 previousGeneration = enclaveGeneration; + enclaveGeneration = previousGeneration + 1; + emit AllEnclavesRevoked(previousGeneration, enclaveGeneration); + } - publicKey = journal[offset:offset + pubkeyLen]; - offset += pubkeyLen; + /// @notice Update the RISC Zero verifier contract + function setRiscZeroVerifier(IRiscZeroVerifier _verifier) external onlyOwner { + if (address(_verifier) == address(0)) revert InvalidVerifierAddress(); + IRiscZeroVerifier oldVerifier = riscZeroVerifier; + riscZeroVerifier = _verifier; + emit RiscZeroVerifierUpdated(oldVerifier, _verifier); + } - uint16 userDataLen = uint16(bytes2(journal[offset:offset + 2])); - offset += 2; + /// @notice Update the RISC Zero guest image ID + function setImageId(bytes32 _imageId) external onlyOwner { + if (_imageId == bytes32(0)) revert InvalidImageId(); + bytes32 oldImageId = imageId; + imageId = _imageId; + emit ImageIdUpdated(oldImageId, _imageId); + } - userData = journal[offset:offset + userDataLen]; + /// @notice Update the expected AWS Nitro root public key + function setExpectedRootKey(bytes memory _rootKey) external onlyOwner { + if (_rootKey.length != 96) revert InvalidRootKeyLength(); + bytes memory oldKey = expectedRootKey; + expectedRootKey = _rootKey; + emit ExpectedRootKeyUpdated(oldKey, _rootKey); } + // ============ Internal Functions ============ + /// @notice Extract Ethereum address from secp256k1 uncompressed public key /// @param publicKey 65 bytes: 0x04 prefix + 32-byte x + 32-byte y function _extractAddress(bytes memory publicKey) internal pure returns (address) { diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index 1dda8d592fbbc..0ff0f837bd6a4 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -655,8 +655,13 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // Register the executor enclave via real register() flow Vm.Wallet memory enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "integration-enclave"); - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - verifier.register("", journal); + TeeProofVerifier.AttestationData memory data = TeeProofVerifier.AttestationData({ + timestampMs: 1234, + pcrHash: PCR_HASH, + publicKey: uncompressedPublicKey(enclaveWallet), + userData: "" + }); + verifier.register("", data); return verifier; } diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol index 7254b8982acb5..0eca0ce8f0efa 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -3,6 +3,7 @@ pragma solidity ^0.8.15; import {Vm} from "forge-std/Vm.sol"; import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; +import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; @@ -22,65 +23,86 @@ contract TeeProofVerifierTest is TeeTestUtils { enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "enclave"); } + // ============ Helper ============ + + function _buildAttestationData( + uint64 timestampMs, + bytes32 pcrHash, + bytes memory publicKey, + bytes memory userData + ) + internal + pure + returns (TeeProofVerifier.AttestationData memory) + { + return TeeProofVerifier.AttestationData({ + timestampMs: timestampMs, + pcrHash: pcrHash, + publicKey: publicKey, + userData: userData + }); + } + + function _registerEnclave() internal { + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, uncompressedPublicKey(enclaveWallet), "data"); + verifier.register(hex"1234", data); + } + + // ============ Register Tests ============ + function test_register_succeeds() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), "data"); + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, uncompressedPublicKey(enclaveWallet), "data"); - verifier.register(hex"1234", journal); + verifier.register(hex"1234", data); - (bytes32 pcrHash, uint64 registeredAt) = verifier.registeredEnclaves(enclaveWallet.addr); - assertEq(pcrHash, PCR_HASH); - assertEq(registeredAt, 1234); + assertEq(verifier.enclavePcrHash(enclaveWallet.addr), PCR_HASH); + assertEq(verifier.enclaveRegisteredGeneration(enclaveWallet.addr), verifier.enclaveGeneration()); assertTrue(verifier.isRegistered(enclaveWallet.addr)); } function test_register_revertUnauthorizedCaller() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, uncompressedPublicKey(enclaveWallet), ""); vm.prank(makeAddr("attacker")); vm.expectRevert("Ownable: caller is not the owner"); - verifier.register(hex"1234", journal); + verifier.register(hex"1234", data); } function test_register_revertInvalidProof() public { riscZeroVerifier.setShouldRevert(true); - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, uncompressedPublicKey(enclaveWallet), ""); vm.expectRevert(TeeProofVerifier.InvalidProof.selector); - verifier.register(hex"1234", journal); - } - - function test_register_revertInvalidRootKey() public { - bytes memory badRootKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); - bytes memory journal = buildJournal(1234, PCR_HASH, badRootKey, uncompressedPublicKey(enclaveWallet), ""); - - vm.expectRevert(TeeProofVerifier.InvalidRootKey.selector); - verifier.register(hex"1234", journal); + verifier.register(hex"1234", data); } function test_register_revertInvalidPublicKey() public { bytes memory shortPublicKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2))); - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, shortPublicKey, ""); + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, shortPublicKey, ""); vm.expectRevert(TeeProofVerifier.InvalidPublicKey.selector); - verifier.register(hex"1234", journal); + verifier.register(hex"1234", data); } function test_register_revertDuplicateEnclave() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - verifier.register(hex"1234", journal); + _registerEnclave(); + + TeeProofVerifier.AttestationData memory data = + _buildAttestationData(1234, PCR_HASH, uncompressedPublicKey(enclaveWallet), "data"); vm.expectRevert(TeeProofVerifier.EnclaveAlreadyRegistered.selector); - verifier.register(hex"1234", journal); + verifier.register(hex"1234", data); } - function test_register_revertMalformedJournal() public { - vm.expectRevert(); - verifier.register(hex"1234", hex"0001"); - } + // ============ VerifyBatch Tests ============ function test_verifyBatch_succeedsForRegisteredEnclave() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - verifier.register(hex"1234", journal); + _registerEnclave(); bytes32 digest = keccak256("batch"); bytes memory signature = signDigest(enclaveWallet.privateKey, digest); @@ -97,16 +119,16 @@ contract TeeProofVerifierTest is TeeTestUtils { } function test_verifyBatch_revertForInvalidSignature() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - verifier.register(hex"1234", journal); + _registerEnclave(); vm.expectRevert(TeeProofVerifier.InvalidSignature.selector); verifier.verifyBatch(keccak256("batch"), hex"1234"); } + // ============ Revoke Tests ============ + function test_revoke_succeeds() public { - bytes memory journal = buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - verifier.register(hex"1234", journal); + _registerEnclave(); verifier.revoke(enclaveWallet.addr); @@ -118,6 +140,142 @@ contract TeeProofVerifierTest is TeeTestUtils { verifier.revoke(enclaveWallet.addr); } + function test_revoke_revertNonOwner() public { + _registerEnclave(); + vm.prank(makeAddr("attacker")); + vm.expectRevert("Ownable: caller is not the owner"); + verifier.revoke(enclaveWallet.addr); + } + + function test_revoke_verifyBatchFailsAfterRevoke() public { + _registerEnclave(); + bytes32 digest = keccak256("batch"); + bytes memory signature = signDigest(enclaveWallet.privateKey, digest); + assertEq(verifier.verifyBatch(digest, signature), enclaveWallet.addr); + + verifier.revoke(enclaveWallet.addr); + + vm.expectRevert(TeeProofVerifier.EnclaveNotRegistered.selector); + verifier.verifyBatch(digest, signature); + } + + function test_revoke_doubleRevokeReverts() public { + _registerEnclave(); + verifier.revoke(enclaveWallet.addr); + + vm.expectRevert(TeeProofVerifier.EnclaveNotRegistered.selector); + verifier.revoke(enclaveWallet.addr); + } + + function test_revoke_canReRegisterAfterRevoke() public { + _registerEnclave(); + verifier.revoke(enclaveWallet.addr); + assertFalse(verifier.isRegistered(enclaveWallet.addr)); + + _registerEnclave(); + assertTrue(verifier.isRegistered(enclaveWallet.addr)); + } + + // ============ RevokeAll Tests ============ + + function test_revokeAll_invalidatesAllEnclaves() public { + _registerEnclave(); + assertTrue(verifier.isRegistered(enclaveWallet.addr)); + + uint256 oldGen = verifier.enclaveGeneration(); + verifier.revokeAll(); + + assertEq(verifier.enclaveGeneration(), oldGen + 1); + assertFalse(verifier.isRegistered(enclaveWallet.addr)); + } + + function test_revokeAll_enclaveCanReRegister() public { + _registerEnclave(); + verifier.revokeAll(); + assertFalse(verifier.isRegistered(enclaveWallet.addr)); + + // Re-register after generation bump + _registerEnclave(); + assertTrue(verifier.isRegistered(enclaveWallet.addr)); + } + + function test_revokeAll_revertNonOwner() public { + vm.prank(makeAddr("attacker")); + vm.expectRevert("Ownable: caller is not the owner"); + verifier.revokeAll(); + } + + function test_revokeAll_verifyBatchFailsAfterRevoke() public { + _registerEnclave(); + bytes32 digest = keccak256("batch"); + bytes memory signature = signDigest(enclaveWallet.privateKey, digest); + + // Works before revokeAll + assertEq(verifier.verifyBatch(digest, signature), enclaveWallet.addr); + + verifier.revokeAll(); + + // Fails after revokeAll + vm.expectRevert(TeeProofVerifier.EnclaveNotRegistered.selector); + verifier.verifyBatch(digest, signature); + } + + // ============ Setter Tests ============ + + function test_setRiscZeroVerifier_succeeds() public { + MockRiscZeroVerifier newVerifier = new MockRiscZeroVerifier(); + verifier.setRiscZeroVerifier(newVerifier); + assertEq(address(verifier.riscZeroVerifier()), address(newVerifier)); + } + + function test_setRiscZeroVerifier_revertZeroAddress() public { + vm.expectRevert(TeeProofVerifier.InvalidVerifierAddress.selector); + verifier.setRiscZeroVerifier(IRiscZeroVerifier(address(0))); + } + + function test_setRiscZeroVerifier_revertNonOwner() public { + vm.prank(makeAddr("attacker")); + vm.expectRevert("Ownable: caller is not the owner"); + verifier.setRiscZeroVerifier(IRiscZeroVerifier(address(1))); + } + + function test_setImageId_succeeds() public { + bytes32 newImageId = keccak256("new-image"); + verifier.setImageId(newImageId); + assertEq(verifier.imageId(), newImageId); + } + + function test_setImageId_revertZero() public { + vm.expectRevert(TeeProofVerifier.InvalidImageId.selector); + verifier.setImageId(bytes32(0)); + } + + function test_setImageId_revertNonOwner() public { + vm.prank(makeAddr("attacker")); + vm.expectRevert("Ownable: caller is not the owner"); + verifier.setImageId(keccak256("new-image")); + } + + function test_setExpectedRootKey_succeeds() public { + bytes memory newKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); + verifier.setExpectedRootKey(newKey); + assertEq(keccak256(verifier.expectedRootKey()), keccak256(newKey)); + } + + function test_setExpectedRootKey_revertInvalidLength() public { + vm.expectRevert(TeeProofVerifier.InvalidRootKeyLength.selector); + verifier.setExpectedRootKey(hex"1234"); + } + + function test_setExpectedRootKey_revertNonOwner() public { + bytes memory newKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); + vm.prank(makeAddr("attacker")); + vm.expectRevert("Ownable: caller is not the owner"); + verifier.setExpectedRootKey(newKey); + } + + // ============ Ownership Tests ============ + function test_transferOwnership_updatesOwner() public { address newOwner = makeAddr("newOwner"); verifier.transferOwnership(newOwner); @@ -128,4 +286,21 @@ contract TeeProofVerifierTest is TeeTestUtils { vm.expectRevert("Ownable: new owner is the zero address"); verifier.transferOwnership(address(0)); } + + // ============ Constructor Validation Tests ============ + + function test_constructor_revertZeroVerifier() public { + vm.expectRevert(TeeProofVerifier.InvalidVerifierAddress.selector); + new TeeProofVerifier(IRiscZeroVerifier(address(0)), IMAGE_ID, expectedRootKey); + } + + function test_constructor_revertZeroImageId() public { + vm.expectRevert(TeeProofVerifier.InvalidImageId.selector); + new TeeProofVerifier(riscZeroVerifier, bytes32(0), expectedRootKey); + } + + function test_constructor_revertInvalidRootKeyLength() public { + vm.expectRevert(TeeProofVerifier.InvalidRootKeyLength.selector); + new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, hex"1234"); + } } diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index 0becf85b3c213..eb45bb087e26b 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -349,9 +349,13 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { registeredExecutor = enclaveWallet.addr; teeProofVerifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); - bytes memory journal = - buildJournal(1234, PCR_HASH, expectedRootKey, uncompressedPublicKey(enclaveWallet), ""); - teeProofVerifier.register("", journal); + TeeProofVerifier.AttestationData memory data = TeeProofVerifier.AttestationData({ + timestampMs: 1234, + pcrHash: PCR_HASH, + publicKey: uncompressedPublicKey(enclaveWallet), + userData: "" + }); + teeProofVerifier.register("", data); } function _assertLiveFactoryFork() internal view { From 1feb569640465fcb1575740691d1d680f383fe65 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Tue, 24 Mar 2026 14:28:06 +0800 Subject: [PATCH 14/24] refactor: remove constructor and setter parameter validations from TeeProofVerifier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner-gated contract — invalid params cause ZK verify failure naturally, explicit checks add no security value. Also remove 96-byte rootKey length constraint to support different key formats. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TeeProofVerifier.sol | 10 ------ .../test/dispute/tee/TeeProofVerifier.t.sol | 31 ------------------- 2 files changed, 41 deletions(-) diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol index b98fc12bbe0eb..8f5ef2ee7df21 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -64,9 +64,6 @@ contract TeeProofVerifier is Ownable { error EnclaveAlreadyRegistered(); error EnclaveNotRegistered(); error InvalidSignature(); - error InvalidVerifierAddress(); - error InvalidImageId(); - error InvalidRootKeyLength(); // ============ Constructor ============ @@ -78,10 +75,6 @@ contract TeeProofVerifier is Ownable { bytes32 _imageId, bytes memory _rootKey ) { - if (address(_riscZeroVerifier) == address(0)) revert InvalidVerifierAddress(); - if (_imageId == bytes32(0)) revert InvalidImageId(); - if (_rootKey.length != 96) revert InvalidRootKeyLength(); - riscZeroVerifier = _riscZeroVerifier; imageId = _imageId; expectedRootKey = _rootKey; @@ -187,7 +180,6 @@ contract TeeProofVerifier is Ownable { /// @notice Update the RISC Zero verifier contract function setRiscZeroVerifier(IRiscZeroVerifier _verifier) external onlyOwner { - if (address(_verifier) == address(0)) revert InvalidVerifierAddress(); IRiscZeroVerifier oldVerifier = riscZeroVerifier; riscZeroVerifier = _verifier; emit RiscZeroVerifierUpdated(oldVerifier, _verifier); @@ -195,7 +187,6 @@ contract TeeProofVerifier is Ownable { /// @notice Update the RISC Zero guest image ID function setImageId(bytes32 _imageId) external onlyOwner { - if (_imageId == bytes32(0)) revert InvalidImageId(); bytes32 oldImageId = imageId; imageId = _imageId; emit ImageIdUpdated(oldImageId, _imageId); @@ -203,7 +194,6 @@ contract TeeProofVerifier is Ownable { /// @notice Update the expected AWS Nitro root public key function setExpectedRootKey(bytes memory _rootKey) external onlyOwner { - if (_rootKey.length != 96) revert InvalidRootKeyLength(); bytes memory oldKey = expectedRootKey; expectedRootKey = _rootKey; emit ExpectedRootKeyUpdated(oldKey, _rootKey); diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol index 0eca0ce8f0efa..6a2fe2d2d7501 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -228,11 +228,6 @@ contract TeeProofVerifierTest is TeeTestUtils { assertEq(address(verifier.riscZeroVerifier()), address(newVerifier)); } - function test_setRiscZeroVerifier_revertZeroAddress() public { - vm.expectRevert(TeeProofVerifier.InvalidVerifierAddress.selector); - verifier.setRiscZeroVerifier(IRiscZeroVerifier(address(0))); - } - function test_setRiscZeroVerifier_revertNonOwner() public { vm.prank(makeAddr("attacker")); vm.expectRevert("Ownable: caller is not the owner"); @@ -245,11 +240,6 @@ contract TeeProofVerifierTest is TeeTestUtils { assertEq(verifier.imageId(), newImageId); } - function test_setImageId_revertZero() public { - vm.expectRevert(TeeProofVerifier.InvalidImageId.selector); - verifier.setImageId(bytes32(0)); - } - function test_setImageId_revertNonOwner() public { vm.prank(makeAddr("attacker")); vm.expectRevert("Ownable: caller is not the owner"); @@ -262,11 +252,6 @@ contract TeeProofVerifierTest is TeeTestUtils { assertEq(keccak256(verifier.expectedRootKey()), keccak256(newKey)); } - function test_setExpectedRootKey_revertInvalidLength() public { - vm.expectRevert(TeeProofVerifier.InvalidRootKeyLength.selector); - verifier.setExpectedRootKey(hex"1234"); - } - function test_setExpectedRootKey_revertNonOwner() public { bytes memory newKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); vm.prank(makeAddr("attacker")); @@ -287,20 +272,4 @@ contract TeeProofVerifierTest is TeeTestUtils { verifier.transferOwnership(address(0)); } - // ============ Constructor Validation Tests ============ - - function test_constructor_revertZeroVerifier() public { - vm.expectRevert(TeeProofVerifier.InvalidVerifierAddress.selector); - new TeeProofVerifier(IRiscZeroVerifier(address(0)), IMAGE_ID, expectedRootKey); - } - - function test_constructor_revertZeroImageId() public { - vm.expectRevert(TeeProofVerifier.InvalidImageId.selector); - new TeeProofVerifier(riscZeroVerifier, bytes32(0), expectedRootKey); - } - - function test_constructor_revertInvalidRootKeyLength() public { - vm.expectRevert(TeeProofVerifier.InvalidRootKeyLength.selector); - new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, hex"1234"); - } } From 69c1f1d3717a6012883d2174ce4933e1e3ecce4a Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Tue, 24 Mar 2026 14:43:15 +0800 Subject: [PATCH 15/24] style: apply OP Stack code style and forge fmt to TEE contracts - Replace // ============ banners with //////////////////////////////////////////////////////////////// style - Apply forge fmt (bracket spacing, multiline func headers, line wrapping) - Group imports with // Libraries and // Interfaces comments - Remove constructor/setter parameter validations (owner-gated, no security value) - Remove rootKey 96-byte length constraint Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TeeDisputeGame.sol | 133 ++++++++++++---- .../src/dispute/tee/TeeProofVerifier.sol | 63 +++++--- .../test/dispute/tee/TeeDisputeGame.t.sol | 99 +++++++----- .../tee/TeeDisputeGameIntegration.t.sol | 149 +++++++++--------- .../test/dispute/tee/TeeProofVerifier.t.sol | 14 +- .../fork/DisputeGameFactoryRouterFork.t.sol | 52 +++--- .../test/dispute/tee/helpers/TeeTestUtils.sol | 23 +-- .../tee/mocks/MockTeeProofVerifier.sol | 15 +- 8 files changed, 318 insertions(+), 230 deletions(-) diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index 7b54d1eb5a7f8..a7124e93dabed 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -2,7 +2,7 @@ pragma solidity ^0.8.15; // Libraries -import {Clone} from "@solady/utils/Clone.sol"; +import { Clone } from "@solady/utils/Clone.sol"; import { BondDistributionMode, Claim, @@ -28,11 +28,11 @@ import { import "src/dispute/tee/lib/Errors.sol"; // Interfaces -import {ISemver} from "interfaces/universal/ISemver.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; -import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import { ISemver } from "interfaces/universal/ISemver.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; /// @dev Game type constant for TEE Dispute Game. uint32 constant TEE_DISPUTE_GAME_TYPE = 1960; @@ -89,7 +89,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { bytes32 endBlockHash; bytes32 endStateHash; uint256 l2Block; - bytes signature; // 65 bytes ECDSA (r + s + v) + bytes signature; // 65 bytes ECDSA (r + s + v) } //////////////////////////////////////////////////////////////// @@ -221,8 +221,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { if (proxy.status() == GameStatus.CHALLENGER_WINS) revert InvalidParentGame(); } else { - (startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = - ANCHOR_STATE_REGISTRY.getAnchorRoot(); + (startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = ANCHOR_STATE_REGISTRY.getAnchorRoot(); } if (l2SequenceNumber() <= startingOutputRoot.l2SequenceNumber) { @@ -417,7 +416,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { refundModeCredit[_recipient] = 0; normalModeCredit[_recipient] = 0; - (bool success,) = _recipient.call{value: recipientCredit}(hex""); + (bool success,) = _recipient.call{ value: recipientCredit }(hex""); if (!success) revert BondTransferFailed(); } @@ -436,7 +435,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { revert GameNotFinalized(); } - try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} catch {} + try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) { } catch { } bool properGame = ANCHOR_STATE_REGISTRY.isGameProper(IDisputeGame(address(this))); @@ -469,18 +468,53 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // IDisputeGame Impl // //////////////////////////////////////////////////////////////// - function gameType() public view returns (GameType gameType_) { gameType_ = GAME_TYPE; } - function gameCreator() public pure returns (address creator_) { creator_ = _getArgAddress(0x00); } - function rootClaim() public pure returns (Claim rootClaim_) { rootClaim_ = Claim.wrap(_getArgBytes32(0x14)); } - function l1Head() public pure returns (Hash l1Head_) { l1Head_ = Hash.wrap(_getArgBytes32(0x34)); } - function l2SequenceNumber() public pure returns (uint256 l2SequenceNumber_) { l2SequenceNumber_ = _getArgUint256(0x54); } - function l2BlockNumber() public pure returns (uint256 l2BlockNumber_) { l2BlockNumber_ = l2SequenceNumber(); } - function parentIndex() public pure returns (uint32 parentIndex_) { parentIndex_ = _getArgUint32(0x74); } - function blockHash() public pure returns (bytes32 blockHash_) { blockHash_ = _getArgBytes32(0x78); } - function stateHash() public pure returns (bytes32 stateHash_) { stateHash_ = _getArgBytes32(0x98); } - function startingBlockNumber() external view returns (uint256) { return startingOutputRoot.l2SequenceNumber; } - function startingRootHash() external view returns (Hash) { return startingOutputRoot.root; } - function extraData() public pure returns (bytes memory extraData_) { extraData_ = _getArgBytes(0x54, 0x64); } + function gameType() public view returns (GameType gameType_) { + gameType_ = GAME_TYPE; + } + + function gameCreator() public pure returns (address creator_) { + creator_ = _getArgAddress(0x00); + } + + function rootClaim() public pure returns (Claim rootClaim_) { + rootClaim_ = Claim.wrap(_getArgBytes32(0x14)); + } + + function l1Head() public pure returns (Hash l1Head_) { + l1Head_ = Hash.wrap(_getArgBytes32(0x34)); + } + + function l2SequenceNumber() public pure returns (uint256 l2SequenceNumber_) { + l2SequenceNumber_ = _getArgUint256(0x54); + } + + function l2BlockNumber() public pure returns (uint256 l2BlockNumber_) { + l2BlockNumber_ = l2SequenceNumber(); + } + + function parentIndex() public pure returns (uint32 parentIndex_) { + parentIndex_ = _getArgUint32(0x74); + } + + function blockHash() public pure returns (bytes32 blockHash_) { + blockHash_ = _getArgBytes32(0x78); + } + + function stateHash() public pure returns (bytes32 stateHash_) { + stateHash_ = _getArgBytes32(0x98); + } + + function startingBlockNumber() external view returns (uint256) { + return startingOutputRoot.l2SequenceNumber; + } + + function startingRootHash() external view returns (Hash) { + return startingOutputRoot.root; + } + + function extraData() public pure returns (bytes memory extraData_) { + extraData_ = _getArgBytes(0x54, 0x64); + } function gameData() external view returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { gameType_ = gameType(); @@ -492,16 +526,45 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // Immutable Getters // //////////////////////////////////////////////////////////////// - function domainSeparator() external view returns (bytes32) { return _domainSeparator(); } - function batchProofTypehash() external pure returns (bytes32) { return BATCH_PROOF_TYPEHASH; } - function maxChallengeDuration() external view returns (Duration) { return MAX_CHALLENGE_DURATION; } - function maxProveDuration() external view returns (Duration) { return MAX_PROVE_DURATION; } - function disputeGameFactory() external view returns (IDisputeGameFactory) { return DISPUTE_GAME_FACTORY; } - function teeProofVerifier() external view returns (ITeeProofVerifier) { return TEE_PROOF_VERIFIER; } - function challengerBond() external view returns (uint256) { return CHALLENGER_BOND; } - function anchorStateRegistry() external view returns (IAnchorStateRegistry) { return ANCHOR_STATE_REGISTRY; } - function proposer_() external view returns (address) { return PROPOSER; } - function challenger_() external view returns (address) { return CHALLENGER; } + function domainSeparator() external view returns (bytes32) { + return _domainSeparator(); + } + + function batchProofTypehash() external pure returns (bytes32) { + return BATCH_PROOF_TYPEHASH; + } + + function maxChallengeDuration() external view returns (Duration) { + return MAX_CHALLENGE_DURATION; + } + + function maxProveDuration() external view returns (Duration) { + return MAX_PROVE_DURATION; + } + + function disputeGameFactory() external view returns (IDisputeGameFactory) { + return DISPUTE_GAME_FACTORY; + } + + function teeProofVerifier() external view returns (ITeeProofVerifier) { + return TEE_PROOF_VERIFIER; + } + + function challengerBond() external view returns (uint256) { + return CHALLENGER_BOND; + } + + function anchorStateRegistry() external view returns (IAnchorStateRegistry) { + return ANCHOR_STATE_REGISTRY; + } + + function proposer_() external view returns (address) { + return PROPOSER; + } + + function challenger_() external view returns (address) { + return CHALLENGER; + } //////////////////////////////////////////////////////////////// // Internal Functions // @@ -513,7 +576,9 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { /// verification endpoint and is unique per chain deployment. function _domainSeparator() private view returns (bytes32) { return keccak256( - abi.encode(DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, address(TEE_PROOF_VERIFIER)) + abi.encode( + DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, address(TEE_PROOF_VERIFIER) + ) ); } diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol index 8f5ef2ee7df21..81aac9249ed34 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -1,9 +1,12 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; -import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; -import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; +// Libraries +import { ECDSA } from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; +import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol"; + +// Interfaces +import { IRiscZeroVerifier } from "interfaces/dispute/IRiscZeroVerifier.sol"; /// @title TEE Proof Verifier for OP Stack DisputeGame /// @notice Verifies TEE enclave identity via ZK proof (owner-gated registration) and @@ -18,7 +21,9 @@ import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; /// Journal is reconstructed on-chain from AttestationData + expectedRootKey, /// so rootKey mismatch causes ZK verify failure without explicit comparison. contract TeeProofVerifier is Ownable { - // ============ Structs ============ + //////////////////////////////////////////////////////////////// + // Structs // + //////////////////////////////////////////////////////////////// /// @notice Attestation data from the RISC Zero guest program struct AttestationData { @@ -28,7 +33,9 @@ contract TeeProofVerifier is Ownable { bytes userData; } - // ============ State ============ + //////////////////////////////////////////////////////////////// + // State Vars // + //////////////////////////////////////////////////////////////// /// @notice RISC Zero Groth16 verifier (only called during registration) IRiscZeroVerifier public riscZeroVerifier; @@ -48,7 +55,9 @@ contract TeeProofVerifier is Ownable { /// @notice PCR hash recorded for each enclave (on-chain record only, not validated) mapping(address => bytes32) public enclavePcrHash; - // ============ Events ============ + //////////////////////////////////////////////////////////////// + // Events // + //////////////////////////////////////////////////////////////// event EnclaveRegistered(address indexed enclaveAddress, bytes32 indexed pcrHash, uint64 timestampMs); event EnclaveRevoked(address indexed enclaveAddress); @@ -57,7 +66,9 @@ contract TeeProofVerifier is Ownable { event ImageIdUpdated(bytes32 indexed oldImageId, bytes32 indexed newImageId); event ExpectedRootKeyUpdated(bytes oldKey, bytes newKey); - // ============ Errors ============ + //////////////////////////////////////////////////////////////// + // Errors // + //////////////////////////////////////////////////////////////// error InvalidProof(); error InvalidPublicKey(); @@ -65,23 +76,23 @@ contract TeeProofVerifier is Ownable { error EnclaveNotRegistered(); error InvalidSignature(); - // ============ Constructor ============ + //////////////////////////////////////////////////////////////// + // Constructor // + //////////////////////////////////////////////////////////////// /// @param _riscZeroVerifier RISC Zero verifier contract (Groth16 or mock) /// @param _imageId RISC Zero guest image ID /// @param _rootKey Expected AWS Nitro root public key (96 bytes) - constructor( - IRiscZeroVerifier _riscZeroVerifier, - bytes32 _imageId, - bytes memory _rootKey - ) { + constructor(IRiscZeroVerifier _riscZeroVerifier, bytes32 _imageId, bytes memory _rootKey) { riscZeroVerifier = _riscZeroVerifier; imageId = _imageId; expectedRootKey = _rootKey; enclaveGeneration = 1; } - // ============ Registration (Owner Only) ============ + //////////////////////////////////////////////////////////////// + // Registration (Owner Only) // + //////////////////////////////////////////////////////////////// /// @notice Register a TEE enclave by verifying its ZK attestation proof. /// @dev Only callable by the owner. The journal is reconstructed on-chain from @@ -118,7 +129,7 @@ contract TeeProofVerifier is Ownable { ); // 5. Verify ZK proof - try riscZeroVerifier.verify(seal, imageId, journalDigest) {} + try riscZeroVerifier.verify(seal, imageId, journalDigest) { } catch { revert InvalidProof(); } @@ -130,17 +141,15 @@ contract TeeProofVerifier is Ownable { emit EnclaveRegistered(enclaveAddress, attestationData.pcrHash, attestationData.timestampMs); } - // ============ Batch Verification (Permissionless) ============ + //////////////////////////////////////////////////////////////// + // Batch Verification (Permissionless) // + //////////////////////////////////////////////////////////////// /// @notice Verify a batch state transition signed by a registered TEE enclave. /// @param digest The hash of the batch data (pre_batch, txs, post_batch, etc.) /// @param signature ECDSA signature (65 bytes: r + s + v) /// @return signer The address of the verified enclave that signed the batch - function verifyBatch(bytes32 digest, bytes calldata signature) - external - view - returns (address signer) - { + function verifyBatch(bytes32 digest, bytes calldata signature) external view returns (address signer) { (address recovered, ECDSA.RecoverError err) = ECDSA.tryRecover(digest, signature); if (err != ECDSA.RecoverError.NoError || recovered == address(0)) { revert InvalidSignature(); @@ -153,14 +162,18 @@ contract TeeProofVerifier is Ownable { return recovered; } - // ============ Query Functions ============ + //////////////////////////////////////////////////////////////// + // Query Functions // + //////////////////////////////////////////////////////////////// /// @notice Check if an address is a registered enclave function isRegistered(address enclaveAddress) external view returns (bool) { return enclaveRegisteredGeneration[enclaveAddress] == enclaveGeneration; } - // ============ Admin Functions ============ + //////////////////////////////////////////////////////////////// + // Admin Functions // + //////////////////////////////////////////////////////////////// /// @notice Revoke a single registered enclave function revoke(address enclaveAddress) external onlyOwner { @@ -199,7 +212,9 @@ contract TeeProofVerifier is Ownable { emit ExpectedRootKeyUpdated(oldKey, _rootKey); } - // ============ Internal Functions ============ + //////////////////////////////////////////////////////////////// + // Internal Functions // + //////////////////////////////////////////////////////////////// /// @notice Extract Ethereum address from secp256k1 uncompressed public key /// @param publicKey 65 bytes: 0x04 prefix + 32-byte x + 32-byte y diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 564b7e9e54d2c..9889aecca168f 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -1,25 +1,25 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; -import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; -import {BadAuth, GameNotFinalized, IncorrectBondAmount, UnexpectedRootClaim} from "src/dispute/lib/Errors.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { BadAuth, GameNotFinalized, IncorrectBondAmount, UnexpectedRootClaim } from "src/dispute/lib/Errors.sol"; import { ClaimAlreadyChallenged, InvalidParentGame, ParentGameNotResolved, GameNotOver } from "src/dispute/tee/lib/Errors.sol"; -import {BondDistributionMode, Duration, GameType, Claim, Hash, GameStatus} from "src/dispute/lib/Types.sol"; -import {MockAnchorStateRegistry} from "test/dispute/tee/mocks/MockAnchorStateRegistry.sol"; -import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; -import {MockStatusDisputeGame} from "test/dispute/tee/mocks/MockStatusDisputeGame.sol"; -import {MockTeeProofVerifier} from "test/dispute/tee/mocks/MockTeeProofVerifier.sol"; -import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import { BondDistributionMode, Duration, GameType, Claim, Hash, GameStatus } from "src/dispute/lib/Types.sol"; +import { MockAnchorStateRegistry } from "test/dispute/tee/mocks/MockAnchorStateRegistry.sol"; +import { MockDisputeGameFactory } from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; +import { MockStatusDisputeGame } from "test/dispute/tee/mocks/MockStatusDisputeGame.sol"; +import { MockTeeProofVerifier } from "test/dispute/tee/mocks/MockTeeProofVerifier.sol"; +import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; contract TeeDisputeGameTest is TeeTestUtils { uint256 internal constant DEFENDER_BOND = 1 ether; @@ -66,12 +66,15 @@ contract TeeDisputeGameTest is TeeTestUtils { factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); factory.setInitBond(GameType.wrap(TEE_DISPUTE_GAME_TYPE), DEFENDER_BOND); - anchorStateRegistry.setAnchor(Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), ANCHOR_L2_BLOCK); + anchorStateRegistry.setAnchor( + Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), ANCHOR_L2_BLOCK + ); anchorStateRegistry.setRespectedGameType(GameType.wrap(TEE_DISPUTE_GAME_TYPE)); } function test_initialize_usesAnchorStateForRootGame() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); (Hash startingRoot, uint256 startingBlockNumber) = game.startingOutputRoot(); assertEq(startingRoot.raw(), computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()); @@ -88,12 +91,12 @@ contract TeeDisputeGameTest is TeeTestUtils { bytes32 endBlockHash = keccak256("router-end-block"); bytes32 endStateHash = keccak256("router-end-state"); - bytes memory extraData = - buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + bytes memory extraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); Claim rootClaim = computeRootClaim(endBlockHash, endStateHash); vm.startPrank(proposer, proposer); - address proxy = router.create{value: DEFENDER_BOND}(zoneId, GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData); + address proxy = + router.create{ value: DEFENDER_BOND }(zoneId, GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData); vm.stopPrank(); TeeDisputeGame game = TeeDisputeGame(payable(proxy)); @@ -153,12 +156,16 @@ contract TeeDisputeGameTest is TeeTestUtils { TeeDisputeGame.RootClaimMismatch.selector, expectedRootClaim.raw(), wrongRootClaim.raw() ) ); - factory.create{value: DEFENDER_BOND}(GameType.wrap(TEE_DISPUTE_GAME_TYPE), wrongRootClaim, extraData); + factory.create{ value: DEFENDER_BOND }(GameType.wrap(TEE_DISPUTE_GAME_TYPE), wrongRootClaim, extraData); vm.stopPrank(); } function test_initialize_revertWhenL2SequenceNumberDoesNotAdvance() public { - vm.expectRevert(abi.encodeWithSelector(UnexpectedRootClaim.selector, computeRootClaim(keccak256("block"), keccak256("state")))); + vm.expectRevert( + abi.encodeWithSelector( + UnexpectedRootClaim.selector, computeRootClaim(keccak256("block"), keccak256("state")) + ) + ); _createGame(proposer, ANCHOR_L2_BLOCK, type(uint32).max, keccak256("block"), keccak256("state")); } @@ -189,12 +196,13 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_challenge_updatesState() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.prank(challenger); - TeeDisputeGame.ProposalStatus proposalStatus = game.challenge{value: CHALLENGER_BOND}(); + TeeDisputeGame.ProposalStatus proposalStatus = game.challenge{ value: CHALLENGER_BOND }(); - (, address counteredBy,, , TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); + (, address counteredBy,,, TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); assertEq(counteredBy, challenger); assertEq(uint8(proposalStatus), uint8(TeeDisputeGame.ProposalStatus.Challenged)); assertEq(uint8(storedStatus), uint8(TeeDisputeGame.ProposalStatus.Challenged)); @@ -202,22 +210,24 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_challenge_revertIncorrectBond() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.prank(challenger); vm.expectRevert(IncorrectBondAmount.selector); - game.challenge{value: CHALLENGER_BOND - 1}(); + game.challenge{ value: CHALLENGER_BOND - 1 }(); } function test_challenge_revertWhenAlreadyChallenged() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); vm.prank(challenger); vm.expectRevert(ClaimAlreadyChallenged.selector); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); } function test_prove_succeedsWithSingleBatch() public { @@ -242,7 +252,7 @@ contract TeeDisputeGameTest is TeeTestUtils { vm.prank(proposer); TeeDisputeGame.ProposalStatus status = game.prove(abi.encode(proofs)); - (, , address prover,, TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); + (,, address prover,, TeeDisputeGame.ProposalStatus storedStatus,) = game.claimData(); assertEq(prover, proposer); assertEq(uint8(status), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); assertEq(uint8(storedStatus), uint8(TeeDisputeGame.ProposalStatus.UnchallengedAndValidProofProvided)); @@ -289,7 +299,8 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_prove_revertEmptyBatchProofs() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.prank(proposer); vm.expectRevert(TeeDisputeGame.EmptyBatchProofs.selector); @@ -397,7 +408,11 @@ contract TeeDisputeGameTest is TeeTestUtils { ); vm.prank(proposer); - vm.expectRevert(abi.encodeWithSelector(TeeDisputeGame.BatchBlockNotIncreasing.selector, 1, ANCHOR_L2_BLOCK + 4, ANCHOR_L2_BLOCK + 4)); + vm.expectRevert( + abi.encodeWithSelector( + TeeDisputeGame.BatchBlockNotIncreasing.selector, 1, ANCHOR_L2_BLOCK + 4, ANCHOR_L2_BLOCK + 4 + ) + ); game.prove(abi.encode(proofs)); } @@ -453,7 +468,9 @@ contract TeeDisputeGameTest is TeeTestUtils { ); vm.expectRevert( - abi.encodeWithSelector(TeeDisputeGame.FinalBlockMismatch.selector, game.l2SequenceNumber(), game.l2SequenceNumber() - 1) + abi.encodeWithSelector( + TeeDisputeGame.FinalBlockMismatch.selector, game.l2SequenceNumber(), game.l2SequenceNumber() - 1 + ) ); vm.prank(proposer); game.prove(abi.encode(proofs)); @@ -547,7 +564,7 @@ contract TeeDisputeGameTest is TeeTestUtils { // Challenger challenges the child vm.prank(challenger); - child.challenge{value: CHALLENGER_BOND}(); + child.challenge{ value: CHALLENGER_BOND }(); // Time passes: parent is challenged and times out → CHALLENGER_WINS vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); @@ -594,7 +611,7 @@ contract TeeDisputeGameTest is TeeTestUtils { _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Timeout without proof → CHALLENGER_WINS vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); @@ -624,7 +641,7 @@ contract TeeDisputeGameTest is TeeTestUtils { _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Proposer proves — game would normally be DEFENDER_WINS teeProofVerifier.setRegistered(executor, true); @@ -660,7 +677,8 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_closeGame_revertWhenNotFinalized() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); game.resolve(); @@ -669,7 +687,8 @@ contract TeeDisputeGameTest is TeeTestUtils { } function test_resolve_revertWhenGameNotOver() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); vm.expectRevert(GameNotOver.selector); game.resolve(); @@ -690,7 +709,11 @@ contract TeeDisputeGameTest is TeeTestUtils { vm.startPrank(creator, creator); game = TeeDisputeGame( - payable(address(factory.create{value: DEFENDER_BOND}(GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData))) + payable( + address( + factory.create{ value: DEFENDER_BOND }(GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData) + ) + ) ); vm.stopPrank(); } diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index 0ff0f837bd6a4..aa2ec8a553b0c 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -1,32 +1,24 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {Vm} from "forge-std/Vm.sol"; -import {Proxy} from "src/universal/Proxy.sol"; -import {AnchorStateRegistry} from "src/dispute/AnchorStateRegistry.sol"; -import {DisputeGameFactory} from "src/dispute/DisputeGameFactory.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; -import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; -import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; -import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import { - BondDistributionMode, - Claim, - Duration, - GameStatus, - GameType, - Hash, - Proposal -} from "src/dispute/lib/Types.sol"; -import {GameNotFinalized} from "src/dispute/lib/Errors.sol"; -import {ParentGameNotResolved, InvalidParentGame} from "src/dispute/tee/lib/Errors.sol"; -import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; -import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; -import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; +import { Vm } from "forge-std/Vm.sol"; +import { Proxy } from "src/universal/Proxy.sol"; +import { AnchorStateRegistry } from "src/dispute/AnchorStateRegistry.sol"; +import { DisputeGameFactory } from "src/dispute/DisputeGameFactory.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; +import { BondDistributionMode, Claim, Duration, GameStatus, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; +import { GameNotFinalized } from "src/dispute/lib/Errors.sol"; +import { ParentGameNotResolved, InvalidParentGame } from "src/dispute/tee/lib/Errors.sol"; +import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; /// @title TeeDisputeGameIntegrationTest /// @notice Integration tests for the full TEE dispute game lifecycle using real contracts. @@ -97,7 +89,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { /// @notice create → (no challenge) → timeout → resolve → closeGame → claimCredit function test_lifecycle_unchallenged_defenderWins() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); // Wait for challenge window to expire vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); @@ -130,11 +123,12 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { function test_lifecycle_challenged_proveByProposer_defenderWins() public { bytes32 endBlockHash = keccak256("end-block"); bytes32 endStateHash = keccak256("end-state"); - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); // Challenger challenges vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Proposer proves with real TeeProofVerifier TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); @@ -176,11 +170,12 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { /// @dev A CHALLENGER_WINS game is still "proper" per ASR (registered, not blacklisted, /// not retired, not paused), so closeGame → NORMAL mode. The challenger wins all bonds. function test_lifecycle_challenged_timeout_challengerWins() public { - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); // Challenger challenges vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Nobody proves — wait for prove deadline vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); @@ -218,11 +213,12 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { function test_lifecycle_blacklisted_refund() public { bytes32 endBlockHash = keccak256("end-block"); bytes32 endStateHash = keccak256("end-state"); - (TeeDisputeGame game,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); // Challenger challenges vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Proposer proves TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); @@ -273,9 +269,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { bytes32 parentEndStateHash = keccak256("parent-end-state"); // Create parent game (root game, parentIndex = max) - (TeeDisputeGame parent,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash - ); + (TeeDisputeGame parent,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash); // Wait for challenge window and resolve parent vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); @@ -288,9 +283,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // Create child game referencing parent (parentIndex = 0) bytes32 childEndBlockHash = keccak256("child-end-block"); bytes32 childEndStateHash = keccak256("child-end-state"); - (TeeDisputeGame child,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash - ); + (TeeDisputeGame child,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash); // Verify child's startingOutputRoot comes from parent (Hash childStartRoot, uint256 childStartBlock) = child.startingOutputRoot(); @@ -337,24 +330,21 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { bytes32 parentEndStateHash = keccak256("parent-end-state"); // Create parent (still IN_PROGRESS) - (TeeDisputeGame parent,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash - ); + (TeeDisputeGame parent,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash); // Create child BEFORE parent resolves (parentIndex = 0) bytes32 childEndBlockHash = keccak256("child-end-block"); bytes32 childEndStateHash = keccak256("child-end-state"); - (TeeDisputeGame child,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash - ); + (TeeDisputeGame child,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash); // Challenge child so there's a challenger to receive bonds vm.prank(challenger); - child.challenge{value: CHALLENGER_BOND}(); + child.challenge{ value: CHALLENGER_BOND }(); // Now challenge parent and let it timeout → CHALLENGER_WINS vm.prank(challenger); - parent.challenge{value: CHALLENGER_BOND}(); + parent.challenge{ value: CHALLENGER_BOND }(); vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); parent.resolve(); @@ -386,20 +376,17 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { bytes32 parentEndStateHash = keccak256("parent-end-state"); // Create parent (still IN_PROGRESS) - (TeeDisputeGame parent,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash - ); + (TeeDisputeGame parent,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, parentEndBlockHash, parentEndStateHash); // Create child BEFORE parent resolves — child is NOT challenged bytes32 childEndBlockHash = keccak256("child-end-block"); bytes32 childEndStateHash = keccak256("child-end-state"); - (TeeDisputeGame child,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash - ); + (TeeDisputeGame child,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 10, 0, childEndBlockHash, childEndStateHash); // Challenge parent and let it timeout → CHALLENGER_WINS vm.prank(challenger); - parent.challenge{value: CHALLENGER_BOND}(); + parent.challenge{ value: CHALLENGER_BOND }(); vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); parent.resolve(); @@ -429,13 +416,16 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { function test_lifecycle_childCannotResolveBeforeParent() public { // Create parent (unchallenged, still in progress) (TeeDisputeGame parent,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("parent-end-block"), keccak256("parent-end-state") + proposer, + ANCHOR_L2_BLOCK + 5, + type(uint32).max, + keccak256("parent-end-block"), + keccak256("parent-end-state") ); // Create child referencing parent - (TeeDisputeGame child,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 10, 0, keccak256("child-end-block"), keccak256("child-end-state") - ); + (TeeDisputeGame child,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 10, 0, keccak256("child-end-block"), keccak256("child-end-state")); // Fast forward past child's challenge window vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); @@ -468,7 +458,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // Create via router vm.startPrank(proposer, proposer); - address proxy = router.create{value: DEFENDER_BOND}(zoneId, TEE_GAME_TYPE, rootClaim, extraData); + address proxy = router.create{ value: DEFENDER_BOND }(zoneId, TEE_GAME_TYPE, rootClaim, extraData); vm.stopPrank(); TeeDisputeGame game = TeeDisputeGame(payable(proxy)); @@ -479,7 +469,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // Challenge vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); // Prove TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); @@ -526,11 +516,12 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { factory.setInitBond(XL_GAME_TYPE, DEFENDER_BOND); // Create an XL game (index 0) — factory records it as GameType 1 - bytes memory xlExtraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); + bytes memory xlExtraData = + buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); Claim xlRootClaim = computeRootClaim(keccak256("xl-block"), keccak256("xl-state")); vm.startPrank(proposer, proposer); - factory.create{value: DEFENDER_BOND}(XL_GAME_TYPE, xlRootClaim, xlExtraData); + factory.create{ value: DEFENDER_BOND }(XL_GAME_TYPE, xlRootClaim, xlExtraData); vm.stopPrank(); // Try to create a TZ game (GameType 1960) with parentIndex=0 (the XL game) @@ -540,7 +531,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { vm.startPrank(proposer, proposer); vm.expectRevert(InvalidParentGame.selector); - factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, tzRootClaim, tzExtraData); + factory.create{ value: DEFENDER_BOND }(TEE_GAME_TYPE, tzRootClaim, tzExtraData); vm.stopPrank(); } @@ -557,7 +548,8 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { // Create and resolve a TZ game (DEFENDER_WINS) bytes32 endBlockHash = keccak256("tz-end-block"); bytes32 endStateHash = keccak256("tz-end-state"); - (TeeDisputeGame tzGame,,) = _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + (TeeDisputeGame tzGame,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); tzGame.resolve(); @@ -587,31 +579,31 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { factory.setInitBond(XL_GAME_TYPE, DEFENDER_BOND); // Create XL game (index 0) - bytes memory xlExtraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); + bytes memory xlExtraData = + buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("xl-block"), keccak256("xl-state")); Claim xlRootClaim = computeRootClaim(keccak256("xl-block"), keccak256("xl-state")); vm.startPrank(proposer, proposer); - factory.create{value: DEFENDER_BOND}(XL_GAME_TYPE, xlRootClaim, xlExtraData); + factory.create{ value: DEFENDER_BOND }(XL_GAME_TYPE, xlRootClaim, xlExtraData); vm.stopPrank(); // Create TZ game (index 1) - (TeeDisputeGame tzParent,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("tz-block"), keccak256("tz-state") - ); + (TeeDisputeGame tzParent,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("tz-block"), keccak256("tz-state")); // TZ child referencing TZ parent (index 1, same type) — should succeed - (TeeDisputeGame tzChild,,) = _createGame( - proposer, ANCHOR_L2_BLOCK + 10, 1, keccak256("tz-child-block"), keccak256("tz-child-state") - ); + (TeeDisputeGame tzChild,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 10, 1, keccak256("tz-child-block"), keccak256("tz-child-state")); assertEq(uint8(tzChild.status()), uint8(GameStatus.IN_PROGRESS)); // TZ child referencing XL parent (index 0, wrong type) — should revert - bytes memory badExtraData = buildExtraData(ANCHOR_L2_BLOCK + 15, 0, keccak256("bad-block"), keccak256("bad-state")); + bytes memory badExtraData = + buildExtraData(ANCHOR_L2_BLOCK + 15, 0, keccak256("bad-block"), keccak256("bad-state")); Claim badRootClaim = computeRootClaim(keccak256("bad-block"), keccak256("bad-state")); vm.startPrank(proposer, proposer); vm.expectRevert(InvalidParentGame.selector); - factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, badRootClaim, badExtraData); + factory.create{ value: DEFENDER_BOND }(TEE_GAME_TYPE, badRootClaim, badExtraData); vm.stopPrank(); } @@ -666,7 +658,10 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { return verifier; } - function _deployAnchorStateRegistryForType(DisputeGameFactory _factory, GameType _gameType) + function _deployAnchorStateRegistryForType( + DisputeGameFactory _factory, + GameType _gameType + ) internal returns (AnchorStateRegistry) { @@ -706,9 +701,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { vm.startPrank(creator, creator); game = TeeDisputeGame( - payable( - address(factory.create{value: DEFENDER_BOND}(TEE_GAME_TYPE, rootClaim, extraData)) - ) + payable(address(factory.create{ value: DEFENDER_BOND }(TEE_GAME_TYPE, rootClaim, extraData))) ); vm.stopPrank(); } diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol index 6a2fe2d2d7501..2b3fd2b76eac0 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -1,11 +1,11 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {Vm} from "forge-std/Vm.sol"; -import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; -import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; -import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; -import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import { Vm } from "forge-std/Vm.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { IRiscZeroVerifier } from "interfaces/dispute/IRiscZeroVerifier.sol"; +import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; contract TeeProofVerifierTest is TeeTestUtils { MockRiscZeroVerifier internal riscZeroVerifier; @@ -82,8 +82,7 @@ contract TeeProofVerifierTest is TeeTestUtils { function test_register_revertInvalidPublicKey() public { bytes memory shortPublicKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2))); - TeeProofVerifier.AttestationData memory data = - _buildAttestationData(1234, PCR_HASH, shortPublicKey, ""); + TeeProofVerifier.AttestationData memory data = _buildAttestationData(1234, PCR_HASH, shortPublicKey, ""); vm.expectRevert(TeeProofVerifier.InvalidPublicKey.selector); verifier.register(hex"1234", data); @@ -271,5 +270,4 @@ contract TeeProofVerifierTest is TeeTestUtils { vm.expectRevert("Ownable: new owner is the zero address"); verifier.transferOwnership(address(0)); } - } diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol index eb45bb087e26b..8dd40413e62e9 100644 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol @@ -1,24 +1,24 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {Vm} from "forge-std/Vm.sol"; -import {Proxy} from "src/universal/Proxy.sol"; -import {AnchorStateRegistry} from "src/dispute/AnchorStateRegistry.sol"; -import {DisputeGameFactory} from "src/dispute/DisputeGameFactory.sol"; -import {PermissionedDisputeGame} from "src/dispute/PermissionedDisputeGame.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol"; -import {ISystemConfig} from "interfaces/L1/ISystemConfig.sol"; -import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; -import {TeeDisputeGame, TEE_DISPUTE_GAME_TYPE} from "src/dispute/tee/TeeDisputeGame.sol"; -import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; -import {Claim, Duration, GameStatus, GameType, Hash, Proposal} from "src/dispute/lib/Types.sol"; -import {TeeTestUtils} from "test/dispute/tee/helpers/TeeTestUtils.sol"; -import {MockRiscZeroVerifier} from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; -import {MockSystemConfig} from "test/dispute/tee/mocks/MockSystemConfig.sol"; +import { Vm } from "forge-std/Vm.sol"; +import { Proxy } from "src/universal/Proxy.sol"; +import { AnchorStateRegistry } from "src/dispute/AnchorStateRegistry.sol"; +import { DisputeGameFactory } from "src/dispute/DisputeGameFactory.sol"; +import { PermissionedDisputeGame } from "src/dispute/PermissionedDisputeGame.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; +import { IDisputeGameFactoryRouter } from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { Claim, Duration, GameStatus, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; +import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; contract DisputeGameFactoryRouterForkTest is TeeTestUtils { struct SecondZoneFixture { @@ -96,7 +96,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { bytes memory extraData = abi.encodePacked(uint256(1_000_000_000)); vm.startPrank(xLayer.proposer, xLayer.proposer); - address proxy = router.create{value: xLayer.initBond}(ZONE_XLAYER, xLayer.gameType, rootClaim, extraData); + address proxy = router.create{ value: xLayer.initBond }(ZONE_XLAYER, xLayer.gameType, rootClaim, extraData); vm.stopPrank(); assertTrue(proxy != address(0)); @@ -165,7 +165,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { }); vm.startPrank(xLayer.proposer, xLayer.proposer); - address[] memory proxies = router.createBatch{value: xLayer.initBond + DEFENDER_BOND}(params); + address[] memory proxies = router.createBatch{ value: xLayer.initBond + DEFENDER_BOND }(params); vm.stopPrank(); assertEq(proxies.length, 2); @@ -234,7 +234,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { rootClaim = computeRootClaim(endBlockHash, endStateHash); vm.startPrank(proposer, proposer); - address proxy = router.create{value: DEFENDER_BOND}(ZONE_SECOND, TEE_GAME_TYPE, rootClaim, extraData); + address proxy = router.create{ value: DEFENDER_BOND }(ZONE_SECOND, TEE_GAME_TYPE, rootClaim, extraData); vm.stopPrank(); game = TeeDisputeGame(payable(proxy)); @@ -253,7 +253,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { assertEq(startingBlockNumber, ANCHOR_L2_BLOCK); vm.prank(challenger); - game.challenge{value: CHALLENGER_BOND}(); + game.challenge{ value: CHALLENGER_BOND }(); TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); proofs[0] = buildBatchProof( @@ -306,10 +306,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { function _deployLocalDisputeGameFactory() internal returns (DisputeGameFactory factory) { DisputeGameFactory implementation = new DisputeGameFactory(); Proxy proxy = new Proxy(address(this)); - proxy.upgradeToAndCall( - address(implementation), - abi.encodeCall(implementation.initialize, (address(this))) - ); + proxy.upgradeToAndCall(address(implementation), abi.encodeCall(implementation.initialize, (address(this)))); factory = DisputeGameFactory(address(proxy)); } @@ -344,8 +341,7 @@ contract DisputeGameFactoryRouterForkTest is TeeTestUtils { { Vm.Wallet memory enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "fork-registered-enclave"); MockRiscZeroVerifier riscZeroVerifier = new MockRiscZeroVerifier(); - bytes memory expectedRootKey = - abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + bytes memory expectedRootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); registeredExecutor = enclaveWallet.addr; teeProofVerifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); diff --git a/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol index 6e990077f7c41..39e66995deb0e 100644 --- a/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol +++ b/packages/contracts-bedrock/test/dispute/tee/helpers/TeeTestUtils.sol @@ -1,10 +1,10 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {Test} from "forge-std/Test.sol"; -import {Vm} from "forge-std/Vm.sol"; -import {Claim} from "src/dispute/lib/Types.sol"; -import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; +import { Test } from "forge-std/Test.sol"; +import { Vm } from "forge-std/Vm.sol"; +import { Claim } from "src/dispute/lib/Types.sol"; +import { TeeDisputeGame } from "src/dispute/tee/TeeDisputeGame.sol"; abstract contract TeeTestUtils is Test { uint256 internal constant DEFAULT_PROPOSER_KEY = 0xA11CE; @@ -60,9 +60,7 @@ abstract contract TeeTestUtils is Test { } function computeDomainSeparator(address verifier) internal view returns (bytes32) { - return keccak256( - abi.encode(DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, verifier) - ); + return keccak256(abi.encode(DOMAIN_TYPEHASH, DOMAIN_NAME_HASH, DOMAIN_VERSION_HASH, block.chainid, verifier)); } function computeEIP712Digest(BatchInput memory batch, bytes32 domainSeparator) internal pure returns (bytes32) { @@ -74,7 +72,11 @@ abstract contract TeeTestUtils is Test { return abi.encodePacked(r, s, v); } - function buildBatchProof(BatchInput memory batch, uint256 privateKey, bytes32 domainSeparator) + function buildBatchProof( + BatchInput memory batch, + uint256 privateKey, + bytes32 domainSeparator + ) internal returns (TeeDisputeGame.BatchProof memory) { @@ -88,7 +90,10 @@ abstract contract TeeTestUtils is Test { }); } - function buildBatchProofWithSignature(BatchInput memory batch, bytes memory signature) + function buildBatchProofWithSignature( + BatchInput memory batch, + bytes memory signature + ) internal pure returns (TeeDisputeGame.BatchProof memory) diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol index 4324c983dcda4..7632d51228a5b 100644 --- a/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol +++ b/packages/contracts-bedrock/test/dispute/tee/mocks/MockTeeProofVerifier.sol @@ -1,8 +1,8 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.15; -import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; -import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; +import { ECDSA } from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; contract MockTeeProofVerifier is ITeeProofVerifier { error EnclaveNotRegistered(); @@ -16,21 +16,14 @@ contract MockTeeProofVerifier is ITeeProofVerifier { registered[enclave] = value; } - function verifyBatch(bytes32 digest, bytes calldata signature) - external - view - returns (address signer) - { + function verifyBatch(bytes32 digest, bytes calldata signature) external view returns (address signer) { (address recovered, ECDSA.RecoverError err) = ECDSA.tryRecover(digest, signature); if (err != ECDSA.RecoverError.NoError || recovered == address(0)) revert InvalidSignature(); if (!registered[recovered]) revert EnclaveNotRegistered(); return recovered; } - function verifyBatchAndRecord(bytes32 digest, bytes calldata signature) - external - returns (address signer) - { + function verifyBatchAndRecord(bytes32 digest, bytes calldata signature) external returns (address signer) { lastDigest = digest; lastSignature = signature; return this.verifyBatch(digest, signature); From bf8a1799b3d488b6f58a9d1c5ea49a88c9095458 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Wed, 25 Mar 2026 15:46:49 +0800 Subject: [PATCH 16/24] docs: add local integration guide and E2E scripts for TEE prover Add forge scripts and documentation for TEE ZK Prover local testing: - DeployTeeMock.s.sol: deploys full TEE stack with MockRiscZeroVerifier - TeeProveE2E.s.sol: E2E flow (register, create, challenge, prove, resolve) with two modes: mock (ENCLAVE_KEY signs locally) and external (BATCH_SIGNATURE passed in from TEE prover, no private key exposure) - tee-local-integration-guide.md: Chinese integration guide covering architecture, EIP-712 signing spec, cast commands, and troubleshooting Co-Authored-By: Claude Opus 4.6 (1M context) --- .../tee/tee-local-integration-guide.md | 636 ++++++++++++++++++ .../scripts/tee/DeployTeeMock.s.sol | 172 +++++ .../scripts/tee/TeeProveE2E.s.sol | 270 ++++++++ 3 files changed, 1078 insertions(+) create mode 100644 packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md create mode 100644 packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol create mode 100644 packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol diff --git a/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md b/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md new file mode 100644 index 0000000000000..cab8b55724572 --- /dev/null +++ b/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md @@ -0,0 +1,636 @@ +# TEE Dispute Game 本地部署联调指南 + +> 供 TEE ZK Prover 对接联调使用，mock attestation + mock ZK proof。 +> 全部通过 forge script / cast 命令行操作。 + +## 目录 + +- [架构概览](#架构概览) +- [真实 vs Mock 对照](#真实-vs-mock-对照) +- [前置条件](#前置条件) +- [快速开始](#快速开始) +- [分步详解](#分步详解) + - [Step 1: 启动 Anvil](#step-1-启动-anvil) + - [Step 2: 部署合约](#step-2-部署合约) + - [Step 3: 运行 E2E](#step-3-运行-e2e) + - [Step 4: 领取 Bond](#step-4-领取-bond) +- [Prover 对接核心概念](#prover-对接核心概念) + - [注册 Enclave (Mock Attestation)](#注册-enclave-mock-attestation) + - [prove() 输入格式](#prove-输入格式) + - [从外部传入 prove 输入](#从外部传入-prove-输入) + - [EIP-712 签名规范](#eip-712-签名规范) + - [多 Batch 链式证明](#多-batch-链式证明) +- [单步 cast 调用参考](#单步-cast-调用参考) +- [数据结构参考](#数据结构参考) +- [常见问题排查](#常见问题排查) + +--- + +## 架构概览 + +``` ++-------------------------------------------------------------+ +| TEE ZK Prover (你的服务) | +| | +| 1. 生成 Nitro Attestation (mock) | +| 2. 生成 ZK Proof of Attestation (mock -> 空 seal) | +| 3. 调用 register() 注册 enclave | +| 4. 用 enclave 私钥对 batch 数据做 EIP-712 ECDSA 签名 | +| 5. 调用 prove() 提交 batch proof | ++-------------+--------------------------------+---------------+ + | | + v v ++------------------------+ +----------------------------+ +| TeeProofVerifier | | TeeDisputeGame | +| | | | +| register(seal, att) |<-----| prove(batchProofs) | +| -> ZK 验证 (mock) | | -> verifyBatch(digest, | +| -> 存储 enclave | | signature) | +| | | | +| verifyBatch(digest, |<-----| (ECDSA recover -> | +| signature) | | 检查是否已注册) | ++----------+-------------+ +----------------------------+ + | + v ++------------------------+ +| MockRiscZeroVerifier | +| (verify -> 直接通过) | ++------------------------+ +``` + +## 真实 vs Mock 对照 + +**合约层面：** + +| 合约 | 真实 / Mock | 说明 | +|---|---|---| +| `MockRiscZeroVerifier` | **Mock** | `verify()` 直接通过，接受任意 seal | +| `TeeProofVerifier` | **真实** | 真实的 enclave 注册 + ECDSA batch 验证逻辑 | +| `DisputeGameFactory` | **真实** | 通过 Proxy 部署，创建 game 实例 | +| `AnchorStateRegistry` | **真实** | 通过 Proxy 部署，管理 anchor state | +| `TeeDisputeGame` | **真实** | 完整 game 逻辑：initialize, challenge, prove, resolve | +| `MockSystemConfig` | **Mock** | 返回 guardian 地址和 pause 状态 | + +**`prove()` 流程中的各部分：** + +| 部分 | 真实 / Mock | 生产环境对应 | +|---|---|---| +| `startBlockHash/stateHash` | Mock 数据（可外部传入） | TEE prover 从 L2 链上读取 | +| `endBlockHash/stateHash` | Mock 数据（可外部传入） | TEE prover 执行后计算得到 | +| `l2Block` | Mock 数据（可外部传入） | 真实 L2 区块号 | +| EIP-712 digest 计算 | **真实** | 链上合约用相同逻辑重算 | +| ECDSA 签名 | **真实** | enclave 私钥签署 EIP-712 digest | +| `verifyBatch()` ecrecover | **真实** | 恢复 signer 地址，检查注册状态 | + +整个 prove 流程中唯一 mock 的是**被签名的数据**（block/state hash 默认是假值，但可以通过环境变量替换为真实数据）。签名的生成和验证链路与生产环境完全一致。 + +--- + +## 前置条件 + +- 已安装 [Foundry](https://book.getfoundry.sh/getting-started/installation)（`forge`、`cast`、`anvil`） +- 已 clone 仓库并安装依赖 + +## 快速开始 + +```bash +# Terminal 1: 启动 Anvil +anvil --block-time 1 + +# Terminal 2: 部署全部合约 +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER=0x70997970C51812dc3A010C7d01b50e0d17dc79C8 \ +CHALLENGER=0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC \ +forge script scripts/tee/DeployTeeMock.s.sol \ + --rpc-url http://localhost:8545 --broadcast + +# 从输出中复制 TEE_PROOF_VERIFIER 和 DISPUTE_GAME_FACTORY 地址，然后运行 E2E： +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ +CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ +ENCLAVE_KEY=0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6 \ +TEE_PROOF_VERIFIER=<部署输出的地址> \ +DISPUTE_GAME_FACTORY=<部署输出的地址> \ +forge script scripts/tee/TeeProveE2E.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +预期输出： + +``` +=== Step 1: Register Enclave (mock attestation + mock ZK proof) === + Enclave registered: 0x90F79bf6EB2c4f870365E785982E1f101E93b906 + +=== Step 2: Create Game (proposer) === + Game created: 0xd8058efe0198ae9dD7D563e1b4938Dcbc86A1F81 + l2SequenceNumber: 100 + proposer: 0x70997970C51812dc3A010C7d01b50e0d17dc79C8 + +=== Step 3: Challenge (challenger) === + Game challenged by: 0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC + +=== Step 4: Prove - single batch (proposer submits, enclave signs) === + Domain separator from game: 0x7d2b73... + Batch signed, signature length: 65 + Proof submitted successfully! + +=== Step 5: Resolve === + Game resolved: DEFENDER_WINS + +=== E2E Complete (steps 1-5 passed) === +``` + +--- + +## 分步详解 + +### Step 1: 启动 Anvil + +```bash +anvil --block-time 1 +``` + +默认账户（每个预充 10000 ETH）： + +| 角色 | 私钥 | 地址 | +|---|---|---| +| Deployer / Owner | `0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80` | `0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266` | +| Proposer | `0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d` | `0x70997970C51812dc3A010C7d01b50e0d17dc79C8` | +| Challenger | `0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a` | `0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC` | +| Enclave (TEE Prover) | `0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6` | `0x90F79bf6EB2c4f870365E785982E1f101E93b906` | + +### Step 2: 部署合约 + +脚本：`scripts/tee/DeployTeeMock.s.sol` + +部署内容： +1. `MockRiscZeroVerifier` -- `verify()` 直接通过 +2. `TeeProofVerifier` -- 使用 mock verifier，但注册和 ECDSA 验证逻辑是真实的 +3. `DisputeGameFactory` -- 通过 Proxy 部署 +4. `AnchorStateRegistry` -- 通过 Proxy 部署，finality delay = 0 +5. `TeeDisputeGame` 实现合约 -- 注册为 game type 1960 + +测试用配置（脚本内硬编码）： + +| 参数 | 值 | +|---|---| +| `DEFENDER_BOND` | 0.1 ETH | +| `CHALLENGER_BOND` | 0.2 ETH | +| `MAX_CHALLENGE_DURATION` | 300 秒（5 分钟） | +| `MAX_PROVE_DURATION` | 300 秒（5 分钟） | +| `TEE_GAME_TYPE` | 1960 | +| `ANCHOR_L2_BLOCK` | 0 | + +```bash +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER=0x70997970C51812dc3A010C7d01b50e0d17dc79C8 \ +CHALLENGER=0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC \ +forge script scripts/tee/DeployTeeMock.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +保存输出的地址，下一步需要用到： + +``` +=== Deployed Addresses === +MockRiscZeroVerifier : 0x5FbDB2315678afecb367f032d93F642f64180aa3 +TeeProofVerifier : 0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 <-- 需要 +DisputeGameFactory : 0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 <-- 需要 +AnchorStateRegistry : 0xa513E6E4b8f2a923D98304ec87F64353C4D5C853 +TeeDisputeGame impl : 0x8A791620dd6260079BF849Dc5567aDC3F2FdC318 +``` + +### Step 3: 运行 E2E + +脚本：`scripts/tee/TeeProveE2E.s.sol` + +依次执行 5 个步骤： + +1. **注册 Enclave** -- `register("", attestationData)`，seal 传空字节（mock ZK proof） +2. **创建 Game** -- `factory.create()`，proposer 存入 defender bond +3. **挑战** -- `game.challenge()`，challenger 存入 challenger bond +4. **提交证明** -- 构造 EIP-712 digest，用 enclave 私钥签名，调用 `game.prove()` +5. **解决** -- `game.resolve()` 返回 `DEFENDER_WINS` + +```bash +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ +CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ +ENCLAVE_KEY=0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6 \ +TEE_PROOF_VERIFIER=0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 \ +DISPUTE_GAME_FACTORY=0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 \ +forge script scripts/tee/TeeProveE2E.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +### Step 4: 领取 Bond + +`claimCredit` 需要满足 `resolvedAt + finalityDelay < block.timestamp`。由于 forge script 中所有交易在同一个区块执行，必须单独调用。等待至少 1 秒后： + +```bash +# 将 替换为 Step 3 输出的 Game created 地址 +cast send 'claimCredit(address)' \ + 0x70997970C51812dc3A010C7d01b50e0d17dc79C8 \ + --private-key 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ + --rpc-url http://localhost:8545 +``` + +--- + +## Prover 对接核心概念 + +### 注册 Enclave (Mock Attestation) + +```solidity +function register(bytes calldata seal, AttestationData calldata attestationData) external onlyOwner +``` + +使用 `MockRiscZeroVerifier` 时，ZK proof 验证被跳过。只需提供： + +- `seal`：空字节 `0x` +- `attestationData.publicKey`：**65 字节 secp256k1 未压缩公钥**（`0x04` + 32 字节 x + 32 字节 y） +- `attestationData.timestampMs`：任意 uint64 +- `attestationData.pcrHash`：任意 bytes32 +- `attestationData.userData`：可为空 + +合约通过 `keccak256(x || y)` 从公钥中提取 Ethereum 地址。后续 `verifyBatch()` 会通过 ECDSA recover 得到 signer 地址，与这个注册地址进行比对。 + +**关键**：用于签名 batch 的私钥必须与注册时提供的公钥是同一对密钥。 + +### prove() 输入格式 + +```solidity +function prove(bytes calldata proofBytes) external returns (ProposalStatus) +``` + +`proofBytes` = `abi.encode(BatchProof[])`： + +```solidity +struct BatchProof { + bytes32 startBlockHash; + bytes32 startStateHash; + bytes32 endBlockHash; + bytes32 endStateHash; + uint256 l2Block; + bytes signature; // 65 字节：r(32) + s(32) + v(1) +} +``` + +链上对每个 batch 的验证逻辑： + +1. `keccak256(abi.encode(proofs[0].startBlockHash, startStateHash))` == `startingOutputRoot.root`（起始状态匹配 anchor） +2. `proofs[i].end == proofs[i+1].start`（链式连续性） +3. `proofs[i].l2Block < proofs[i+1].l2Block`（单调递增） +4. 链上重算 EIP-712 digest + signature，通过 `TeeProofVerifier.verifyBatch()` 验证 +5. `keccak256(abi.encode(proofs[last].endBlockHash, endStateHash))` == `rootClaim`（终态匹配 rootClaim） +6. `proofs[last].l2Block` == `l2SequenceNumber`（最终区块号匹配） + +### 从外部传入 prove 输入 + +`TeeProveE2E.s.sol` 支持两种模式： + +**Mock 模式**（默认）：脚本用 `ENCLAVE_KEY` 在本地签名，用于快速验证全流程。 + +**External 模式**（对接用）：TEE prover 在 enclave 内签好名，把 signature 传出来。脚本不需要也不应该拿到 enclave 私钥。 + +#### 环境变量 + +| 变量 | 必填 | 默认值 | 说明 | +|---|---|---|---| +| `BATCH_SIGNATURE` | External 模式必填 | 无 | 65 字节签名 hex（`r+s+v`），设置后进入 external 模式 | +| `ENCLAVE_ADDR` | External 模式必填 | 无 | 已注册的 enclave 地址（用于校验注册状态） | +| `ENCLAVE_KEY` | Mock 模式必填 | 无 | enclave 私钥，仅 mock 模式使用 | +| `START_BLOCK_HASH` | 否 | `keccak256("genesis-block")` | batch 起始 block hash，必须匹配 anchor | +| `START_STATE_HASH` | 否 | `keccak256("genesis-state")` | batch 起始 state hash，必须匹配 anchor | +| `END_BLOCK_HASH` | 否 | `keccak256("end-block-100")` | batch 终态 block hash | +| `END_STATE_HASH` | 否 | `keccak256("end-state-100")` | batch 终态 state hash | +| `L2_SEQUENCE_NUMBER` | 否 | `100` | L2 区块号 | + +#### External 模式（TEE Prover 对接） + +TEE prover 的对接流程： + +1. Prover 从链上查询 `game.domainSeparator()` 和 batch 数据 +2. Prover 在 TEE enclave 内按 [EIP-712 签名规范](#eip-712-签名规范) 计算 digest 并签名 +3. Prover 将 65 字节签名（`r+s+v`）传出 +4. 通过 `BATCH_SIGNATURE` 环境变量传给脚本 + +```bash +# 1. 先查询 domain separator（prover 签名时需要） +cast call 'domainSeparator()(bytes32)' --rpc-url http://localhost:8545 + +# 2. TEE prover 在 enclave 内签名，产出 65 字节签名 hex + +# 3. 用外部签名运行脚本 +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ +CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ +TEE_PROOF_VERIFIER=0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 \ +DISPUTE_GAME_FACTORY=0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 \ +ENCLAVE_ADDR=0x<已注册的 enclave 地址> \ +BATCH_SIGNATURE=0x<65 字节 r+s+v 签名 hex> \ +END_BLOCK_HASH=0x \ +END_STATE_HASH=0x \ +L2_SEQUENCE_NUMBER=<目标 L2 区块号> \ +forge script scripts/tee/TeeProveE2E.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +> 注意：external 模式下不需要设置 `ENCLAVE_KEY`。enclave 私钥始终留在 TEE 内部，不会暴露。 + +#### Mock 模式（快速验证） + +```bash +# 脚本用 ENCLAVE_KEY 在本地签名 +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ +CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ +ENCLAVE_KEY=0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6 \ +TEE_PROOF_VERIFIER=0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 \ +DISPUTE_GAME_FACTORY=0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 \ +forge script scripts/tee/TeeProveE2E.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +#### 注意事项 + +- `START_BLOCK_HASH` / `START_STATE_HASH` 必须满足 `keccak256(abi.encode(startBlockHash, startStateHash))` 等于链上 anchor state 的 root。可查询：`cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)'` +- `END_BLOCK_HASH` / `END_STATE_HASH` 的 `keccak256(abi.encode(...))` 会作为 `rootClaim` 写入 game。 +- `L2_SEQUENCE_NUMBER` 必须大于 anchor 的 l2SequenceNumber。 +- `BATCH_SIGNATURE` 必须是对正确 EIP-712 digest 的签名，且签名者必须是已注册的 enclave。签名格式：`abi.encodePacked(r, s, v)` = 65 字节。 + +**查询当前 anchor state（用于确定 START_BLOCK_HASH / START_STATE_HASH）：** + +```bash +# 返回 (root, l2SequenceNumber) +cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)' \ + --rpc-url http://localhost:8545 +``` + +默认部署的 anchor root = `keccak256(abi.encode(keccak256("genesis-block"), keccak256("genesis-state")))`，l2SequenceNumber = 0。 + +### EIP-712 签名规范 + +这是 prover 对接最关键的部分。domain、types、字段顺序有任何偏差都会导致 `verifyBatch()` revert。 + +**Domain：** + +``` +name: "TeeDisputeGame" +version: "1" +chainId: <当前链 ID> (Anvil = 31337) +verifyingContract: (注意：不是 game 地址！) +``` + +**Type：** + +``` +BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block) +``` + +**Domain separator（链上计算方式）：** + +``` +domainSeparator = keccak256(abi.encode( + keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), + keccak256("TeeDisputeGame"), + keccak256("1"), + chainId, + address(TeeProofVerifier) +)) +``` + +**Struct hash：** + +``` +structHash = keccak256(abi.encode( + keccak256("BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)"), + startBlockHash, + startStateHash, + endBlockHash, + endStateHash, + l2Block +)) +``` + +**最终 digest：** + +``` +digest = keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash)) +``` + +**签名格式：** `abi.encodePacked(r, s, v)` = 32 + 32 + 1 = **65 字节** + +可以通过调用 `game.domainSeparator()` 读取链上的 domain separator，与链下计算结果进行比对验证： + +```bash +cast call 'domainSeparator()(bytes32)' --rpc-url http://localhost:8545 +``` + +### 多 Batch 链式证明 + +多个 batch 覆盖不同的子范围，适用于不同的 TEE executor 处理不同的 L2 区块范围： + +``` +batch[0]: anchor -> mid1 (l2Block = 50) +batch[1]: mid1 -> mid2 (l2Block = 80) +batch[2]: mid2 -> endState (l2Block = 100) +``` + +规则： +- `batch[i].startBlockHash == batch[i-1].endBlockHash` 且 `batch[i].startStateHash == batch[i-1].endStateHash` +- `batch[i].l2Block > batch[i-1].l2Block` +- 每个 batch 可以由**不同的**已注册 enclave 签名 +- `batch[0].start` 必须匹配 anchor state +- `batch[last].end` 必须匹配 `rootClaim`，`batch[last].l2Block` 必须等于 `l2SequenceNumber` + +> 注意：当前 `TeeProveE2E.s.sol` 仅支持单 batch。如需测试多 batch，可参考 `test/dispute/tee/TeeDisputeGameIntegration.t.sol` 中的多 batch 测试用例自行扩展。 + +--- + +## 单步 cast 调用参考 + +如果需要脱离 E2E 脚本，单独调用各步骤（例如只测 prove 对接），可参考以下 cast 命令。 + +### 查询 enclave 注册状态 + +```bash +cast call $TEE_PROOF_VERIFIER \ + 'isRegistered(address)(bool)' $ENCLAVE_ADDR \ + --rpc-url http://localhost:8545 +``` + +### 查询 anchor state + +```bash +cast call $ANCHOR_STATE_REGISTRY \ + 'getAnchorRoot()(bytes32,uint256)' \ + --rpc-url http://localhost:8545 +``` + +### 查询 game 状态 + +```bash +# game status: 0=IN_PROGRESS, 1=CHALLENGER_WINS, 2=DEFENDER_WINS +cast call 'status()(uint8)' --rpc-url http://localhost:8545 + +# domain separator（用于验证链下 EIP-712 计算是否正确） +cast call 'domainSeparator()(bytes32)' --rpc-url http://localhost:8545 + +# l2SequenceNumber +cast call 'l2SequenceNumber()(uint256)' --rpc-url http://localhost:8545 + +# rootClaim +cast call 'rootClaim()(bytes32)' --rpc-url http://localhost:8545 + +# proposer +cast call 'proposer()(address)' --rpc-url http://localhost:8545 +``` + +### 领取 bond + +```bash +# 等 resolve 后至少 1 秒 +cast send 'claimCredit(address)' \ + --private-key \ + --rpc-url http://localhost:8545 +``` + +--- + +## 数据结构参考 + +### AttestationData（注册用） + +```solidity +struct AttestationData { + uint64 timestampMs; // Unix 时间戳（毫秒） + bytes32 pcrHash; // PCR hash（mock 时可填任意值） + bytes publicKey; // 65 字节：0x04 + x(32) + y(32) + bytes userData; // 附加数据（可为空） +} +``` + +### Game ExtraData（创建 game 用） + +``` +extraData = abi.encodePacked( + uint256 l2SequenceNumber, // L2 区块号 + uint32 parentIndex, // 无父 game = 0xFFFFFFFF + bytes32 endBlockHash, // 终态 block hash + bytes32 endStateHash // 终态 state hash +) +``` + +### Root Claim + +``` +rootClaim = keccak256(abi.encode(endBlockHash, endStateHash)) +``` + +### Game 生命周期 + +``` + create（proposer 存入 DEFENDER_BOND） + | + v + +---------- IN_PROGRESS ----------+ + | | + | challenge（可选） | prove（可选，EIP-712 签名的 batch） + | challenger 存入 | proposer 提交 + | CHALLENGER_BOND | enclave 签名的 proof + | | + +--------+----------------+------+ + | | + v v + deadline 过期 proof 已提交 + | | + v v + resolve() resolve() + | | + +------+------+ DEFENDER_WINS + | | （proposer 获得全部 bond） + v v + 无 proof 已 prove + | | + v v +CHALLENGER DEFENDER + _WINS _WINS +（challenger （proposer + 获得全部 获得全部 + bond） bond） +``` + +--- + +## 常见问题排查 + +### `register()` 报 `InvalidProof` 错误 + +确认部署的是 `MockRiscZeroVerifier` 并传给了 `TeeProofVerifier` 构造函数。mock 的 `shouldRevert` 默认为 `false`。 + +### `verifyBatch()` 报 `EnclaveNotRegistered` 错误 + +1. 确认 `register()` 已成功执行：`cast call $TEE_PROOF_VERIFIER 'isRegistered(address)(bool)' $ENCLAVE_ADDR` +2. 确认签名用的私钥与注册时的公钥是同一对 +3. 确认没有调用过 `revokeAll()`（会使所有注册失效） + +### `prove()` 报 `InvalidSignature` 错误 + +说明 ecrecover 恢复出的地址与预期不一致，检查以下几点： + +1. EIP-712 domain 中的 **`verifyingContract`** 必须是 `TeeProofVerifier` 地址（不是 game 地址） +2. **`chainId`** 必须匹配当前链（Anvil = 31337） +3. **签名格式**必须是 `r(32) + s(32) + v(1)` = 65 字节，用 `abi.encodePacked(r, s, v)` 打包 +4. 读取 `game.domainSeparator()` 与你的链下计算结果对比 + +### `prove()` 报 `StartHashMismatch` 错误 + +`batch[0].startBlockHash/startStateHash` 的组合 hash 必须等于 anchor state： + +``` +keccak256(abi.encode(startBlockHash, startStateHash)) == startingOutputRoot.root +``` + +对于首个 game（无父 game），anchor 来自 `AnchorStateRegistry`，可查询： + +```bash +cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)' --rpc-url http://localhost:8545 +``` + +### `prove()` 报 `FinalHashMismatch` 或 `FinalBlockMismatch` 错误 + +- 最后一个 batch 的 `endBlockHash/endStateHash` 必须满足：`keccak256(abi.encode(endBlockHash, endStateHash)) == rootClaim` +- 最后一个 batch 的 `l2Block` 必须等于 `game.l2SequenceNumber()` + +### `prove()` 报 `BatchChainBreak(i)` 错误 + +`batch[i].startBlockHash != batch[i-1].endBlockHash` 或 `startStateHash != endStateHash`。每个 batch 必须从上一个 batch 的终态开始。 + +### `prove()` 报 `BadAuth` 错误 + +`prove()` 只能由 proposer 调用（创建 game 时的 `tx.origin`）。 + +### `claimCredit()` 报 `GameNotFinalized` 错误 + +game 必须已 resolve 且 finality delay 已过：`resolvedAt + finalityDelay < block.timestamp`。mock 环境下 finality delay 为 0，但仍需等待至少 1 秒。在 forge script 中所有交易在同一个区块执行，所以需要单独用 `cast send` 调用。 + +### 如何获取 enclave 的未压缩公钥？ + +**Foundry (Solidity 中)：** +```solidity +Vm.Wallet memory wallet = vm.createWallet(privateKey, "label"); +bytes memory pubKey = abi.encodePacked( + bytes1(0x04), + bytes32(wallet.publicKeyX), + bytes32(wallet.publicKeyY) +); +``` + +**cast 命令行：** +```bash +# 获取地址 +cast wallet address $ENCLAVE_KEY +``` + +> 注意：`cast` 目前不直接输出未压缩公钥。E2E 脚本 (`TeeProveE2E.s.sol`) 内部通过 `vm.createWallet()` 自动处理了公钥的构造和注册。 diff --git a/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol b/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol new file mode 100644 index 0000000000000..afdb86c1dcd12 --- /dev/null +++ b/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol @@ -0,0 +1,172 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import { Script, console2 } from "forge-std/Script.sol"; +import { Proxy } from "src/universal/Proxy.sol"; +import { DisputeGameFactory } from "src/dispute/DisputeGameFactory.sol"; +import { AnchorStateRegistry } from "src/dispute/AnchorStateRegistry.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; +import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; +import { Duration, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; + +/// @title DeployTeeMock +/// @notice Deploys the full TEE dispute game stack with mock ZK verifier for local testing. +/// MockRiscZeroVerifier accepts any proof, so register() works with empty seal. +/// +/// @dev Usage: +/// anvil --block-time 1 +/// +/// PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +/// PROPOSER=0x70997970C51812dc3A010C7d01b50e0d17dc79C8 \ +/// CHALLENGER=0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC \ +/// forge script scripts/tee/DeployTeeMock.s.sol --rpc-url http://localhost:8545 --broadcast +contract DeployTeeMock is Script { + uint256 internal constant DEFENDER_BOND = 0.1 ether; + uint256 internal constant CHALLENGER_BOND = 0.2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 300; // 5 min (short for testing) + uint64 internal constant MAX_PROVE_DURATION = 300; // 5 min + + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("genesis-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("genesis-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 0; + + function run() external { + uint256 deployerKey = vm.envUint("PRIVATE_KEY"); + address deployer = vm.addr(deployerKey); + address proposer_ = vm.envAddress("PROPOSER"); + address challenger_ = vm.envAddress("CHALLENGER"); + + vm.startBroadcast(deployerKey); + + // 1. MockRiscZeroVerifier -- verify() is a no-op, any seal passes + MockRiscZeroVerifier mockRiscZero = new MockRiscZeroVerifier(); + + // 2. TeeProofVerifier with mock ZK verifier + TeeProofVerifier teeProofVerifier = _deployTeeProofVerifier(mockRiscZero); + + // 3. DisputeGameFactory (via Proxy) + DisputeGameFactory factory = _deployFactory(deployer); + + // 4. AnchorStateRegistry (via Proxy) + AnchorStateRegistry anchorStateRegistry = _deployAnchorStateRegistry(deployer, factory); + + // 5. TeeDisputeGame implementation + register in factory + TeeDisputeGame teeDisputeGame = + _deployAndRegisterGame(factory, teeProofVerifier, anchorStateRegistry, proposer_, challenger_); + + vm.stopBroadcast(); + + _logResults( + mockRiscZero, teeProofVerifier, factory, anchorStateRegistry, teeDisputeGame, proposer_, challenger_ + ); + } + + function _deployTeeProofVerifier(MockRiscZeroVerifier mockRiscZero) internal returns (TeeProofVerifier) { + bytes32 imageId = keccak256("mock-image-id"); + bytes memory rootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + return new TeeProofVerifier(mockRiscZero, imageId, rootKey); + } + + function _deployFactory(address deployer) internal returns (DisputeGameFactory) { + DisputeGameFactory factoryImpl = new DisputeGameFactory(); + Proxy factoryProxy = new Proxy(deployer); + factoryProxy.upgradeToAndCall(address(factoryImpl), abi.encodeCall(factoryImpl.initialize, (deployer))); + return DisputeGameFactory(address(factoryProxy)); + } + + function _deployAnchorStateRegistry( + address deployer, + DisputeGameFactory factory + ) + internal + returns (AnchorStateRegistry) + { + MockSystemConfig systemConfig = new MockSystemConfig(deployer); + AnchorStateRegistry asrImpl = new AnchorStateRegistry(0); // 0 finality delay for testing + Proxy asrProxy = new Proxy(deployer); + asrProxy.upgradeToAndCall( + address(asrImpl), + abi.encodeCall( + asrImpl.initialize, + ( + ISystemConfig(address(systemConfig)), + IDisputeGameFactory(address(factory)), + Proposal({ + root: Hash.wrap(keccak256(abi.encode(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH))), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + TEE_GAME_TYPE + ) + ) + ); + return AnchorStateRegistry(address(asrProxy)); + } + + function _deployAndRegisterGame( + DisputeGameFactory factory, + TeeProofVerifier teeProofVerifier, + AnchorStateRegistry anchorStateRegistry, + address proposer_, + address challenger_ + ) + internal + returns (TeeDisputeGame) + { + TeeDisputeGame teeDisputeGame = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(teeProofVerifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(anchorStateRegistry)), + proposer_, + challenger_ + ); + + factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(teeDisputeGame)), bytes("")); + factory.setInitBond(TEE_GAME_TYPE, DEFENDER_BOND); + + return teeDisputeGame; + } + + function _logResults( + MockRiscZeroVerifier mockRiscZero, + TeeProofVerifier teeProofVerifier, + DisputeGameFactory factory, + AnchorStateRegistry anchorStateRegistry, + TeeDisputeGame teeDisputeGame, + address proposer_, + address challenger_ + ) + internal + view + { + console2.log("=== Deployed Addresses ==="); + console2.log("MockRiscZeroVerifier :", address(mockRiscZero)); + console2.log("TeeProofVerifier :", address(teeProofVerifier)); + console2.log("DisputeGameFactory :", address(factory)); + console2.log("AnchorStateRegistry :", address(anchorStateRegistry)); + console2.log("TeeDisputeGame impl :", address(teeDisputeGame)); + console2.log(""); + console2.log("=== Config ==="); + console2.log("PROPOSER :", proposer_); + console2.log("CHALLENGER :", challenger_); + console2.log("DEFENDER_BOND :", DEFENDER_BOND); + console2.log("CHALLENGER_BOND :", CHALLENGER_BOND); + console2.log("MAX_CHALLENGE_DURATION:", MAX_CHALLENGE_DURATION); + console2.log("MAX_PROVE_DURATION :", MAX_PROVE_DURATION); + console2.log("TEE_GAME_TYPE :", TEE_DISPUTE_GAME_TYPE); + console2.log("ANCHOR_L2_BLOCK :", ANCHOR_L2_BLOCK); + console2.log("ANCHOR_BLOCK_HASH :", vm.toString(ANCHOR_BLOCK_HASH)); + console2.log("ANCHOR_STATE_HASH :", vm.toString(ANCHOR_STATE_HASH)); + } +} diff --git a/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol b/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol new file mode 100644 index 0000000000000..2adc62b5262d8 --- /dev/null +++ b/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol @@ -0,0 +1,270 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import { Script, console2 } from "forge-std/Script.sol"; +import { Vm } from "forge-std/Vm.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { Claim, GameType, GameStatus } from "src/dispute/lib/Types.sol"; + +/// @title TeeProveE2E +/// @notice End-to-end script: register enclave, create game, challenge, prove, resolve. +/// Two modes: +/// - Mock mode (default): ENCLAVE_KEY signs batch on-chain via vm.sign +/// - External mode: set BATCH_SIGNATURE to use a pre-built signature from TEE prover +/// +/// @dev Prerequisites: Run DeployTeeMock.s.sol first, then set the env vars below. +/// +/// # Required +/// PRIVATE_KEY= +/// PROPOSER_KEY= +/// CHALLENGER_KEY= +/// TEE_PROOF_VERIFIER=
+/// DISPUTE_GAME_FACTORY=
+/// +/// # Mock mode (script signs with enclave key): +/// ENCLAVE_KEY=0x... +/// +/// # External mode (prover signs off-chain, passes signature in): +/// BATCH_SIGNATURE=0x<65-byte r+s+v hex> +/// ENCLAVE_ADDR=0x +/// # ENCLAVE_KEY is not needed in this mode +/// +/// # Optional: override batch data (defaults to mock values if not set) +/// # START_BLOCK_HASH=0x... (default: keccak256("genesis-block"), must match anchor) +/// # START_STATE_HASH=0x... (default: keccak256("genesis-state"), must match anchor) +/// # END_BLOCK_HASH=0x... (default: keccak256("end-block-100")) +/// # END_STATE_HASH=0x... (default: keccak256("end-state-100")) +/// # L2_SEQUENCE_NUMBER=100 (default: 100) +/// +/// forge script scripts/tee/TeeProveE2E.s.sol --rpc-url http://localhost:8545 --broadcast +contract TeeProveE2E is Script { + bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( + "BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)" + ); + + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + // Stored after env reads, used across steps + TeeProofVerifier internal teeProofVerifier; + IDisputeGameFactory internal factory; + TeeDisputeGame internal game; + + // Prove inputs + bytes32 internal startBlockHash; + bytes32 internal startStateHash; + bytes32 internal endBlockHash; + bytes32 internal endStateHash; + uint256 internal l2SeqNum; + + function run() external { + // --- Read env --- + uint256 ownerKey = vm.envUint("PRIVATE_KEY"); + uint256 proposerKey = vm.envUint("PROPOSER_KEY"); + uint256 challengerKey = vm.envUint("CHALLENGER_KEY"); + + teeProofVerifier = TeeProofVerifier(vm.envAddress("TEE_PROOF_VERIFIER")); + factory = IDisputeGameFactory(vm.envAddress("DISPUTE_GAME_FACTORY")); + + // Prove inputs: env override or mock defaults + startBlockHash = vm.envOr("START_BLOCK_HASH", keccak256("genesis-block")); + startStateHash = vm.envOr("START_STATE_HASH", keccak256("genesis-state")); + endBlockHash = vm.envOr("END_BLOCK_HASH", keccak256("end-block-100")); + endStateHash = vm.envOr("END_STATE_HASH", keccak256("end-state-100")); + l2SeqNum = vm.envOr("L2_SEQUENCE_NUMBER", uint256(100)); + + // Determine mode: external signature or mock (enclave key signs locally) + bytes memory externalSig = vm.envOr("BATCH_SIGNATURE", bytes("")); + bool externalMode = externalSig.length > 0; + + // Step 1: Register enclave + console2.log("=== Step 1: Register Enclave (mock attestation + mock ZK proof) ==="); + if (externalMode) { + // External mode: enclave already registered by prover, just verify + address enclaveAddr = vm.envAddress("ENCLAVE_ADDR"); + require(teeProofVerifier.isRegistered(enclaveAddr), "ENCLAVE_ADDR not registered"); + console2.log("Enclave verified registered:", enclaveAddr); + } else { + uint256 enclaveKey = vm.envUint("ENCLAVE_KEY"); + _registerEnclave(ownerKey, enclaveKey); + } + + // Step 2: Create game + console2.log(""); + console2.log("=== Step 2: Create Game (proposer) ==="); + _createGame(proposerKey); + + // Step 3: Challenge + console2.log(""); + console2.log("=== Step 3: Challenge (challenger) ==="); + _challenge(challengerKey); + + // Step 4: Prove + console2.log(""); + if (externalMode) { + console2.log("=== Step 4: Prove - external signature from TEE prover ==="); + _proveExternal(proposerKey, externalSig); + } else { + console2.log("=== Step 4: Prove - mock mode (enclave key signs locally) ==="); + uint256 enclaveKey = vm.envUint("ENCLAVE_KEY"); + _proveMock(proposerKey, enclaveKey); + } + + // Step 5: Resolve + console2.log(""); + console2.log("=== Step 5: Resolve ==="); + _resolve(proposerKey); + + console2.log(""); + console2.log("=== E2E Complete (steps 1-5 passed) ==="); + console2.log(""); + console2.log("Note: claimCredit requires finality delay to pass (resolvedAt + delay < block.timestamp)."); + console2.log("In forge script all txns share the same block, so claimCredit must be called separately:"); + console2.log( + " cast send 'claimCredit(address)' --private-key --rpc-url http://localhost:8545" + ); + } + + // ---------------------------------------------------------------- + // Step 1: Register enclave with mock attestation + // ---------------------------------------------------------------- + + function _registerEnclave(uint256 ownerKey, uint256 enclaveKey) internal { + Vm.Wallet memory enclaveWallet = vm.createWallet(enclaveKey, "enclave"); + + if (teeProofVerifier.isRegistered(enclaveWallet.addr)) { + console2.log("Enclave already registered:", enclaveWallet.addr); + return; + } + + bytes memory pubKey = + abi.encodePacked(bytes1(0x04), bytes32(enclaveWallet.publicKeyX), bytes32(enclaveWallet.publicKeyY)); + + TeeProofVerifier.AttestationData memory att = TeeProofVerifier.AttestationData({ + timestampMs: uint64(block.timestamp * 1000), + pcrHash: keccak256("mock-pcr-hash"), + publicKey: pubKey, + userData: "" + }); + + vm.broadcast(ownerKey); + teeProofVerifier.register("", att); + + require(teeProofVerifier.isRegistered(enclaveWallet.addr), "register failed"); + console2.log("Enclave registered:", enclaveWallet.addr); + } + + // ---------------------------------------------------------------- + // Step 2: Create game + // ---------------------------------------------------------------- + + function _createGame(uint256 proposerKey) internal { + uint256 defenderBond = factory.initBonds(TEE_GAME_TYPE); + bytes memory extraData = abi.encodePacked(l2SeqNum, type(uint32).max, endBlockHash, endStateHash); + Claim rootClaim = Claim.wrap(keccak256(abi.encode(endBlockHash, endStateHash))); + + vm.broadcast(proposerKey); + game = + TeeDisputeGame(payable(address(factory.create{ value: defenderBond }(TEE_GAME_TYPE, rootClaim, extraData)))); + + console2.log("Game created:", address(game)); + console2.log(" l2SequenceNumber:", l2SeqNum); + console2.log(" rootClaim:", vm.toString(rootClaim.raw())); + console2.log(" proposer:", game.proposer()); + } + + // ---------------------------------------------------------------- + // Step 3: Challenge + // ---------------------------------------------------------------- + + function _challenge(uint256 challengerKey) internal { + uint256 challengerBond = vm.envOr("CHALLENGER_BOND", uint256(0.2 ether)); + vm.broadcast(challengerKey); + game.challenge{ value: challengerBond }(); + console2.log("Game challenged by:", vm.addr(challengerKey)); + } + + // ---------------------------------------------------------------- + // Step 4a: Prove with external signature (from TEE prover) + // ---------------------------------------------------------------- + + function _proveExternal(uint256 proposerKey, bytes memory signature) internal { + require(signature.length == 65, "BATCH_SIGNATURE must be 65 bytes (r+s+v)"); + + bytes32 domainSep = game.domainSeparator(); + console2.log("Domain separator:", vm.toString(domainSep)); + console2.log("Using external signature, length:", signature.length); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = TeeDisputeGame.BatchProof({ + startBlockHash: startBlockHash, + startStateHash: startStateHash, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: l2SeqNum, + signature: signature + }); + + vm.broadcast(proposerKey); + game.prove(abi.encode(proofs)); + + console2.log("Proof submitted successfully!"); + } + + // ---------------------------------------------------------------- + // Step 4b: Prove with mock signing (enclave key signs locally) + // ---------------------------------------------------------------- + + function _proveMock(uint256 proposerKey, uint256 enclaveKey) internal { + bytes32 domainSep = game.domainSeparator(); + console2.log("Domain separator:", vm.toString(domainSep)); + + bytes32 digest = _buildBatchDigest(domainSep); + console2.log("EIP-712 digest:", vm.toString(digest)); + + (uint8 v, bytes32 r, bytes32 s) = vm.sign(enclaveKey, digest); + bytes memory signature = abi.encodePacked(r, s, v); + console2.log("Batch signed, signature length:", signature.length); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = TeeDisputeGame.BatchProof({ + startBlockHash: startBlockHash, + startStateHash: startStateHash, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: l2SeqNum, + signature: signature + }); + + vm.broadcast(proposerKey); + game.prove(abi.encode(proofs)); + + console2.log("Proof submitted successfully!"); + } + + function _buildBatchDigest(bytes32 domainSep) internal view returns (bytes32) { + bytes32 structHash = keccak256( + abi.encode(BATCH_PROOF_TYPEHASH, startBlockHash, startStateHash, endBlockHash, endStateHash, l2SeqNum) + ); + return keccak256(abi.encodePacked("\x19\x01", domainSep, structHash)); + } + + // ---------------------------------------------------------------- + // Step 5: Resolve + // ---------------------------------------------------------------- + + function _resolve(uint256 callerKey) internal { + vm.broadcast(callerKey); + GameStatus result = game.resolve(); + + if (result == GameStatus.DEFENDER_WINS) { + console2.log("Game resolved: DEFENDER_WINS"); + } else if (result == GameStatus.CHALLENGER_WINS) { + console2.log("Game resolved: CHALLENGER_WINS"); + } else { + console2.log("Game resolved: IN_PROGRESS"); + } + } +} From 8c391c63d51640cf21a1686e9fab5f76148cba0b Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Wed, 25 Mar 2026 18:01:17 +0800 Subject: [PATCH 17/24] refactor: remove DisputeGameFactoryRouter in favor of shared DisputeGameFactory Decision to share the existing DisputeGameFactory directly, making the router layer unnecessary. Removes the contract, interface, all tests, deploy script references, and doc mentions. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../book/src/dispute/tee/AUDIT_FINDINGS.md | 2 +- .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 7 - .../dispute/IDisputeGameFactoryRouter.sol | 33 -- .../scripts/deploy/DeployTee.s.sol | 54 +-- .../src/dispute/DisputeGameFactoryRouter.sol | 81 ---- .../tee/DisputeGameFactoryRouter.t.sol | 108 ------ .../tee/DisputeGameFactoryRouterCreate.t.sol | 72 ---- .../test/dispute/tee/TeeDisputeGame.t.sol | 23 -- .../tee/TeeDisputeGameIntegration.t.sol | 70 +--- .../fork/DisputeGameFactoryRouterFork.t.sol | 361 ------------------ .../tee/mocks/MockCloneableDisputeGame.sol | 56 --- 11 files changed, 5 insertions(+), 862 deletions(-) delete mode 100644 packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol delete mode 100644 packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol delete mode 100644 packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol delete mode 100644 packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol delete mode 100644 packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol delete mode 100644 packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md index 07d8948df56ed..02ca5b4b3b356 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md @@ -246,7 +246,7 @@ A whitelisted proposer interacting with any malicious contract could have `facto **Recommendation:** This is a known OP Stack pattern. Document the risk prominently. Proposers should be advised to never interact with untrusted contracts from their whitelisted EOA. Long-term, consider passing the proposer address explicitly from the factory. -> **Response: Acknowledged, won't fix.** This is a known OP Stack pattern used across all permissioned dispute games (including `PermissionedDisputeGame`). `tx.origin` is necessary to attribute the proposer through intermediate contracts like `DisputeGameFactoryRouter`. Proposers are trusted operators that should use dedicated EOAs. +> **Response: Acknowledged, won't fix.** This is a known OP Stack pattern used across all permissioned dispute games (including `PermissionedDisputeGame`). `tx.origin` is necessary to attribute the proposer through intermediate contracts. Proposers are trusted operators that should use dedicated EOAs. --- diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index d44f81bc454ff..cf2090eb9d027 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -11,7 +11,6 @@ TeeDisputeGame is a dispute game contract for the OP Stack that replaces interac - Integrates with `AnchorStateRegistry` for anchor state management, finalization, and validity checks - Uses `BondDistributionMode` (NORMAL/REFUND) from the shared Types library - Implements `IDisputeGame` interface for compatibility with `OptimismPortal` and other OP infrastructure -- Adds a `DisputeGameFactoryRouter` for multi-zone game creation - Game type constant: `1960` --- @@ -22,12 +21,6 @@ TeeDisputeGame is a dispute game contract for the OP Stack that replaces interac ``` +---------------------------+ - | DisputeGameFactoryRouter | - | (multi-zone routing) | - +------------+--------------+ - | - v - +---------------------------+ | DisputeGameFactory | | (creates Clone proxies) | +-----+----------+----------+ diff --git a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol b/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol deleted file mode 100644 index ce5be8d20e179..0000000000000 --- a/packages/contracts-bedrock/interfaces/dispute/IDisputeGameFactoryRouter.sol +++ /dev/null @@ -1,33 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {GameType, Claim} from "src/dispute/lib/Types.sol"; - -/// @title IDisputeGameFactoryRouter -/// @notice Interface for routing dispute game creation across multiple zone factories. -interface IDisputeGameFactoryRouter { - /// @notice Parameters for creating a single dispute game in a batch. - struct CreateParams { - uint256 zoneId; - GameType gameType; - Claim rootClaim; - bytes extraData; - uint256 bond; - } - - // ============ Events ============ - - event ZoneSet(uint256 indexed zoneId, address indexed oldFactory, address indexed newFactory); - event GameCreated(uint256 indexed zoneId, address indexed proxy); - // ============ Errors ============ - - error ZoneNotRegistered(uint256 zoneId); - error BatchEmpty(); - error BatchBondMismatch(uint256 totalBonds, uint256 msgValue); - - // ============ Functions ============ - - function setZone(uint256 zoneId, address factory) external; - function create(uint256 zoneId, GameType gameType, Claim rootClaim, bytes calldata extraData) external payable returns (address proxy); - function createBatch(CreateParams[] calldata params) external payable returns (address[] memory proxies); -} diff --git a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol index 99dcad897ed31..3d991382817be 100644 --- a/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol +++ b/packages/contracts-bedrock/scripts/deploy/DeployTee.s.sol @@ -7,7 +7,6 @@ import {IAnchorStateRegistry} from "interfaces/dispute/IAnchorStateRegistry.sol" import {Duration} from "src/dispute/lib/Types.sol"; import {IRiscZeroVerifier} from "interfaces/dispute/IRiscZeroVerifier.sol"; import {ITeeProofVerifier} from "interfaces/dispute/ITeeProofVerifier.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; import {TeeDisputeGame} from "src/dispute/tee/TeeDisputeGame.sol"; import {TeeProofVerifier} from "src/dispute/tee/TeeProofVerifier.sol"; @@ -23,29 +22,14 @@ contract Deploy is Script { uint64 maxChallengeDuration; uint64 maxProveDuration; uint256 challengerBond; - bool deployRouter; address proofVerifierOwner; address proposer; address challenger; - uint256[] zoneIds; - address[] routerFactories; - address routerOwner; } - function run() - external - returns ( - TeeProofVerifier teeProofVerifier, - TeeDisputeGame teeDisputeGame, - DisputeGameFactoryRouter router - ) - { + function run() external returns (TeeProofVerifier teeProofVerifier, TeeDisputeGame teeDisputeGame) { DeployConfig memory cfg = _readConfig(); - if (cfg.deployRouter) { - require(cfg.zoneIds.length == cfg.routerFactories.length, "Deploy: router zone/factory length mismatch"); - } - vm.startBroadcast(cfg.deployerKey); teeProofVerifier = new TeeProofVerifier(cfg.riscZeroVerifier, cfg.imageId, cfg.nitroRootKey); @@ -64,18 +48,11 @@ contract Deploy is Script { cfg.challenger ); - if (cfg.deployRouter) { - router = _deployRouter(cfg.routerOwner, cfg.deployer, cfg.zoneIds, cfg.routerFactories); - } - vm.stopBroadcast(); console2.log("deployer", cfg.deployer); console2.log("teeProofVerifier", address(teeProofVerifier)); console2.log("teeDisputeGame", address(teeDisputeGame)); - if (cfg.deployRouter) { - console2.log("router", address(router)); - } } function _readConfig() internal view returns (DeployConfig memory cfg) { @@ -89,37 +66,8 @@ contract Deploy is Script { cfg.maxChallengeDuration = uint64(vm.envUint("MAX_CHALLENGE_DURATION")); cfg.maxProveDuration = uint64(vm.envUint("MAX_PROVE_DURATION")); cfg.challengerBond = vm.envUint("CHALLENGER_BOND"); - cfg.deployRouter = vm.envOr("DEPLOY_ROUTER", false); cfg.proofVerifierOwner = vm.envOr("PROOF_VERIFIER_OWNER", cfg.deployer); cfg.proposer = vm.envAddress("PROPOSER"); cfg.challenger = vm.envAddress("CHALLENGER"); - cfg.zoneIds = _envUintArray("ROUTER_ZONE_IDS"); - cfg.routerFactories = _envAddressArray("ROUTER_FACTORIES"); - cfg.routerOwner = vm.envOr("ROUTER_OWNER", cfg.deployer); - } - - function _deployRouter( - address routerOwner, - address, - uint256[] memory zoneIds, - address[] memory routerFactories - ) - internal - returns (DisputeGameFactoryRouter router) - { - router = new DisputeGameFactoryRouter(routerOwner); - for (uint256 i = 0; i < zoneIds.length; i++) { - router.setZone(zoneIds[i], routerFactories[i]); - } - } - - function _envAddressArray(string memory name) internal view returns (address[] memory values) { - if (!vm.envExists(name)) return new address[](0); - return vm.envAddress(name, ","); - } - - function _envUintArray(string memory name) internal view returns (uint256[] memory values) { - if (!vm.envExists(name)) return new uint256[](0); - return vm.envUint(name, ","); } } diff --git a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol b/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol deleted file mode 100644 index d9e0664e9e561..0000000000000 --- a/packages/contracts-bedrock/src/dispute/DisputeGameFactoryRouter.sol +++ /dev/null @@ -1,81 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; -import {GameType, Claim} from "src/dispute/lib/Types.sol"; -import {IDisputeGameFactory} from "interfaces/dispute/IDisputeGameFactory.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; - -/// @title DisputeGameFactoryRouter -/// @notice Routes dispute game creation to the correct zone's DisputeGameFactory. -/// @dev Each zone (identified by a uint256 zoneId) maps to a DisputeGameFactory address. -contract DisputeGameFactoryRouter is Ownable, IDisputeGameFactoryRouter { - /// @custom:semver 1.0.0 - string public constant version = "1.0.0"; - - /// @notice Mapping of zoneId to DisputeGameFactory address. - mapping(uint256 => address) public factories; - - constructor(address _owner) { - _transferOwnership(_owner); - } - - //////////////////////////////////////////////////////////////// - // Zone Management // - //////////////////////////////////////////////////////////////// - - /// @notice Set, update, or remove a zone's factory address. - /// @dev Pass address(0) as factory to remove the zone. - function setZone(uint256 zoneId, address factory) external onlyOwner { - address oldFactory = factories[zoneId]; - factories[zoneId] = factory; - emit ZoneSet(zoneId, oldFactory, factory); - } - - //////////////////////////////////////////////////////////////// - // Game Creation // - //////////////////////////////////////////////////////////////// - - /// @notice Create a single dispute game in the specified zone. - function create( - uint256 zoneId, - GameType gameType, - Claim rootClaim, - bytes calldata extraData - ) external payable returns (address proxy) { - address factory = factories[zoneId]; - if (factory == address(0)) revert ZoneNotRegistered(zoneId); - - IDisputeGame game = IDisputeGameFactory(factory).create{value: msg.value}( - gameType, rootClaim, extraData - ); - proxy = address(game); - emit GameCreated(zoneId, proxy); - } - - /// @notice Create dispute games across multiple zones in a single transaction. - /// @dev The sum of all params[i].bond must equal msg.value. - function createBatch(CreateParams[] calldata params) external payable returns (address[] memory proxies) { - if (params.length == 0) revert BatchEmpty(); - - uint256 totalBonds; - for (uint256 i = 0; i < params.length; i++) { - totalBonds += params[i].bond; - } - if (totalBonds != msg.value) revert BatchBondMismatch(totalBonds, msg.value); - - proxies = new address[](params.length); - for (uint256 i = 0; i < params.length; i++) { - address factory = factories[params[i].zoneId]; - if (factory == address(0)) revert ZoneNotRegistered(params[i].zoneId); - - IDisputeGame game = IDisputeGameFactory(factory).create{value: params[i].bond}( - params[i].gameType, params[i].rootClaim, params[i].extraData - ); - proxies[i] = address(game); - emit GameCreated(params[i].zoneId, proxies[i]); - } - } - -} diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol deleted file mode 100644 index 68231890cab15..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouter.t.sol +++ /dev/null @@ -1,108 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Test} from "forge-std/Test.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; -import {GameType, Claim} from "src/dispute/lib/Types.sol"; - -contract DisputeGameFactoryRouterTest is Test { - DisputeGameFactoryRouter public router; - - // XLayer factory on ETH mainnet - address constant XLAYER_FACTORY = 0x9D4c8FAEadDdDeeE1Ed0c92dAbAD815c2484f675; - - address owner; - address alice; - - uint256 constant ZONE_XLAYER = 1; - uint256 constant ZONE_OTHER = 2; - - function setUp() public { - owner = address(this); - alice = makeAddr("alice"); - router = new DisputeGameFactoryRouter(owner); - } - - //////////////////////////////////////////////////////////////// - // Zone Management Tests // - //////////////////////////////////////////////////////////////// - - function test_setZone_register() public { - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - assertEq(router.factories(ZONE_XLAYER), XLAYER_FACTORY); - } - - function test_setZone_update() public { - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - address newFactory = makeAddr("newFactory"); - router.setZone(ZONE_XLAYER, newFactory); - assertEq(router.factories(ZONE_XLAYER), newFactory); - } - - function test_setZone_remove() public { - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - router.setZone(ZONE_XLAYER, address(0)); - assertEq(router.factories(ZONE_XLAYER), address(0)); - } - - function test_setZone_emitsEvent() public { - vm.expectEmit(true, true, true, true); - emit IDisputeGameFactoryRouter.ZoneSet(ZONE_XLAYER, address(0), XLAYER_FACTORY); - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - } - - function test_setZone_revertNotOwner() public { - vm.prank(alice); - vm.expectRevert("Ownable: caller is not the owner"); - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - } - - //////////////////////////////////////////////////////////////// - // Create Tests // - //////////////////////////////////////////////////////////////// - - function test_create_revertZoneNotRegistered() public { - vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.ZoneNotRegistered.selector, ZONE_XLAYER)); - router.create(ZONE_XLAYER, GameType.wrap(0), Claim.wrap(bytes32(0)), ""); - } - - function test_createBatch_revertEmpty() public { - IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](0); - vm.expectRevert(IDisputeGameFactoryRouter.BatchEmpty.selector); - router.createBatch(params); - } - - function test_createBatch_revertBondMismatch() public { - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - - IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](1); - params[0] = IDisputeGameFactoryRouter.CreateParams({ - zoneId: ZONE_XLAYER, - gameType: GameType.wrap(0), - rootClaim: Claim.wrap(bytes32(0)), - extraData: "", - bond: 1 ether - }); - - vm.expectRevert(abi.encodeWithSelector(IDisputeGameFactoryRouter.BatchBondMismatch.selector, 1 ether, 0)); - router.createBatch(params); - } - - //////////////////////////////////////////////////////////////// - // View Function Tests // - //////////////////////////////////////////////////////////////// - - function test_factories_unregistered() public view { - assertEq(router.factories(999), address(0)); - } - - function test_factories_mapping() public { - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - assertEq(router.factories(ZONE_XLAYER), XLAYER_FACTORY); - } - - function test_version() public view { - assertEq(router.version(), "1.0.0"); - } -} diff --git a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol b/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol deleted file mode 100644 index 2877bc3695247..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/DisputeGameFactoryRouterCreate.t.sol +++ /dev/null @@ -1,72 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Test} from "forge-std/Test.sol"; -import {DisputeGameFactoryRouter} from "src/dispute/DisputeGameFactoryRouter.sol"; -import {IDisputeGameFactoryRouter} from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; -import {GameType, Claim} from "src/dispute/lib/Types.sol"; -import {MockCloneableDisputeGame} from "test/dispute/tee/mocks/MockCloneableDisputeGame.sol"; -import {MockDisputeGameFactory} from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; - -contract DisputeGameFactoryRouterCreateTest is Test { - uint256 internal constant ZONE_ONE = 1; - uint256 internal constant ZONE_TWO = 2; - GameType internal constant GAME_TYPE = GameType.wrap(1960); - - DisputeGameFactoryRouter internal router; - MockDisputeGameFactory internal factoryOne; - MockDisputeGameFactory internal factoryTwo; - MockCloneableDisputeGame internal gameImpl; - - function setUp() public { - router = new DisputeGameFactoryRouter(address(this)); - factoryOne = new MockDisputeGameFactory(); - factoryTwo = new MockDisputeGameFactory(); - gameImpl = new MockCloneableDisputeGame(); - - factoryOne.setImplementation(GAME_TYPE, gameImpl); - factoryTwo.setImplementation(GAME_TYPE, gameImpl); - factoryOne.setInitBond(GAME_TYPE, 1 ether); - factoryTwo.setInitBond(GAME_TYPE, 2 ether); - - router.setZone(ZONE_ONE, address(factoryOne)); - router.setZone(ZONE_TWO, address(factoryTwo)); - } - - function test_create_routesToZoneFactory() public { - Claim rootClaim = Claim.wrap(keccak256("zone-one")); - bytes memory extraData = abi.encodePacked(uint256(1)); - - address proxy = router.create{value: 1 ether}(ZONE_ONE, GAME_TYPE, rootClaim, extraData); - - assertTrue(proxy != address(0)); - assertEq(factoryOne.gameCount(), 1); - assertEq(factoryTwo.gameCount(), 0); - } - - function test_createBatch_routesAcrossZones() public { - IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](2); - params[0] = IDisputeGameFactoryRouter.CreateParams({ - zoneId: ZONE_ONE, - gameType: GAME_TYPE, - rootClaim: Claim.wrap(keccak256("zone-one")), - extraData: abi.encodePacked(uint256(11)), - bond: 1 ether - }); - params[1] = IDisputeGameFactoryRouter.CreateParams({ - zoneId: ZONE_TWO, - gameType: GAME_TYPE, - rootClaim: Claim.wrap(keccak256("zone-two")), - extraData: abi.encodePacked(uint256(22)), - bond: 2 ether - }); - - address[] memory proxies = router.createBatch{value: 3 ether}(params); - - assertEq(proxies.length, 2); - assertTrue(proxies[0] != address(0)); - assertTrue(proxies[1] != address(0)); - assertEq(factoryOne.gameCount(), 1); - assertEq(factoryTwo.gameCount(), 1); - } -} diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index 9889aecca168f..af695d7734738 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -5,7 +5,6 @@ import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol" import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; -import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; import { BadAuth, GameNotFinalized, IncorrectBondAmount, UnexpectedRootClaim } from "src/dispute/lib/Errors.sol"; import { @@ -84,28 +83,6 @@ contract TeeDisputeGameTest is TeeTestUtils { assertTrue(game.wasRespectedGameTypeWhenCreated()); } - function test_initialize_tracksTxOriginProposerThroughRouter() public { - DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(address(this)); - uint256 zoneId = 1; - router.setZone(zoneId, address(factory)); - - bytes32 endBlockHash = keccak256("router-end-block"); - bytes32 endStateHash = keccak256("router-end-state"); - bytes memory extraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); - Claim rootClaim = computeRootClaim(endBlockHash, endStateHash); - - vm.startPrank(proposer, proposer); - address proxy = - router.create{ value: DEFENDER_BOND }(zoneId, GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData); - vm.stopPrank(); - - TeeDisputeGame game = TeeDisputeGame(payable(proxy)); - assertEq(game.gameCreator(), address(router)); - assertEq(game.proposer(), proposer); - assertEq(game.refundModeCredit(proposer), DEFENDER_BOND); - assertEq(game.refundModeCredit(address(router)), 0); - } - function test_initialize_usesParentGameOutput() public { MockStatusDisputeGame parent = new MockStatusDisputeGame( proposer, diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol index aa2ec8a553b0c..b4500d0ebcf9a 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameIntegration.t.sol @@ -12,7 +12,6 @@ import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; -import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; import { BondDistributionMode, Claim, Duration, GameStatus, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; import { GameNotFinalized } from "src/dispute/lib/Errors.sol"; import { ParentGameNotResolved, InvalidParentGame } from "src/dispute/tee/lib/Errors.sol"; @@ -442,70 +441,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { } //////////////////////////////////////////////////////////////// - // Test 8: Full Cycle via Router // - //////////////////////////////////////////////////////////////// - - /// @notice Router.create → challenge → prove → resolve → claimCredit - function test_lifecycle_viaRouter_fullCycle() public { - DisputeGameFactoryRouter router = new DisputeGameFactoryRouter(address(this)); - uint256 zoneId = 1; - router.setZone(zoneId, address(factory)); - - bytes32 endBlockHash = keccak256("router-end-block"); - bytes32 endStateHash = keccak256("router-end-state"); - bytes memory extraData = buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); - Claim rootClaim = computeRootClaim(endBlockHash, endStateHash); - - // Create via router - vm.startPrank(proposer, proposer); - address proxy = router.create{ value: DEFENDER_BOND }(zoneId, TEE_GAME_TYPE, rootClaim, extraData); - vm.stopPrank(); - - TeeDisputeGame game = TeeDisputeGame(payable(proxy)); - - // Verify creator/proposer attribution - assertEq(game.gameCreator(), address(router)); - assertEq(game.proposer(), proposer); - - // Challenge - vm.prank(challenger); - game.challenge{ value: CHALLENGER_BOND }(); - - // Prove - TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); - proofs[0] = buildBatchProof( - BatchInput({ - startBlockHash: ANCHOR_BLOCK_HASH, - startStateHash: ANCHOR_STATE_HASH, - endBlockHash: endBlockHash, - endStateHash: endStateHash, - l2Block: game.l2SequenceNumber() - }), - DEFAULT_EXECUTOR_KEY, - game.domainSeparator() - ); - - vm.prank(proposer); - game.prove(abi.encode(proofs)); - - // Resolve - assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); - - // Wait for finality - vm.warp(block.timestamp + 1); - - // claimCredit — proposer proved, gets all - uint256 proposerBalanceBefore = proposer.balance; - game.claimCredit(proposer); - - assertEq(uint8(game.bondDistributionMode()), uint8(BondDistributionMode.NORMAL)); - assertEq(proposer.balance, proposerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); - // Bond attributed to proposer (tx.origin), not to router - assertEq(game.refundModeCredit(address(router)), 0); - } - - //////////////////////////////////////////////////////////////// - // Test 9: Cross-Chain — Parent Game Wrong GameType // + // Test 8: Cross-Chain — Parent Game Wrong GameType // //////////////////////////////////////////////////////////////// /// @notice Creating a TZ game with a parent of a different GameType reverts @@ -536,7 +472,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { } //////////////////////////////////////////////////////////////// - // Test 10: Cross-Chain — Anchor Isolation // + // Test 9: Cross-Chain — Anchor Isolation // //////////////////////////////////////////////////////////////// /// @notice A resolved TZ game cannot update XL's AnchorStateRegistry @@ -567,7 +503,7 @@ contract TeeDisputeGameIntegrationTest is TeeTestUtils { } //////////////////////////////////////////////////////////////// - // Test 11: Cross-Chain — Parent Chain Isolation // + // Test 10: Cross-Chain — Parent Chain Isolation // //////////////////////////////////////////////////////////////// /// @notice In a shared Factory, a child game can reference a same-type parent diff --git a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol b/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol deleted file mode 100644 index 8dd40413e62e9..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/fork/DisputeGameFactoryRouterFork.t.sol +++ /dev/null @@ -1,361 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import { Vm } from "forge-std/Vm.sol"; -import { Proxy } from "src/universal/Proxy.sol"; -import { AnchorStateRegistry } from "src/dispute/AnchorStateRegistry.sol"; -import { DisputeGameFactory } from "src/dispute/DisputeGameFactory.sol"; -import { PermissionedDisputeGame } from "src/dispute/PermissionedDisputeGame.sol"; -import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; -import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; -import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; -import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; -import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; -import { DisputeGameFactoryRouter } from "src/dispute/DisputeGameFactoryRouter.sol"; -import { IDisputeGameFactoryRouter } from "interfaces/dispute/IDisputeGameFactoryRouter.sol"; -import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; -import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; -import { Claim, Duration, GameStatus, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; -import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; -import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; -import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; - -contract DisputeGameFactoryRouterForkTest is TeeTestUtils { - struct SecondZoneFixture { - DisputeGameFactory factory; - AnchorStateRegistry anchorStateRegistry; - TeeProofVerifier teeProofVerifier; - TeeDisputeGame implementation; - address registeredExecutor; - } - - struct XLayerConfig { - GameType gameType; - uint256 initBond; - address proposer; - } - - uint256 internal constant DEFENDER_BOND = 1 ether; - uint256 internal constant CHALLENGER_BOND = 2 ether; - uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; - uint64 internal constant MAX_PROVE_DURATION = 12 hours; - bytes32 internal constant IMAGE_ID = keccak256("fork-tee-image"); - bytes32 internal constant PCR_HASH = keccak256("fork-pcr-hash"); - - // XLayer's dispute game factory is deployed on Ethereum mainnet L1. - address internal constant XLAYER_FACTORY = 0x9D4c8FAEadDdDeeE1Ed0c92dAbAD815c2484f675; - uint256 internal constant ZONE_XLAYER = 1; - uint256 internal constant ZONE_SECOND = 2; - GameType internal constant XLAYER_GAME_TYPE = GameType.wrap(1); - GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); - - bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("fork-anchor-block"); - bytes32 internal constant ANCHOR_STATE_HASH = keccak256("fork-anchor-state"); - uint256 internal constant ANCHOR_L2_BLOCK = 10; - - DisputeGameFactory internal xLayerFactory; - DisputeGameFactoryRouter internal router; - bool internal hasFork; - - address internal proposer; - address internal challenger; - - function setUp() public { - proposer = makeWallet(DEFAULT_PROPOSER_KEY, "fork-proposer").addr; - challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "fork-challenger").addr; - - if (!vm.envExists("ETH_RPC_URL")) return; - - vm.createSelectFork(vm.envString("ETH_RPC_URL")); - hasFork = true; - xLayerFactory = DisputeGameFactory(XLAYER_FACTORY); - router = new DisputeGameFactoryRouter(address(this)); - router.setZone(ZONE_XLAYER, XLAYER_FACTORY); - } - - function test_liveFactoryReadPaths() public view { - if (!hasFork) return; - - _assertLiveFactoryFork(); - - assertTrue(xLayerFactory.owner() != address(0)); - assertTrue(bytes(xLayerFactory.version()).length > 0); - assertTrue(address(xLayerFactory.gameImpls(XLAYER_GAME_TYPE)) != address(0)); - assertGt(xLayerFactory.initBonds(XLAYER_GAME_TYPE), 0); - } - - function test_routerCreate_onlyXLayer() public { - if (!hasFork) return; - - _assertLiveFactoryFork(); - XLayerConfig memory xLayer = _readXLayerConfig(); - - vm.deal(xLayer.proposer, 10 ether); - - Claim rootClaim = Claim.wrap(keccak256("xlayer-router-root")); - bytes memory extraData = abi.encodePacked(uint256(1_000_000_000)); - - vm.startPrank(xLayer.proposer, xLayer.proposer); - address proxy = router.create{ value: xLayer.initBond }(ZONE_XLAYER, xLayer.gameType, rootClaim, extraData); - vm.stopPrank(); - - assertTrue(proxy != address(0)); - - (IDisputeGame storedGame,) = xLayerFactory.games(xLayer.gameType, rootClaim, extraData); - assertEq(address(storedGame), proxy); - assertEq(storedGame.gameCreator(), address(router)); - assertEq(storedGame.rootClaim().raw(), rootClaim.raw()); - } - - function test_routerCreate_onlySecondZone_lifecycle() public { - if (!hasFork) return; - - _assertLiveFactoryFork(); - SecondZoneFixture memory secondZone = _installSecondZoneFixture(proposer); - - vm.deal(proposer, 100 ether); - vm.deal(challenger, 100 ether); - - bytes32 endBlockHash = keccak256("second-zone-end-block"); - bytes32 endStateHash = keccak256("second-zone-end-state"); - (TeeDisputeGame game, Claim rootClaim, bytes memory extraData) = - _createSecondZoneGame(endBlockHash, endStateHash, ANCHOR_L2_BLOCK + 6); - - _assertStoredSecondZoneGame(secondZone.factory, game, rootClaim, extraData); - assertEq(game.gameCreator(), address(router)); - assertEq(game.proposer(), proposer); - - _runSecondZoneLifecycle(secondZone, game, endBlockHash, endStateHash); - } - - function test_routerCreateBatch_xLayerAndSecondZone() public { - if (!hasFork) return; - - _assertLiveFactoryFork(); - XLayerConfig memory xLayer = _readXLayerConfig(); - SecondZoneFixture memory secondZone = _installSecondZoneFixture(xLayer.proposer); - - vm.deal(xLayer.proposer, 10 ether); - vm.deal(proposer, 100 ether); - vm.deal(challenger, 100 ether); - - Claim xLayerRootClaim = Claim.wrap(keccak256("batch-xlayer-root")); - bytes memory xLayerExtraData = abi.encodePacked(uint256(1_000_000_001)); - - bytes32 secondZoneEndBlockHash = keccak256("batch-second-zone-end-block"); - bytes32 secondZoneEndStateHash = keccak256("batch-second-zone-end-state"); - bytes memory secondZoneExtraData = - buildExtraData(ANCHOR_L2_BLOCK + 8, type(uint32).max, secondZoneEndBlockHash, secondZoneEndStateHash); - Claim secondZoneRootClaim = computeRootClaim(secondZoneEndBlockHash, secondZoneEndStateHash); - - IDisputeGameFactoryRouter.CreateParams[] memory params = new IDisputeGameFactoryRouter.CreateParams[](2); - params[0] = IDisputeGameFactoryRouter.CreateParams({ - zoneId: ZONE_XLAYER, - gameType: xLayer.gameType, - rootClaim: xLayerRootClaim, - extraData: xLayerExtraData, - bond: xLayer.initBond - }); - params[1] = IDisputeGameFactoryRouter.CreateParams({ - zoneId: ZONE_SECOND, - gameType: TEE_GAME_TYPE, - rootClaim: secondZoneRootClaim, - extraData: secondZoneExtraData, - bond: DEFENDER_BOND - }); - - vm.startPrank(xLayer.proposer, xLayer.proposer); - address[] memory proxies = router.createBatch{ value: xLayer.initBond + DEFENDER_BOND }(params); - vm.stopPrank(); - - assertEq(proxies.length, 2); - - (IDisputeGame xLayerStoredGame,) = xLayerFactory.games(xLayer.gameType, xLayerRootClaim, xLayerExtraData); - assertEq(address(xLayerStoredGame), proxies[0]); - assertEq(xLayerStoredGame.gameCreator(), address(router)); - - TeeDisputeGame secondZoneGame = TeeDisputeGame(payable(proxies[1])); - _assertStoredSecondZoneGame(secondZone.factory, secondZoneGame, secondZoneRootClaim, secondZoneExtraData); - assertEq(secondZoneGame.gameCreator(), address(router)); - assertEq(secondZoneGame.proposer(), xLayer.proposer); - - _runSecondZoneLifecycle(secondZone, secondZoneGame, secondZoneEndBlockHash, secondZoneEndStateHash); - } - - function _readXLayerConfig() internal view returns (XLayerConfig memory xLayer) { - xLayer.gameType = XLAYER_GAME_TYPE; - xLayer.initBond = xLayerFactory.initBonds(XLAYER_GAME_TYPE); - - PermissionedDisputeGame implementation = - PermissionedDisputeGame(payable(address(xLayerFactory.gameImpls(XLAYER_GAME_TYPE)))); - xLayer.proposer = implementation.proposer(); - - assertTrue(address(implementation) != address(0), "xlayer impl missing"); - assertGt(xLayer.initBond, 0, "xlayer init bond missing"); - } - - function _installSecondZoneFixture(address allowedProposer) - internal - returns (SecondZoneFixture memory secondZone) - { - secondZone.factory = _deployLocalDisputeGameFactory(); - router.setZone(ZONE_SECOND, address(secondZone.factory)); - - secondZone.anchorStateRegistry = _deployRealAnchorStateRegistry(secondZone.factory); - (secondZone.teeProofVerifier, secondZone.registeredExecutor) = _deployRealTeeProofVerifier(); - - secondZone.implementation = new TeeDisputeGame( - Duration.wrap(MAX_CHALLENGE_DURATION), - Duration.wrap(MAX_PROVE_DURATION), - IDisputeGameFactory(address(secondZone.factory)), - ITeeProofVerifier(address(secondZone.teeProofVerifier)), - CHALLENGER_BOND, - IAnchorStateRegistry(address(secondZone.anchorStateRegistry)), - allowedProposer, - challenger - ); - - secondZone.factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(secondZone.implementation)), bytes("")); - secondZone.factory.setInitBond(TEE_GAME_TYPE, DEFENDER_BOND); - - // Real ASR marks games created at or before the retirement timestamp as retired. - vm.warp(block.timestamp + 1); - } - - function _createSecondZoneGame( - bytes32 endBlockHash, - bytes32 endStateHash, - uint256 l2SequenceNumber - ) - internal - returns (TeeDisputeGame game, Claim rootClaim, bytes memory extraData) - { - extraData = buildExtraData(l2SequenceNumber, type(uint32).max, endBlockHash, endStateHash); - rootClaim = computeRootClaim(endBlockHash, endStateHash); - - vm.startPrank(proposer, proposer); - address proxy = router.create{ value: DEFENDER_BOND }(ZONE_SECOND, TEE_GAME_TYPE, rootClaim, extraData); - vm.stopPrank(); - - game = TeeDisputeGame(payable(proxy)); - } - - function _runSecondZoneLifecycle( - SecondZoneFixture memory secondZone, - TeeDisputeGame game, - bytes32 endBlockHash, - bytes32 endStateHash - ) - internal - { - (Hash startingRoot, uint256 startingBlockNumber) = game.startingOutputRoot(); - assertEq(startingRoot.raw(), computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()); - assertEq(startingBlockNumber, ANCHOR_L2_BLOCK); - - vm.prank(challenger); - game.challenge{ value: CHALLENGER_BOND }(); - - TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); - proofs[0] = buildBatchProof( - BatchInput({ - startBlockHash: ANCHOR_BLOCK_HASH, - startStateHash: ANCHOR_STATE_HASH, - endBlockHash: endBlockHash, - endStateHash: endStateHash, - l2Block: game.l2SequenceNumber() - }), - DEFAULT_EXECUTOR_KEY, - game.domainSeparator() - ); - - address gameProposer = game.proposer(); - - vm.prank(gameProposer); - game.prove(abi.encode(proofs)); - - assertEq(uint8(game.resolve()), uint8(GameStatus.DEFENDER_WINS)); - assertTrue(secondZone.anchorStateRegistry.isGameRegistered(game)); - assertTrue(secondZone.anchorStateRegistry.isGameProper(game)); - assertFalse(secondZone.anchorStateRegistry.isGameFinalized(game)); - assertTrue(secondZone.teeProofVerifier.isRegistered(secondZone.registeredExecutor)); - - vm.warp(block.timestamp + 1); - assertTrue(secondZone.anchorStateRegistry.isGameFinalized(game)); - assertEq(game.normalModeCredit(gameProposer), DEFENDER_BOND + CHALLENGER_BOND); - - uint256 proposerBalanceBefore = gameProposer.balance; - game.claimCredit(gameProposer); - assertEq(gameProposer.balance, proposerBalanceBefore + DEFENDER_BOND + CHALLENGER_BOND); - assertEq(address(secondZone.anchorStateRegistry.anchorGame()), address(game)); - } - - function _assertStoredSecondZoneGame( - DisputeGameFactory factory, - TeeDisputeGame game, - Claim rootClaim, - bytes memory extraData - ) - internal - view - { - (IDisputeGame storedGame,) = factory.games(TEE_GAME_TYPE, rootClaim, extraData); - assertEq(address(storedGame), address(game)); - assertEq(game.rootClaim().raw(), rootClaim.raw()); - } - - function _deployLocalDisputeGameFactory() internal returns (DisputeGameFactory factory) { - DisputeGameFactory implementation = new DisputeGameFactory(); - Proxy proxy = new Proxy(address(this)); - proxy.upgradeToAndCall(address(implementation), abi.encodeCall(implementation.initialize, (address(this)))); - factory = DisputeGameFactory(address(proxy)); - } - - function _deployRealAnchorStateRegistry(DisputeGameFactory factory) - internal - returns (AnchorStateRegistry anchorStateRegistry) - { - MockSystemConfig systemConfig = new MockSystemConfig(address(this)); - AnchorStateRegistry anchorStateRegistryImpl = new AnchorStateRegistry(0); - Proxy anchorStateRegistryProxy = new Proxy(address(this)); - anchorStateRegistryProxy.upgradeToAndCall( - address(anchorStateRegistryImpl), - abi.encodeCall( - anchorStateRegistryImpl.initialize, - ( - ISystemConfig(address(systemConfig)), - IDisputeGameFactory(address(factory)), - Proposal({ - root: Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), - l2SequenceNumber: ANCHOR_L2_BLOCK - }), - TEE_GAME_TYPE - ) - ) - ); - anchorStateRegistry = AnchorStateRegistry(address(anchorStateRegistryProxy)); - } - - function _deployRealTeeProofVerifier() - internal - returns (TeeProofVerifier teeProofVerifier, address registeredExecutor) - { - Vm.Wallet memory enclaveWallet = makeWallet(DEFAULT_EXECUTOR_KEY, "fork-registered-enclave"); - MockRiscZeroVerifier riscZeroVerifier = new MockRiscZeroVerifier(); - bytes memory expectedRootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); - - registeredExecutor = enclaveWallet.addr; - teeProofVerifier = new TeeProofVerifier(riscZeroVerifier, IMAGE_ID, expectedRootKey); - TeeProofVerifier.AttestationData memory data = TeeProofVerifier.AttestationData({ - timestampMs: 1234, - pcrHash: PCR_HASH, - publicKey: uncompressedPublicKey(enclaveWallet), - userData: "" - }); - teeProofVerifier.register("", data); - } - - function _assertLiveFactoryFork() internal view { - assertEq(block.chainid, 1, "expected Ethereum mainnet fork"); - assertTrue(XLAYER_FACTORY.code.length > 0, "factory missing on fork"); - } -} diff --git a/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol b/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol deleted file mode 100644 index e81fa3f2200c0..0000000000000 --- a/packages/contracts-bedrock/test/dispute/tee/mocks/MockCloneableDisputeGame.sol +++ /dev/null @@ -1,56 +0,0 @@ -// SPDX-License-Identifier: MIT -pragma solidity ^0.8.15; - -import {Clone} from "@solady/utils/Clone.sol"; -import {IDisputeGame} from "interfaces/dispute/IDisputeGame.sol"; -import {Timestamp, GameStatus, GameType, Claim, Hash} from "src/dispute/lib/Types.sol"; - -contract MockCloneableDisputeGame is Clone, IDisputeGame { - bool public initialized; - bool public wasRespectedGameTypeWhenCreated; - Timestamp public createdAt; - Timestamp public resolvedAt; - GameStatus public status; - - function initialize() external payable { - require(!initialized, "MockCloneableDisputeGame: already initialized"); - initialized = true; - createdAt = Timestamp.wrap(uint64(block.timestamp)); - status = GameStatus.IN_PROGRESS; - msg.value; - } - - function resolve() external returns (GameStatus status_) { - status = GameStatus.DEFENDER_WINS; - resolvedAt = Timestamp.wrap(uint64(block.timestamp)); - return status; - } - - function gameType() external pure returns (GameType gameType_) { - return GameType.wrap(0); - } - - function gameCreator() external pure returns (address creator_) { - return address(0); - } - - function rootClaim() external pure returns (Claim rootClaim_) { - return Claim.wrap(bytes32(0)); - } - - function l1Head() external pure returns (Hash l1Head_) { - return Hash.wrap(bytes32(0)); - } - - function l2SequenceNumber() external pure returns (uint256 l2SequenceNumber_) { - return 0; - } - - function extraData() external pure returns (bytes memory extraData_) { - return bytes(""); - } - - function gameData() external pure returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { - return (GameType.wrap(0), Claim.wrap(bytes32(0)), bytes("")); - } -} From 206794d32f96a8bd25d4c8aaf52ab6d5b7540265 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Wed, 25 Mar 2026 18:25:39 +0800 Subject: [PATCH 18/24] feat: add fork mode scripts for real RiscZero ZK proof testing Split E2E scripts into mock and fork variants: - DeployTeeMock/TeeProveE2E: pure mock mode (simplified) - DeployTeeFork/TeeProveE2EFork: fork mainnet with real RiscZeroVerifierRouter (0x8EaB...D319), real seal registration, and external BATCH_SIGNATURE from TEE prover Update integration guide with fork mode section including: - fork mainnet setup, deploy, and E2E commands - journal field parsing (Boundless seal -> env vars) - chainId difference (mock=31337, fork=1) - troubleshooting for real ZK proof failures Co-Authored-By: Claude Opus 4.6 (1M context) --- .../tee/tee-local-integration-guide.md | 266 ++++++++++++------ .../scripts/tee/DeployTeeFork.s.sol | 129 +++++++++ .../scripts/tee/DeployTeeMock.s.sol | 71 ++--- .../scripts/tee/TeeProveE2E.s.sol | 202 +++---------- .../scripts/tee/TeeProveE2EFork.s.sol | 209 ++++++++++++++ 5 files changed, 578 insertions(+), 299 deletions(-) create mode 100644 packages/contracts-bedrock/scripts/tee/DeployTeeFork.s.sol create mode 100644 packages/contracts-bedrock/scripts/tee/TeeProveE2EFork.s.sol diff --git a/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md b/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md index cab8b55724572..523985310fa8f 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/tee-local-integration-guide.md @@ -1,21 +1,26 @@ # TEE Dispute Game 本地部署联调指南 -> 供 TEE ZK Prover 对接联调使用，mock attestation + mock ZK proof。 -> 全部通过 forge script / cast 命令行操作。 +> 供 TEE ZK Prover 对接联调使用。全部通过 forge script / cast 命令行操作。 ## 目录 - [架构概览](#架构概览) - [真实 vs Mock 对照](#真实-vs-mock-对照) +- [脚本一览](#脚本一览) - [前置条件](#前置条件) -- [快速开始](#快速开始) -- [分步详解](#分步详解) +- [Mock 模式（快速验证）](#mock-模式快速验证) - [Step 1: 启动 Anvil](#step-1-启动-anvil) - [Step 2: 部署合约](#step-2-部署合约) - [Step 3: 运行 E2E](#step-3-运行-e2e) - [Step 4: 领取 Bond](#step-4-领取-bond) +- [Fork 模式（真实 ZK Proof 验证）](#fork-模式真实-zk-proof-验证) + - [概述](#概述) + - [Step 1: Fork 主网启动 Anvil](#step-1-fork-主网启动-anvil) + - [Step 2: 部署合约（真实 RiscZero Verifier）](#step-2-部署合约真实-risczero-verifier) + - [Step 3: 运行 E2E（真实 seal + 外部签名）](#step-3-运行-e2e真实-seal--外部签名) + - [Journal 字段解析](#journal-字段解析) - [Prover 对接核心概念](#prover-对接核心概念) - - [注册 Enclave (Mock Attestation)](#注册-enclave-mock-attestation) + - [注册 Enclave](#注册-enclave) - [prove() 输入格式](#prove-输入格式) - [从外部传入 prove 输入](#从外部传入-prove-输入) - [EIP-712 签名规范](#eip-712-签名规范) @@ -84,6 +89,15 @@ 整个 prove 流程中唯一 mock 的是**被签名的数据**（block/state hash 默认是假值，但可以通过环境变量替换为真实数据）。签名的生成和验证链路与生产环境完全一致。 +## 脚本一览 + +| 脚本 | 用途 | RiscZero Verifier | +|---|---|---| +| `scripts/tee/DeployTeeMock.s.sol` | Mock 模式部署 | MockRiscZeroVerifier（任意 seal 通过） | +| `scripts/tee/TeeProveE2E.s.sol` | Mock E2E（本地签名） | 同上 | +| `scripts/tee/DeployTeeFork.s.sol` | Fork 模式部署 | 主网真实 RiscZeroVerifierRouter | +| `scripts/tee/TeeProveE2EFork.s.sol` | Fork E2E（真实 seal + 外部签名） | 同上 | + --- ## 前置条件 @@ -91,7 +105,9 @@ - 已安装 [Foundry](https://book.getfoundry.sh/getting-started/installation)（`forge`、`cast`、`anvil`） - 已 clone 仓库并安装依赖 -## 快速开始 +## Mock 模式（快速验证） + +### 快速开始 ```bash # Terminal 1: 启动 Anvil @@ -140,10 +156,6 @@ forge script scripts/tee/TeeProveE2E.s.sol \ === E2E Complete (steps 1-5 passed) === ``` ---- - -## 分步详解 - ### Step 1: 启动 Anvil ```bash @@ -237,15 +249,143 @@ cast send 'claimCredit(address)' \ --- +## Fork 模式（真实 ZK Proof 验证） + +### 概述 + +Fork 模式通过 `anvil --fork-url` fork 以太坊主网，使用链上已部署的 **RiscZeroVerifierRouter** (`0x8EaB2D97Dfce405A1692a21b3ff3A172d593D319`) 进行真实的 Groth16 ZK proof 验证。 + +与 mock 模式的区别： + +| | Mock 模式 | Fork 模式 | +|---|---|---| +| RiscZero Verifier | MockRiscZeroVerifier（任意 seal 通过） | 主网真实 RiscZeroVerifierRouter | +| `register()` seal | 空字节 `0x` | 真实 Groth16 seal（如 Boundless 返回的） | +| imageId | 假值 | 真实 guest image ID | +| expectedRootKey | 假值 | 真实 AWS Nitro P384 root key（96 字节） | +| prove() 签名 | ENCLAVE_KEY 本地签名 | 外部传入 `BATCH_SIGNATURE` | + +### Step 1: Fork 主网启动 Anvil + +```bash +# 需要以太坊主网 RPC（Alchemy / Infura / 自建节点） +anvil --fork-url $ETH_RPC_URL --block-time 1 +``` + +> 注意：fork 主网后 chainId 为 1（非 mock 模式的 31337）。Anvil 默认账户同样预充 10000 ETH。prover 构造 EIP-712 签名时 chainId 必须使用 1。 + +### Step 2: 部署合约（真实 RiscZero Verifier） + +脚本：`scripts/tee/DeployTeeFork.s.sol` + +```bash +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER=0x70997970C51812dc3A010C7d01b50e0d17dc79C8 \ +CHALLENGER=0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC \ +RISC_ZERO_VERIFIER=0x8EaB2D97Dfce405A1692a21b3ff3A172d593D319 \ +RISC_ZERO_IMAGE_ID=0x \ +NITRO_ROOT_KEY=0x<96 字节 AWS Nitro P384 root key hex> \ +forge script scripts/tee/DeployTeeFork.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +**环境变量说明：** + +| 变量 | 说明 | +|---|---| +| `RISC_ZERO_VERIFIER` | 主网 RiscZeroVerifierRouter 地址 | +| `RISC_ZERO_IMAGE_ID` | RISC Zero guest program 的 image ID（ELF hash） | +| `NITRO_ROOT_KEY` | AWS Nitro Enclave P384 root public key，96 字节（不含 0x04 前缀） | + +保存输出的 `TeeProofVerifier` 和 `DisputeGameFactory` 地址。 + +### Step 3: 运行 E2E（真实 seal + 外部签名） + +脚本：`scripts/tee/TeeProveE2EFork.s.sol` + +```bash +PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ +PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ +CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ +TEE_PROOF_VERIFIER=<部署输出的地址> \ +DISPUTE_GAME_FACTORY=<部署输出的地址> \ +SEAL=0x \ +ATT_TIMESTAMP_MS= \ +ATT_PCR_HASH=0x \ +ATT_PUBLIC_KEY=0x<65 字节未压缩公钥 hex> \ +ATT_USER_DATA=0x \ +BATCH_SIGNATURE=0x \ +END_BLOCK_HASH=0x<终态 block hash> \ +END_STATE_HASH=0x<终态 state hash> \ +L2_SEQUENCE_NUMBER= \ +forge script scripts/tee/TeeProveE2EFork.s.sol \ + --rpc-url http://localhost:8545 --broadcast +``` + +**环境变量说明：** + +| 变量 | 说明 | +|---|---| +| `SEAL` | Boundless 返回的 Groth16 proof seal（hex 编码） | +| `ATT_TIMESTAMP_MS` | attestation 中的 Unix 时间戳（毫秒） | +| `ATT_PCR_HASH` | PCR0 hash（bytes32） | +| `ATT_PUBLIC_KEY` | enclave 的 65 字节未压缩 secp256k1 公钥 | +| `ATT_USER_DATA` | attestation 中的附加数据（可为空 `0x`） | +| `BATCH_SIGNATURE` | TEE prover 对 EIP-712 batch digest 的签名（65 字节） | + +### Journal 字段解析 + +`register()` 时合约会用 `attestationData` + `expectedRootKey` 重建 journal，然后计算 `journalDigest = SHA256(journal)` 交给 RiscZero verifier 验证。 + +如果你有 Boundless 返回的原始 journal（hex），按以下顺序拆解为环境变量： + +``` +journal = timestampMs (8 bytes) --> ATT_TIMESTAMP_MS（转为 uint64 十进制） + || pcrHash (32 bytes) --> ATT_PCR_HASH（0x 前缀 hex） + || rootKey (96 bytes) --> 跳过（合约从 expectedRootKey 取，部署时通过 NITRO_ROOT_KEY 设置） + || pubKeyLen (1 byte = 0x41) --> 跳过 + || publicKey (65 bytes) --> ATT_PUBLIC_KEY（0x 前缀 hex） + || userDataLen (2 bytes) --> 跳过 + || userData (variable) --> ATT_USER_DATA（0x 前缀 hex，可为空 0x） +``` + +**示例：用 cast 从 journal hex 中提取字段** + +```bash +JOURNAL=0x<完整 journal hex> + +# timestampMs: 前 8 字节 = 16 hex chars +ATT_TIMESTAMP_MS=$(cast to-dec $(echo $JOURNAL | cut -c3-18)) + +# pcrHash: 接下来 32 字节 = 64 hex chars (offset 18) +ATT_PCR_HASH=0x$(echo $JOURNAL | cut -c19-82) + +# 跳过 rootKey: 96 字节 = 192 hex chars (offset 82) +# pubKeyLen: 1 字节 = 2 hex chars (offset 274), 值应为 0x41 = 65 +# publicKey: 65 字节 = 130 hex chars (offset 276) +ATT_PUBLIC_KEY=0x$(echo $JOURNAL | cut -c277-406) + +# userDataLen: 2 字节 = 4 hex chars (offset 406) +USER_DATA_LEN=$(cast to-dec 0x$(echo $JOURNAL | cut -c407-410)) +# userData: 从 offset 410 开始 +if [ "$USER_DATA_LEN" -gt 0 ]; then + ATT_USER_DATA=0x$(echo $JOURNAL | cut -c411-$((410 + USER_DATA_LEN * 2))) +else + ATT_USER_DATA=0x +fi +``` + +--- + ## Prover 对接核心概念 -### 注册 Enclave (Mock Attestation) +### 注册 Enclave ```solidity function register(bytes calldata seal, AttestationData calldata attestationData) external onlyOwner ``` -使用 `MockRiscZeroVerifier` 时，ZK proof 验证被跳过。只需提供： +Mock 模式下使用 `MockRiscZeroVerifier`，ZK proof 验证被跳过。只需提供： - `seal`：空字节 `0x` - `attestationData.publicKey`：**65 字节 secp256k1 未压缩公钥**（`0x04` + 32 字节 x + 32 字节 y） @@ -257,6 +397,8 @@ function register(bytes calldata seal, AttestationData calldata attestationData) **关键**：用于签名 batch 的私钥必须与注册时提供的公钥是同一对密钥。 +Fork 模式下需要提供真实的 seal 和 attestation data，详见 [Fork 模式](#fork-模式真实-zk-proof-验证)。 + ### prove() 输入格式 ```solidity @@ -287,88 +429,38 @@ struct BatchProof { ### 从外部传入 prove 输入 -`TeeProveE2E.s.sol` 支持两种模式： - -**Mock 模式**（默认）：脚本用 `ENCLAVE_KEY` 在本地签名，用于快速验证全流程。 - -**External 模式**（对接用）：TEE prover 在 enclave 内签好名，把 signature 传出来。脚本不需要也不应该拿到 enclave 私钥。 +两套 E2E 脚本均支持通过环境变量覆盖 batch 数据（不设时使用 mock 默认值）： -#### 环境变量 - -| 变量 | 必填 | 默认值 | 说明 | -|---|---|---|---| -| `BATCH_SIGNATURE` | External 模式必填 | 无 | 65 字节签名 hex（`r+s+v`），设置后进入 external 模式 | -| `ENCLAVE_ADDR` | External 模式必填 | 无 | 已注册的 enclave 地址（用于校验注册状态） | -| `ENCLAVE_KEY` | Mock 模式必填 | 无 | enclave 私钥，仅 mock 模式使用 | -| `START_BLOCK_HASH` | 否 | `keccak256("genesis-block")` | batch 起始 block hash，必须匹配 anchor | -| `START_STATE_HASH` | 否 | `keccak256("genesis-state")` | batch 起始 state hash，必须匹配 anchor | -| `END_BLOCK_HASH` | 否 | `keccak256("end-block-100")` | batch 终态 block hash | -| `END_STATE_HASH` | 否 | `keccak256("end-state-100")` | batch 终态 state hash | -| `L2_SEQUENCE_NUMBER` | 否 | `100` | L2 区块号 | - -#### External 模式（TEE Prover 对接） - -TEE prover 的对接流程： - -1. Prover 从链上查询 `game.domainSeparator()` 和 batch 数据 -2. Prover 在 TEE enclave 内按 [EIP-712 签名规范](#eip-712-签名规范) 计算 digest 并签名 -3. Prover 将 65 字节签名（`r+s+v`）传出 -4. 通过 `BATCH_SIGNATURE` 环境变量传给脚本 - -```bash -# 1. 先查询 domain separator（prover 签名时需要） -cast call 'domainSeparator()(bytes32)' --rpc-url http://localhost:8545 - -# 2. TEE prover 在 enclave 内签名，产出 65 字节签名 hex - -# 3. 用外部签名运行脚本 -PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ -PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ -CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ -TEE_PROOF_VERIFIER=0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 \ -DISPUTE_GAME_FACTORY=0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 \ -ENCLAVE_ADDR=0x<已注册的 enclave 地址> \ -BATCH_SIGNATURE=0x<65 字节 r+s+v 签名 hex> \ -END_BLOCK_HASH=0x \ -END_STATE_HASH=0x \ -L2_SEQUENCE_NUMBER=<目标 L2 区块号> \ -forge script scripts/tee/TeeProveE2E.s.sol \ - --rpc-url http://localhost:8545 --broadcast -``` - -> 注意：external 模式下不需要设置 `ENCLAVE_KEY`。enclave 私钥始终留在 TEE 内部，不会暴露。 - -#### Mock 模式（快速验证） - -```bash -# 脚本用 ENCLAVE_KEY 在本地签名 -PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 \ -PROPOSER_KEY=0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d \ -CHALLENGER_KEY=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a \ -ENCLAVE_KEY=0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6 \ -TEE_PROOF_VERIFIER=0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512 \ -DISPUTE_GAME_FACTORY=0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9 \ -forge script scripts/tee/TeeProveE2E.s.sol \ - --rpc-url http://localhost:8545 --broadcast -``` +| 变量 | 默认值 | 说明 | +|---|---|---| +| `START_BLOCK_HASH` | `keccak256("genesis-block")` | batch 起始 block hash，必须匹配 anchor | +| `START_STATE_HASH` | `keccak256("genesis-state")` | batch 起始 state hash，必须匹配 anchor | +| `END_BLOCK_HASH` | `keccak256("end-block-100")` | batch 终态 block hash | +| `END_STATE_HASH` | `keccak256("end-state-100")` | batch 终态 state hash | +| `L2_SEQUENCE_NUMBER` | `100` | L2 区块号 | -#### 注意事项 +**签名来源的区别：** -- `START_BLOCK_HASH` / `START_STATE_HASH` 必须满足 `keccak256(abi.encode(startBlockHash, startStateHash))` 等于链上 anchor state 的 root。可查询：`cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)'` -- `END_BLOCK_HASH` / `END_STATE_HASH` 的 `keccak256(abi.encode(...))` 会作为 `rootClaim` 写入 game。 -- `L2_SEQUENCE_NUMBER` 必须大于 anchor 的 l2SequenceNumber。 -- `BATCH_SIGNATURE` 必须是对正确 EIP-712 digest 的签名，且签名者必须是已注册的 enclave。签名格式：`abi.encodePacked(r, s, v)` = 65 字节。 +| 脚本 | 签名方式 | 说明 | +|---|---|---| +| `TeeProveE2E.s.sol` | `ENCLAVE_KEY` 本地签名 | mock 模式，私钥在本地 | +| `TeeProveE2EFork.s.sol` | `BATCH_SIGNATURE` 外部传入 | fork 模式，私钥留在 TEE 内 | **查询当前 anchor state（用于确定 START_BLOCK_HASH / START_STATE_HASH）：** ```bash -# 返回 (root, l2SequenceNumber) cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)' \ --rpc-url http://localhost:8545 ``` 默认部署的 anchor root = `keccak256(abi.encode(keccak256("genesis-block"), keccak256("genesis-state")))`，l2SequenceNumber = 0。 +**注意事项：** +- `START_BLOCK_HASH` / `START_STATE_HASH` 必须满足 `keccak256(abi.encode(startBlockHash, startStateHash))` 等于链上 anchor root。 +- `END_BLOCK_HASH` / `END_STATE_HASH` 的 `keccak256(abi.encode(...))` 会作为 `rootClaim` 写入 game。 +- `L2_SEQUENCE_NUMBER` 必须大于 anchor 的 l2SequenceNumber。 +- `BATCH_SIGNATURE`（仅 fork 模式）必须是对正确 EIP-712 digest 的签名，签名者必须是已注册的 enclave，格式：`abi.encodePacked(r, s, v)` = 65 字节。 + ### EIP-712 签名规范 这是 prover 对接最关键的部分。domain、types、字段顺序有任何偏差都会导致 `verifyBatch()` revert。 @@ -378,7 +470,7 @@ cast call $ANCHOR_STATE_REGISTRY 'getAnchorRoot()(bytes32,uint256)' \ ``` name: "TeeDisputeGame" version: "1" -chainId: <当前链 ID> (Anvil = 31337) +chainId: <当前链 ID> (mock 模式 = 31337, fork 主网 = 1) verifyingContract: (注意：不是 game 地址！) ``` @@ -567,7 +659,13 @@ CHALLENGER DEFENDER ### `register()` 报 `InvalidProof` 错误 -确认部署的是 `MockRiscZeroVerifier` 并传给了 `TeeProofVerifier` 构造函数。mock 的 `shouldRevert` 默认为 `false`。 +**Mock 模式**：确认部署的是 `MockRiscZeroVerifier` 并传给了 `TeeProofVerifier` 构造函数。mock 的 `shouldRevert` 默认为 `false`。 + +**Fork 模式**：说明 seal 或 attestation data 与链上验证不匹配。检查： +1. `RISC_ZERO_IMAGE_ID` 是否与生成 seal 时使用的 guest program 一致 +2. `NITRO_ROOT_KEY` 是否与 attestation 中的 root key 一致（96 字节，P384） +3. `ATT_*` 字段是否与 journal 中的值完全对应（参考 [Journal 字段解析](#journal-字段解析)） +4. `SEAL` 是否完整、未被截断 ### `verifyBatch()` 报 `EnclaveNotRegistered` 错误 @@ -580,7 +678,7 @@ CHALLENGER DEFENDER 说明 ecrecover 恢复出的地址与预期不一致，检查以下几点： 1. EIP-712 domain 中的 **`verifyingContract`** 必须是 `TeeProofVerifier` 地址（不是 game 地址） -2. **`chainId`** 必须匹配当前链（Anvil = 31337） +2. **`chainId`** 必须匹配当前链（mock 模式 = 31337，fork 主网 = 1） 3. **签名格式**必须是 `r(32) + s(32) + v(1)` = 65 字节，用 `abi.encodePacked(r, s, v)` 打包 4. 读取 `game.domainSeparator()` 与你的链下计算结果对比 diff --git a/packages/contracts-bedrock/scripts/tee/DeployTeeFork.s.sol b/packages/contracts-bedrock/scripts/tee/DeployTeeFork.s.sol new file mode 100644 index 0000000000000..4883f1e5463b0 --- /dev/null +++ b/packages/contracts-bedrock/scripts/tee/DeployTeeFork.s.sol @@ -0,0 +1,129 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import { Script, console2 } from "forge-std/Script.sol"; +import { Proxy } from "src/universal/Proxy.sol"; +import { DisputeGameFactory } from "src/dispute/DisputeGameFactory.sol"; +import { AnchorStateRegistry } from "src/dispute/AnchorStateRegistry.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ISystemConfig } from "interfaces/L1/ISystemConfig.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { IRiscZeroVerifier } from "interfaces/dispute/IRiscZeroVerifier.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; +import { Duration, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; + +/// @title DeployTeeFork +/// @notice Deploys TEE dispute game stack on a forked mainnet, using the real +/// RiscZeroVerifierRouter for ZK proof verification during enclave registration. +/// +/// @dev Usage: +/// anvil --fork-url $ETH_RPC_URL --block-time 1 +/// +/// PRIVATE_KEY=0xac09...ff80 \ +/// PROPOSER=0x7099...79C8 \ +/// CHALLENGER=0x3C44...93BC \ +/// RISC_ZERO_VERIFIER=0x8EaB2D97Dfce405A1692a21b3ff3A172d593D319 \ +/// RISC_ZERO_IMAGE_ID=0x \ +/// NITRO_ROOT_KEY=0x<96 bytes P384 root key hex> \ +/// forge script scripts/tee/DeployTeeFork.s.sol --rpc-url http://localhost:8545 --broadcast +contract DeployTeeFork is Script { + uint256 internal constant DEFENDER_BOND = 0.1 ether; + uint256 internal constant CHALLENGER_BOND = 0.2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 300; + uint64 internal constant MAX_PROVE_DURATION = 300; + + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("genesis-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("genesis-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 0; + + function run() external { + uint256 deployerKey = vm.envUint("PRIVATE_KEY"); + address deployer = vm.addr(deployerKey); + address proposer_ = vm.envAddress("PROPOSER"); + address challenger_ = vm.envAddress("CHALLENGER"); + + vm.startBroadcast(deployerKey); + + TeeProofVerifier teeProofVerifier = _deployVerifier(); + DisputeGameFactory factory = _deployFactory(deployer); + AnchorStateRegistry asr = _deployASR(deployer, factory); + TeeDisputeGame impl = _deployGame(factory, teeProofVerifier, asr, proposer_, challenger_); + + vm.stopBroadcast(); + + console2.log("=== Deployed (fork mode) ==="); + console2.log("TeeProofVerifier :", address(teeProofVerifier)); + console2.log("DisputeGameFactory :", address(factory)); + console2.log("AnchorStateRegistry :", address(asr)); + console2.log("TeeDisputeGame impl :", address(impl)); + } + + function _deployVerifier() internal returns (TeeProofVerifier) { + IRiscZeroVerifier rv = IRiscZeroVerifier(vm.envAddress("RISC_ZERO_VERIFIER")); + bytes32 imageId = vm.envBytes32("RISC_ZERO_IMAGE_ID"); + bytes memory rootKey = vm.envBytes("NITRO_ROOT_KEY"); + console2.log("RiscZeroVerifier :", address(rv)); + console2.log("imageId :", vm.toString(imageId)); + return new TeeProofVerifier(rv, imageId, rootKey); + } + + function _deployFactory(address deployer) internal returns (DisputeGameFactory) { + DisputeGameFactory factoryImpl = new DisputeGameFactory(); + Proxy p = new Proxy(deployer); + p.upgradeToAndCall(address(factoryImpl), abi.encodeCall(factoryImpl.initialize, (deployer))); + return DisputeGameFactory(address(p)); + } + + function _deployASR(address deployer, DisputeGameFactory factory) internal returns (AnchorStateRegistry) { + MockSystemConfig sc = new MockSystemConfig(deployer); + AnchorStateRegistry asrImpl = new AnchorStateRegistry(0); + Proxy p = new Proxy(deployer); + p.upgradeToAndCall( + address(asrImpl), + abi.encodeCall( + asrImpl.initialize, + ( + ISystemConfig(address(sc)), + IDisputeGameFactory(address(factory)), + Proposal({ + root: Hash.wrap(keccak256(abi.encode(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH))), + l2SequenceNumber: ANCHOR_L2_BLOCK + }), + TEE_GAME_TYPE + ) + ) + ); + return AnchorStateRegistry(address(p)); + } + + function _deployGame( + DisputeGameFactory factory, + TeeProofVerifier verifier, + AnchorStateRegistry asr, + address proposer_, + address challenger_ + ) + internal + returns (TeeDisputeGame) + { + TeeDisputeGame impl = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(verifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(asr)), + proposer_, + challenger_ + ); + factory.setImplementation(TEE_GAME_TYPE, IDisputeGame(address(impl)), bytes("")); + factory.setInitBond(TEE_GAME_TYPE, DEFENDER_BOND); + return impl; + } +} diff --git a/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol b/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol index afdb86c1dcd12..656405b1294d8 100644 --- a/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol +++ b/packages/contracts-bedrock/scripts/tee/DeployTeeMock.s.sol @@ -17,8 +17,8 @@ import { MockSystemConfig } from "test/dispute/tee/mocks/MockSystemConfig.sol"; import { Duration, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; /// @title DeployTeeMock -/// @notice Deploys the full TEE dispute game stack with mock ZK verifier for local testing. -/// MockRiscZeroVerifier accepts any proof, so register() works with empty seal. +/// @notice Deploys the full TEE dispute game stack with MockRiscZeroVerifier for local testing. +/// register() accepts empty seal in this mode. /// /// @dev Usage: /// anvil --block-time 1 @@ -30,7 +30,7 @@ import { Duration, GameType, Hash, Proposal } from "src/dispute/lib/Types.sol"; contract DeployTeeMock is Script { uint256 internal constant DEFENDER_BOND = 0.1 ether; uint256 internal constant CHALLENGER_BOND = 0.2 ether; - uint64 internal constant MAX_CHALLENGE_DURATION = 300; // 5 min (short for testing) + uint64 internal constant MAX_CHALLENGE_DURATION = 300; // 5 min uint64 internal constant MAX_PROVE_DURATION = 300; // 5 min GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); @@ -47,11 +47,13 @@ contract DeployTeeMock is Script { vm.startBroadcast(deployerKey); - // 1. MockRiscZeroVerifier -- verify() is a no-op, any seal passes + // 1. MockRiscZeroVerifier -- verify() is a no-op MockRiscZeroVerifier mockRiscZero = new MockRiscZeroVerifier(); - // 2. TeeProofVerifier with mock ZK verifier - TeeProofVerifier teeProofVerifier = _deployTeeProofVerifier(mockRiscZero); + // 2. TeeProofVerifier with mock verifier + dummy imageId/rootKey + bytes32 imageId = keccak256("mock-image-id"); + bytes memory rootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); + TeeProofVerifier teeProofVerifier = new TeeProofVerifier(mockRiscZero, imageId, rootKey); // 3. DisputeGameFactory (via Proxy) DisputeGameFactory factory = _deployFactory(deployer); @@ -65,15 +67,20 @@ contract DeployTeeMock is Script { vm.stopBroadcast(); - _logResults( - mockRiscZero, teeProofVerifier, factory, anchorStateRegistry, teeDisputeGame, proposer_, challenger_ - ); - } - - function _deployTeeProofVerifier(MockRiscZeroVerifier mockRiscZero) internal returns (TeeProofVerifier) { - bytes32 imageId = keccak256("mock-image-id"); - bytes memory rootKey = abi.encodePacked(bytes32(uint256(1)), bytes32(uint256(2)), bytes32(uint256(3))); - return new TeeProofVerifier(mockRiscZero, imageId, rootKey); + console2.log("=== Deployed Addresses ==="); + console2.log("MockRiscZeroVerifier :", address(mockRiscZero)); + console2.log("TeeProofVerifier :", address(teeProofVerifier)); + console2.log("DisputeGameFactory :", address(factory)); + console2.log("AnchorStateRegistry :", address(anchorStateRegistry)); + console2.log("TeeDisputeGame impl :", address(teeDisputeGame)); + console2.log(""); + console2.log("=== Config ==="); + console2.log("PROPOSER :", proposer_); + console2.log("CHALLENGER :", challenger_); + console2.log("DEFENDER_BOND :", DEFENDER_BOND); + console2.log("CHALLENGER_BOND :", CHALLENGER_BOND); + console2.log("TEE_GAME_TYPE :", TEE_DISPUTE_GAME_TYPE); + console2.log("ANCHOR_L2_BLOCK :", ANCHOR_L2_BLOCK); } function _deployFactory(address deployer) internal returns (DisputeGameFactory) { @@ -91,7 +98,7 @@ contract DeployTeeMock is Script { returns (AnchorStateRegistry) { MockSystemConfig systemConfig = new MockSystemConfig(deployer); - AnchorStateRegistry asrImpl = new AnchorStateRegistry(0); // 0 finality delay for testing + AnchorStateRegistry asrImpl = new AnchorStateRegistry(0); Proxy asrProxy = new Proxy(deployer); asrProxy.upgradeToAndCall( address(asrImpl), @@ -137,36 +144,4 @@ contract DeployTeeMock is Script { return teeDisputeGame; } - - function _logResults( - MockRiscZeroVerifier mockRiscZero, - TeeProofVerifier teeProofVerifier, - DisputeGameFactory factory, - AnchorStateRegistry anchorStateRegistry, - TeeDisputeGame teeDisputeGame, - address proposer_, - address challenger_ - ) - internal - view - { - console2.log("=== Deployed Addresses ==="); - console2.log("MockRiscZeroVerifier :", address(mockRiscZero)); - console2.log("TeeProofVerifier :", address(teeProofVerifier)); - console2.log("DisputeGameFactory :", address(factory)); - console2.log("AnchorStateRegistry :", address(anchorStateRegistry)); - console2.log("TeeDisputeGame impl :", address(teeDisputeGame)); - console2.log(""); - console2.log("=== Config ==="); - console2.log("PROPOSER :", proposer_); - console2.log("CHALLENGER :", challenger_); - console2.log("DEFENDER_BOND :", DEFENDER_BOND); - console2.log("CHALLENGER_BOND :", CHALLENGER_BOND); - console2.log("MAX_CHALLENGE_DURATION:", MAX_CHALLENGE_DURATION); - console2.log("MAX_PROVE_DURATION :", MAX_PROVE_DURATION); - console2.log("TEE_GAME_TYPE :", TEE_DISPUTE_GAME_TYPE); - console2.log("ANCHOR_L2_BLOCK :", ANCHOR_L2_BLOCK); - console2.log("ANCHOR_BLOCK_HASH :", vm.toString(ANCHOR_BLOCK_HASH)); - console2.log("ANCHOR_STATE_HASH :", vm.toString(ANCHOR_STATE_HASH)); - } } diff --git a/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol b/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol index 2adc62b5262d8..b2965de7c6ec6 100644 --- a/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol +++ b/packages/contracts-bedrock/scripts/tee/TeeProveE2E.s.sol @@ -4,41 +4,17 @@ pragma solidity ^0.8.15; import { Script, console2 } from "forge-std/Script.sol"; import { Vm } from "forge-std/Vm.sol"; import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; -import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; import { Claim, GameType, GameStatus } from "src/dispute/lib/Types.sol"; /// @title TeeProveE2E -/// @notice End-to-end script: register enclave, create game, challenge, prove, resolve. -/// Two modes: -/// - Mock mode (default): ENCLAVE_KEY signs batch on-chain via vm.sign -/// - External mode: set BATCH_SIGNATURE to use a pre-built signature from TEE prover -/// -/// @dev Prerequisites: Run DeployTeeMock.s.sol first, then set the env vars below. -/// -/// # Required -/// PRIVATE_KEY= -/// PROPOSER_KEY= -/// CHALLENGER_KEY= -/// TEE_PROOF_VERIFIER=
-/// DISPUTE_GAME_FACTORY=
-/// -/// # Mock mode (script signs with enclave key): -/// ENCLAVE_KEY=0x... -/// -/// # External mode (prover signs off-chain, passes signature in): -/// BATCH_SIGNATURE=0x<65-byte r+s+v hex> -/// ENCLAVE_ADDR=0x -/// # ENCLAVE_KEY is not needed in this mode -/// -/// # Optional: override batch data (defaults to mock values if not set) -/// # START_BLOCK_HASH=0x... (default: keccak256("genesis-block"), must match anchor) -/// # START_STATE_HASH=0x... (default: keccak256("genesis-state"), must match anchor) -/// # END_BLOCK_HASH=0x... (default: keccak256("end-block-100")) -/// # END_STATE_HASH=0x... (default: keccak256("end-state-100")) -/// # L2_SEQUENCE_NUMBER=100 (default: 100) +/// @notice Mock E2E: register enclave (empty seal), create game, challenge, prove, resolve. +/// All signing done locally with ENCLAVE_KEY. For real ZK proof testing, use TeeProveE2EFork. /// +/// @dev Usage: +/// PRIVATE_KEY=0xac09...ff80 PROPOSER_KEY=0x59c6...690d CHALLENGER_KEY=0x5de4...365a \ +/// ENCLAVE_KEY=0x7c85...07a6 TEE_PROOF_VERIFIER= DISPUTE_GAME_FACTORY= \ /// forge script scripts/tee/TeeProveE2E.s.sol --rpc-url http://localhost:8545 --broadcast contract TeeProveE2E is Script { bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( @@ -47,12 +23,10 @@ contract TeeProveE2E is Script { GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); - // Stored after env reads, used across steps TeeProofVerifier internal teeProofVerifier; IDisputeGameFactory internal factory; TeeDisputeGame internal game; - // Prove inputs bytes32 internal startBlockHash; bytes32 internal startStateHash; bytes32 internal endBlockHash; @@ -60,173 +34,85 @@ contract TeeProveE2E is Script { uint256 internal l2SeqNum; function run() external { - // --- Read env --- uint256 ownerKey = vm.envUint("PRIVATE_KEY"); uint256 proposerKey = vm.envUint("PROPOSER_KEY"); uint256 challengerKey = vm.envUint("CHALLENGER_KEY"); + uint256 enclaveKey = vm.envUint("ENCLAVE_KEY"); teeProofVerifier = TeeProofVerifier(vm.envAddress("TEE_PROOF_VERIFIER")); factory = IDisputeGameFactory(vm.envAddress("DISPUTE_GAME_FACTORY")); - // Prove inputs: env override or mock defaults startBlockHash = vm.envOr("START_BLOCK_HASH", keccak256("genesis-block")); startStateHash = vm.envOr("START_STATE_HASH", keccak256("genesis-state")); endBlockHash = vm.envOr("END_BLOCK_HASH", keccak256("end-block-100")); endStateHash = vm.envOr("END_STATE_HASH", keccak256("end-state-100")); l2SeqNum = vm.envOr("L2_SEQUENCE_NUMBER", uint256(100)); - // Determine mode: external signature or mock (enclave key signs locally) - bytes memory externalSig = vm.envOr("BATCH_SIGNATURE", bytes("")); - bool externalMode = externalSig.length > 0; - - // Step 1: Register enclave - console2.log("=== Step 1: Register Enclave (mock attestation + mock ZK proof) ==="); - if (externalMode) { - // External mode: enclave already registered by prover, just verify - address enclaveAddr = vm.envAddress("ENCLAVE_ADDR"); - require(teeProofVerifier.isRegistered(enclaveAddr), "ENCLAVE_ADDR not registered"); - console2.log("Enclave verified registered:", enclaveAddr); - } else { - uint256 enclaveKey = vm.envUint("ENCLAVE_KEY"); - _registerEnclave(ownerKey, enclaveKey); - } + console2.log("=== Step 1: Register Enclave (mock) ==="); + _registerEnclave(ownerKey, enclaveKey); - // Step 2: Create game console2.log(""); - console2.log("=== Step 2: Create Game (proposer) ==="); + console2.log("=== Step 2: Create Game ==="); _createGame(proposerKey); - // Step 3: Challenge console2.log(""); - console2.log("=== Step 3: Challenge (challenger) ==="); + console2.log("=== Step 3: Challenge ==="); _challenge(challengerKey); - // Step 4: Prove console2.log(""); - if (externalMode) { - console2.log("=== Step 4: Prove - external signature from TEE prover ==="); - _proveExternal(proposerKey, externalSig); - } else { - console2.log("=== Step 4: Prove - mock mode (enclave key signs locally) ==="); - uint256 enclaveKey = vm.envUint("ENCLAVE_KEY"); - _proveMock(proposerKey, enclaveKey); - } + console2.log("=== Step 4: Prove (enclave key signs locally) ==="); + _prove(proposerKey, enclaveKey); - // Step 5: Resolve console2.log(""); console2.log("=== Step 5: Resolve ==="); _resolve(proposerKey); console2.log(""); - console2.log("=== E2E Complete (steps 1-5 passed) ==="); - console2.log(""); - console2.log("Note: claimCredit requires finality delay to pass (resolvedAt + delay < block.timestamp)."); - console2.log("In forge script all txns share the same block, so claimCredit must be called separately:"); - console2.log( - " cast send 'claimCredit(address)' --private-key --rpc-url http://localhost:8545" - ); + console2.log("=== E2E Complete ==="); } - // ---------------------------------------------------------------- - // Step 1: Register enclave with mock attestation - // ---------------------------------------------------------------- - function _registerEnclave(uint256 ownerKey, uint256 enclaveKey) internal { - Vm.Wallet memory enclaveWallet = vm.createWallet(enclaveKey, "enclave"); - - if (teeProofVerifier.isRegistered(enclaveWallet.addr)) { - console2.log("Enclave already registered:", enclaveWallet.addr); + Vm.Wallet memory w = vm.createWallet(enclaveKey, "enclave"); + if (teeProofVerifier.isRegistered(w.addr)) { + console2.log("Already registered:", w.addr); return; } - - bytes memory pubKey = - abi.encodePacked(bytes1(0x04), bytes32(enclaveWallet.publicKeyX), bytes32(enclaveWallet.publicKeyY)); - + bytes memory pubKey = abi.encodePacked(bytes1(0x04), bytes32(w.publicKeyX), bytes32(w.publicKeyY)); TeeProofVerifier.AttestationData memory att = TeeProofVerifier.AttestationData({ timestampMs: uint64(block.timestamp * 1000), pcrHash: keccak256("mock-pcr-hash"), publicKey: pubKey, userData: "" }); - vm.broadcast(ownerKey); teeProofVerifier.register("", att); - - require(teeProofVerifier.isRegistered(enclaveWallet.addr), "register failed"); - console2.log("Enclave registered:", enclaveWallet.addr); + console2.log("Enclave registered:", w.addr); } - // ---------------------------------------------------------------- - // Step 2: Create game - // ---------------------------------------------------------------- - function _createGame(uint256 proposerKey) internal { - uint256 defenderBond = factory.initBonds(TEE_GAME_TYPE); - bytes memory extraData = abi.encodePacked(l2SeqNum, type(uint32).max, endBlockHash, endStateHash); - Claim rootClaim = Claim.wrap(keccak256(abi.encode(endBlockHash, endStateHash))); - + uint256 bond = factory.initBonds(TEE_GAME_TYPE); + bytes memory extra = abi.encodePacked(l2SeqNum, type(uint32).max, endBlockHash, endStateHash); + Claim root = Claim.wrap(keccak256(abi.encode(endBlockHash, endStateHash))); vm.broadcast(proposerKey); - game = - TeeDisputeGame(payable(address(factory.create{ value: defenderBond }(TEE_GAME_TYPE, rootClaim, extraData)))); - + game = TeeDisputeGame(payable(address(factory.create{ value: bond }(TEE_GAME_TYPE, root, extra)))); console2.log("Game created:", address(game)); console2.log(" l2SequenceNumber:", l2SeqNum); - console2.log(" rootClaim:", vm.toString(rootClaim.raw())); - console2.log(" proposer:", game.proposer()); } - // ---------------------------------------------------------------- - // Step 3: Challenge - // ---------------------------------------------------------------- - function _challenge(uint256 challengerKey) internal { - uint256 challengerBond = vm.envOr("CHALLENGER_BOND", uint256(0.2 ether)); + uint256 bond = vm.envOr("CHALLENGER_BOND", uint256(0.2 ether)); vm.broadcast(challengerKey); - game.challenge{ value: challengerBond }(); - console2.log("Game challenged by:", vm.addr(challengerKey)); - } - - // ---------------------------------------------------------------- - // Step 4a: Prove with external signature (from TEE prover) - // ---------------------------------------------------------------- - - function _proveExternal(uint256 proposerKey, bytes memory signature) internal { - require(signature.length == 65, "BATCH_SIGNATURE must be 65 bytes (r+s+v)"); - - bytes32 domainSep = game.domainSeparator(); - console2.log("Domain separator:", vm.toString(domainSep)); - console2.log("Using external signature, length:", signature.length); - - TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); - proofs[0] = TeeDisputeGame.BatchProof({ - startBlockHash: startBlockHash, - startStateHash: startStateHash, - endBlockHash: endBlockHash, - endStateHash: endStateHash, - l2Block: l2SeqNum, - signature: signature - }); - - vm.broadcast(proposerKey); - game.prove(abi.encode(proofs)); - - console2.log("Proof submitted successfully!"); + game.challenge{ value: bond }(); + console2.log("Challenged by:", vm.addr(challengerKey)); } - // ---------------------------------------------------------------- - // Step 4b: Prove with mock signing (enclave key signs locally) - // ---------------------------------------------------------------- - - function _proveMock(uint256 proposerKey, uint256 enclaveKey) internal { + function _prove(uint256 proposerKey, uint256 enclaveKey) internal { bytes32 domainSep = game.domainSeparator(); - console2.log("Domain separator:", vm.toString(domainSep)); - - bytes32 digest = _buildBatchDigest(domainSep); - console2.log("EIP-712 digest:", vm.toString(digest)); - + bytes32 structHash = keccak256( + abi.encode(BATCH_PROOF_TYPEHASH, startBlockHash, startStateHash, endBlockHash, endStateHash, l2SeqNum) + ); + bytes32 digest = keccak256(abi.encodePacked("\x19\x01", domainSep, structHash)); (uint8 v, bytes32 r, bytes32 s) = vm.sign(enclaveKey, digest); - bytes memory signature = abi.encodePacked(r, s, v); - console2.log("Batch signed, signature length:", signature.length); TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); proofs[0] = TeeDisputeGame.BatchProof({ @@ -235,36 +121,18 @@ contract TeeProveE2E is Script { endBlockHash: endBlockHash, endStateHash: endStateHash, l2Block: l2SeqNum, - signature: signature + signature: abi.encodePacked(r, s, v) }); - vm.broadcast(proposerKey); game.prove(abi.encode(proofs)); - - console2.log("Proof submitted successfully!"); + console2.log("Proof submitted!"); } - function _buildBatchDigest(bytes32 domainSep) internal view returns (bytes32) { - bytes32 structHash = keccak256( - abi.encode(BATCH_PROOF_TYPEHASH, startBlockHash, startStateHash, endBlockHash, endStateHash, l2SeqNum) - ); - return keccak256(abi.encodePacked("\x19\x01", domainSep, structHash)); - } - - // ---------------------------------------------------------------- - // Step 5: Resolve - // ---------------------------------------------------------------- - function _resolve(uint256 callerKey) internal { vm.broadcast(callerKey); GameStatus result = game.resolve(); - - if (result == GameStatus.DEFENDER_WINS) { - console2.log("Game resolved: DEFENDER_WINS"); - } else if (result == GameStatus.CHALLENGER_WINS) { - console2.log("Game resolved: CHALLENGER_WINS"); - } else { - console2.log("Game resolved: IN_PROGRESS"); - } + if (result == GameStatus.DEFENDER_WINS) console2.log("DEFENDER_WINS"); + else if (result == GameStatus.CHALLENGER_WINS) console2.log("CHALLENGER_WINS"); + else console2.log("IN_PROGRESS"); } } diff --git a/packages/contracts-bedrock/scripts/tee/TeeProveE2EFork.s.sol b/packages/contracts-bedrock/scripts/tee/TeeProveE2EFork.s.sol new file mode 100644 index 0000000000000..9e43d56d810cb --- /dev/null +++ b/packages/contracts-bedrock/scripts/tee/TeeProveE2EFork.s.sol @@ -0,0 +1,209 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import { Script, console2 } from "forge-std/Script.sol"; +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; +import { Claim, GameType, GameStatus } from "src/dispute/lib/Types.sol"; + +/// @title TeeProveE2EFork +/// @notice E2E on forked mainnet: register enclave with real ZK proof, then +/// create game, challenge, prove (external signature), resolve. +/// +/// @dev Usage: +/// # 1. Deploy first: +/// forge script scripts/tee/DeployTeeFork.s.sol --rpc-url http://localhost:8545 --broadcast +/// +/// # 2. Run E2E: +/// PRIVATE_KEY= \ +/// PROPOSER_KEY= \ +/// CHALLENGER_KEY= \ +/// TEE_PROOF_VERIFIER= \ +/// DISPUTE_GAME_FACTORY= \ +/// SEAL=0x \ +/// ATT_TIMESTAMP_MS= \ +/// ATT_PCR_HASH=0x \ +/// ATT_PUBLIC_KEY=0x<65 bytes> \ +/// ATT_USER_DATA=0x \ +/// BATCH_SIGNATURE=0x<65 bytes r+s+v> \ +/// END_BLOCK_HASH=0x... \ +/// END_STATE_HASH=0x... \ +/// L2_SEQUENCE_NUMBER=100 \ +/// forge script scripts/tee/TeeProveE2EFork.s.sol --rpc-url http://localhost:8545 --broadcast +contract TeeProveE2EFork is Script { + bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( + "BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)" + ); + + GameType internal constant TEE_GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); + + TeeProofVerifier internal teeProofVerifier; + IDisputeGameFactory internal factory; + TeeDisputeGame internal game; + + bytes32 internal startBlockHash; + bytes32 internal startStateHash; + bytes32 internal endBlockHash; + bytes32 internal endStateHash; + uint256 internal l2SeqNum; + + function run() external { + uint256 ownerKey = vm.envUint("PRIVATE_KEY"); + uint256 proposerKey = vm.envUint("PROPOSER_KEY"); + uint256 challengerKey = vm.envUint("CHALLENGER_KEY"); + + teeProofVerifier = TeeProofVerifier(vm.envAddress("TEE_PROOF_VERIFIER")); + factory = IDisputeGameFactory(vm.envAddress("DISPUTE_GAME_FACTORY")); + + startBlockHash = vm.envOr("START_BLOCK_HASH", keccak256("genesis-block")); + startStateHash = vm.envOr("START_STATE_HASH", keccak256("genesis-state")); + endBlockHash = vm.envOr("END_BLOCK_HASH", keccak256("end-block-100")); + endStateHash = vm.envOr("END_STATE_HASH", keccak256("end-state-100")); + l2SeqNum = vm.envOr("L2_SEQUENCE_NUMBER", uint256(100)); + + bytes memory batchSig = vm.envBytes("BATCH_SIGNATURE"); + + // ---- Step 1: Register enclave with real ZK proof ---- + console2.log("=== Step 1: Register Enclave (real ZK proof) ==="); + _registerEnclave(ownerKey); + + // ---- Step 2: Create game ---- + console2.log(""); + console2.log("=== Step 2: Create Game ==="); + _createGame(proposerKey); + + // ---- Step 3: Challenge ---- + console2.log(""); + console2.log("=== Step 3: Challenge ==="); + _challenge(challengerKey); + + // ---- Step 4: Prove with external signature ---- + console2.log(""); + console2.log("=== Step 4: Prove (external signature) ==="); + _prove(proposerKey, batchSig); + + // ---- Step 5: Resolve ---- + console2.log(""); + console2.log("=== Step 5: Resolve ==="); + _resolve(proposerKey); + + console2.log(""); + console2.log("=== E2E Complete (fork mode) ==="); + } + + // ---------------------------------------------------------------- + // Step 1: Register enclave with real seal from Boundless + // ---------------------------------------------------------------- + + function _registerEnclave(uint256 ownerKey) internal { + bytes memory seal = vm.envBytes("SEAL"); + uint64 timestampMs = uint64(vm.envUint("ATT_TIMESTAMP_MS")); + bytes32 pcrHash = vm.envBytes32("ATT_PCR_HASH"); + bytes memory publicKey = vm.envBytes("ATT_PUBLIC_KEY"); + bytes memory userData = vm.envOr("ATT_USER_DATA", bytes("")); + + require(publicKey.length == 65, "ATT_PUBLIC_KEY must be 65 bytes"); + + // Derive enclave address from public key + address enclaveAddr = _pubKeyToAddr(publicKey); + + if (teeProofVerifier.isRegistered(enclaveAddr)) { + console2.log("Already registered:", enclaveAddr); + return; + } + + TeeProofVerifier.AttestationData memory att = TeeProofVerifier.AttestationData({ + timestampMs: timestampMs, + pcrHash: pcrHash, + publicKey: publicKey, + userData: userData + }); + + console2.log("Registering with real seal..."); + console2.log(" seal length:", seal.length); + console2.log(" enclave address:", enclaveAddr); + + vm.broadcast(ownerKey); + teeProofVerifier.register(seal, att); + + require(teeProofVerifier.isRegistered(enclaveAddr), "register failed"); + console2.log("Enclave registered:", enclaveAddr); + } + + // ---------------------------------------------------------------- + // Step 2: Create game + // ---------------------------------------------------------------- + + function _createGame(uint256 proposerKey) internal { + uint256 bond = factory.initBonds(TEE_GAME_TYPE); + bytes memory extra = abi.encodePacked(l2SeqNum, type(uint32).max, endBlockHash, endStateHash); + Claim root = Claim.wrap(keccak256(abi.encode(endBlockHash, endStateHash))); + + vm.broadcast(proposerKey); + game = TeeDisputeGame(payable(address(factory.create{ value: bond }(TEE_GAME_TYPE, root, extra)))); + + console2.log("Game created:", address(game)); + console2.log(" l2SequenceNumber:", l2SeqNum); + console2.log(" domainSeparator:", vm.toString(game.domainSeparator())); + } + + // ---------------------------------------------------------------- + // Step 3: Challenge + // ---------------------------------------------------------------- + + function _challenge(uint256 challengerKey) internal { + uint256 bond = vm.envOr("CHALLENGER_BOND", uint256(0.2 ether)); + vm.broadcast(challengerKey); + game.challenge{ value: bond }(); + console2.log("Challenged by:", vm.addr(challengerKey)); + } + + // ---------------------------------------------------------------- + // Step 4: Prove with external signature from TEE prover + // ---------------------------------------------------------------- + + function _prove(uint256 proposerKey, bytes memory signature) internal { + require(signature.length == 65, "BATCH_SIGNATURE must be 65 bytes"); + console2.log("Using external signature, length:", signature.length); + + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = TeeDisputeGame.BatchProof({ + startBlockHash: startBlockHash, + startStateHash: startStateHash, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: l2SeqNum, + signature: signature + }); + + vm.broadcast(proposerKey); + game.prove(abi.encode(proofs)); + + console2.log("Proof submitted!"); + } + + // ---------------------------------------------------------------- + // Step 5: Resolve + // ---------------------------------------------------------------- + + function _resolve(uint256 callerKey) internal { + vm.broadcast(callerKey); + GameStatus result = game.resolve(); + if (result == GameStatus.DEFENDER_WINS) console2.log("DEFENDER_WINS"); + else if (result == GameStatus.CHALLENGER_WINS) console2.log("CHALLENGER_WINS"); + else console2.log("IN_PROGRESS"); + } + + // ---------------------------------------------------------------- + // Helpers + // ---------------------------------------------------------------- + + function _pubKeyToAddr(bytes memory publicKey) internal pure returns (address) { + bytes memory coords = new bytes(64); + for (uint256 i = 0; i < 64; i++) { + coords[i] = publicKey[i + 1]; + } + return address(uint160(uint256(keccak256(coords)))); + } +} From 13272b0732b6f457864a2907c94fb682130c55ed Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 26 Mar 2026 15:32:23 +0800 Subject: [PATCH 19/24] docs: update TEE Dispute Game specification with Chinese translations Revise the TEE Dispute Game specification document to include Chinese translations for key sections, enhancing accessibility for Chinese-speaking developers. The updates cover the overview, purpose, architecture, and contract relationship diagrams, ensuring clarity in both English and Chinese. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 667 +++++++++--------- 1 file changed, 315 insertions(+), 352 deletions(-) diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index cf2090eb9d027..a3042108ddc1a 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -1,103 +1,86 @@ -# TEE Dispute Game Specification +# TEE Dispute Game 规格说明 -## 1. Overview +## 1. 概述 -TeeDisputeGame is a dispute game contract for the OP Stack that replaces interactive bisection (FaultDisputeGame) and ZK proof verification (hypothetical OPSuccinctFaultDisputeGame) with **TEE (Trusted Execution Environment) ECDSA signature verification** for batch state transition proofs. +TeeDisputeGame 是 OP Stack 的争议游戏合约，用 **TEE（可信执行环境）ECDSA 签名验证** 替代交互式二分法（FaultDisputeGame）和 ZK 证明验证（OPSuccinctFaultDisputeGame），实现批量状态转移证明。 -**Purpose:** Enable faster, cheaper dispute resolution by leveraging AWS Nitro Enclave attestations. A TEE executor runs the state transition inside an enclave, signs the result with a registered enclave key, and the on-chain contract verifies the ECDSA signature against the registered enclave set. +**目标**：利用 AWS Nitro Enclave 远程证明，实现更快、更低成本的争议解决。TEE 执行器在 enclave 内运行状态转移，用注册的 enclave 密钥签署结果，链上合约验证 ECDSA 签名。 -**How it fits in the OP Stack:** -- Uses the standard `DisputeGameFactory` for game creation (via Clone pattern) -- Integrates with `AnchorStateRegistry` for anchor state management, finalization, and validity checks -- Uses `BondDistributionMode` (NORMAL/REFUND) from the shared Types library -- Implements `IDisputeGame` interface for compatibility with `OptimismPortal` and other OP infrastructure -- Game type constant: `1960` +**在 OP Stack 中的定位**： +- 通过标准 `DisputeGameFactory` 创建游戏（Clone 模式） +- 与 `AnchorStateRegistry` 集成，管理锚定状态、最终化和有效性检查 +- 使用共享 Types 库中的 `BondDistributionMode`（NORMAL/REFUND） +- 实现 `IDisputeGame` 接口，兼容 OP Stack 标准争议游戏框架（TZ 不使用 OptimismPortal，见 Section 12） +- 游戏类型常量：`1960` --- -## 2. Architecture +## 2. 架构 -### Contract Relationship Diagram +### 合约关系图 ``` +---------------------------+ | DisputeGameFactory | - | (creates Clone proxies) | + | (创建 Clone 代理) | +-----+----------+----------+ | | create() | | gameAtIndex() v v +--------------------------+ | TeeDisputeGame | - | (Clone proxy instance) | + | (Clone 代理实例) | +----+-------+-------+-----+ | | | +----------+ +----+----+ +----------+ v v v v +----------------+ +---------+ +------------------+ +---------------+ | PROPOSER / | | Anchor | | TeeProofVerifier | | IDisputeGame | - | CHALLENGER | | State | | (enclave ECDSA | | (interface) | - | (immutable | | Registry| | verification) | | | - | addresses) | | | +-------+----------+ +---------------+ - +----------------+ +---------+ | + | CHALLENGER | | State | | (enclave ECDSA | | (接口) | + | (不可变地址) | | Registry| | 签名验证) | | | + +----------------+ +---------+ +-------+----------+ +---------------+ v +------------------+ | IRiscZeroVerifier| - | (enclave | - | registration | - | only) | + | (仅用于 enclave | + | 注册时的 ZK 验证)| +------------------+ ``` -### Immutables (set in constructor, shared across all clones) - -| Immutable | Type | Description | -|--------------------------|-------------------------|--------------------------------------------------| -| `GAME_TYPE` | `GameType` | Always `GameType.wrap(1960)` | -| `MAX_CHALLENGE_DURATION` | `Duration` | Window for challenger to post challenge | -| `MAX_PROVE_DURATION` | `Duration` | Window for prover to submit proof after challenge | -| `DISPUTE_GAME_FACTORY` | `IDisputeGameFactory` | Factory that created this game | -| `TEE_PROOF_VERIFIER` | `ITeeProofVerifier` | TEE signature verification contract | -| `CHALLENGER_BOND` | `uint256` | Fixed bond amount required to challenge | -| `ANCHOR_STATE_REGISTRY` | `IAnchorStateRegistry` | Anchor state management | -| `PROPOSER` | `address` | Single allowed proposer address | -| `CHALLENGER` | `address` | Single allowed challenger address | - -### Clone (CWIA) Data Layout - -| Offset | Size | Field | Description | -|--------|---------|-------------------|-----------------------------------------------------| -| 0x00 | 20 bytes| `gameCreator` | Address of the game creator | -| 0x14 | 32 bytes| `rootClaim` | The proposed output root claim | -| 0x34 | 32 bytes| `l1Head` | L1 block hash at game creation | -| 0x54 | 32 bytes| `l2SequenceNumber`| Target L2 block number | -| 0x74 | 4 bytes | `parentIndex` | Index of parent game in factory (0xFFFFFFFF = root) | -| 0x78 | 32 bytes| `blockHash` | L2 block hash component of rootClaim | -| 0x98 | 32 bytes| `stateHash` | L2 state hash component of rootClaim | - -Total extraData: 100 bytes (0x64) starting at offset 0x54. Expected calldata size: `0xBE` (190 bytes). - -### State Variables - -| Variable | Type | Description | -|------------------------------------|-------------------------------|----------------------------------------------| -| `createdAt` | `Timestamp` | Block timestamp of initialization | -| `resolvedAt` | `Timestamp` | Block timestamp of resolution | -| `status` | `GameStatus` | IN_PROGRESS / DEFENDER_WINS / CHALLENGER_WINS| -| `proposer` | `address` | `tx.origin` of the initialize call | -| `initialized` | `bool` | Re-initialization guard | -| `claimData` | `ClaimData` | Single claim (not an array like FDG) | -| `normalModeCredit[addr]` | `mapping(address => uint256)` | Bonds distributed to winners | -| `refundModeCredit[addr]` | `mapping(address => uint256)` | Bonds refunded to original depositors | -| `startingOutputRoot` | `Proposal` | Starting anchor (root hash + block number) | -| `wasRespectedGameTypeWhenCreated` | `bool` | Was this game type respected at creation? | -| `bondDistributionMode` | `BondDistributionMode` | UNDECIDED / NORMAL / REFUND | +### 不可变量（constructor 设置，所有 Clone 共享） + +| 不可变量 | 类型 | 说明 | +|--------------------------|-------------------------|------------------------------------------| +| `GAME_TYPE` | `GameType` | 固定为 `GameType.wrap(1960)` | +| `MAX_CHALLENGE_DURATION` | `Duration` | 挑战者提交挑战的时间窗口 | +| `MAX_PROVE_DURATION` | `Duration` | 挑战后证明者提交证明的时间窗口 | +| `DISPUTE_GAME_FACTORY` | `IDisputeGameFactory` | 创建此游戏的工厂合约 | +| `TEE_PROOF_VERIFIER` | `ITeeProofVerifier` | TEE 签名验证合约 | +| `CHALLENGER_BOND` | `uint256` | 挑战所需的固定保证金金额 | +| `ANCHOR_STATE_REGISTRY` | `IAnchorStateRegistry` | 锚定状态管理合约 | +| `PROPOSER` | `address` | 唯一允许的提议者地址 | +| `CHALLENGER` | `address` | 唯一允许的挑战者地址 | + +### rootClaim 格式 + +``` +rootClaim = keccak256(abi.encode(blockHash, stateHash)) +``` + +blockHash 和 stateHash 通过 extraData 传入。这与 FaultDisputeGame 不同——FDG 的 rootClaim 直接是 output root hash。 + +### 关键设计说明 + +- `wasRespectedGameTypeWhenCreated`：仅为兼容 `IDisputeGame` 接口保留，TZ 不使用 OptimismPortal，此字段无实际消费方（见 Section 12） +- 每个游戏实例使用单个 `ClaimData` 结构体（非数组），区别于 FDG 的追加式 DAG --- -## 3. Game Lifecycle +## 3. 游戏生命周期 + +`DisputeGameFactory.create()` 通过 Clone 模式创建游戏实例后立即调用 `initialize()`，进入状态机。 -### State Machine +### 状态机 ``` initialize() @@ -109,7 +92,7 @@ Total extraData: 100 bytes (0x64) starting at offset 0x54. Expected calldata siz | +------------------+------------------+ | | - challenge() deadline expires + challenge() deadline 过期 | | v v +-------------+ resolve() -> DEFENDER_WINS @@ -118,7 +101,7 @@ Total extraData: 100 bytes (0x64) starting at offset 0x54. Expected calldata siz | +----------+----------+ | | - prove() deadline expires + prove() deadline 过期 | | v v +---------------------------+ resolve() -> CHALLENGER_WINS @@ -130,419 +113,399 @@ Total extraData: 100 bytes (0x64) starting at offset 0x54. Expected calldata siz resolve() -> DEFENDER_WINS ``` -If `prove()` is called while Unchallenged: +Unchallenged 状态下提前 prove 的路径： ``` Unchallenged --> prove() --> UnchallengedAndValidProofProvided --> resolve() --> DEFENDER_WINS ``` -### ProposalStatus Transitions +**重要约束**：`prove()` 内部检查 `gameOver()`，如果 deadline 已过期，prove() 会 revert `GameOver()`。因此 Unchallenged 状态下 prove 只能在 challenge deadline 过期之前调用。 -| From | Action | To | +### ProposalStatus 转移表 + +| 起始状态 | 动作 | 目标状态 | |--------------------------------------|-------------|---------------------------------------| | `Unchallenged` | `challenge()`| `Challenged` | | `Unchallenged` | `prove()` | `UnchallengedAndValidProofProvided` | | `Challenged` | `prove()` | `ChallengedAndValidProofProvided` | -| Any (on resolve) | `resolve()` | `Resolved` | +| 任意非 Resolved | `resolve()` | `Resolved` | -### GameStatus Transitions +以上是全部合法转移路径，其他任何转移都不应发生。 -| Condition | Result | -|----------------------------------------------------|--------------------| -| Parent game resolved as CHALLENGER_WINS | CHALLENGER_WINS | -| Unchallenged + deadline expired | DEFENDER_WINS | -| Challenged + deadline expired (no proof) | CHALLENGER_WINS | -| UnchallengedAndValidProofProvided | DEFENDER_WINS | -| ChallengedAndValidProofProvided | DEFENDER_WINS | +### GameStatus 转移表 -### `gameOver()` Condition +| 条件 | 结果 | +|-----------------------------------------------|------------------| +| 父游戏 resolve 为 CHALLENGER_WINS | CHALLENGER_WINS | +| Unchallenged + deadline 过期 | DEFENDER_WINS | +| Challenged + deadline 过期（无证明） | CHALLENGER_WINS | +| UnchallengedAndValidProofProvided | DEFENDER_WINS | +| ChallengedAndValidProofProvided | DEFENDER_WINS | -```solidity -gameOver_ = claimData.deadline.raw() < block.timestamp || claimData.prover != address(0); -``` +### gameOver 条件 -The game is "over" (no more interactions) when the deadline passes OR a valid proof is submitted. +当 deadline 过期（严格小于 `block.timestamp`）或有效证明已提交时，游戏"结束"——不再接受 challenge 或 prove。 --- -## 4. Initialization +## 4. 挑战-证明模型 -`initialize()` is called by the `DisputeGameFactory` immediately after cloning. +### 与 FaultDisputeGame 的关键差异 -### Validation Checks (in order) +| 维度 | TeeDisputeGame | FaultDisputeGame | +|------|---------------|------------------| +| 证明机制 | TEE ECDSA 签名（单轮） | 交互式二分法 + VM step（多轮） | +| 解决复杂度 | O(1) | O(n) | +| 保证金托管 | 原生 ETH（直接持有） | DelayedWETH（7 天延迟 + 紧急恢复） | +| 保证金模型 | 固定 CHALLENGER_BOND | 基于位置的 bond 曲线 | +| 时间模型 | 固定 deadline | 棋钟 + 延长 | +| 访问控制 | 白名单 proposer + challenger | 无权限（permissionless） | +| 父子链 | 显式 parentIndex | 无（仅 ASR 锚定） | +| Claim 结构 | 单个 ClaimData | 追加式 ClaimData[] DAG | -1. **Not already initialized** -- reverts `AlreadyInitialized` -2. **Caller is the factory** -- reverts `IncorrectDisputeGameFactory` -3. **tx.origin == PROPOSER** -- reverts `BadAuth` -4. **Calldata size is exactly 0xBE (190 bytes)** -- reverts with selector `0x9824bdab` (BadExtraData) -5. **rootClaim == keccak256(abi.encode(blockHash, stateHash))** -- reverts `RootClaimMismatch` -6. **Parent game validation** (if parentIndex != type(uint32).max): - - Parent game type must match `GAME_TYPE` - - Parent must be respected, not blacklisted, not retired (via ASR) - - Parent must not have status CHALLENGER_WINS -7. **l2SequenceNumber > startingOutputRoot.l2SequenceNumber** -- reverts `UnexpectedRootClaim` +### challenge() -### Parent Game Resolution +仅白名单 CHALLENGER 可调用。提交固定金额保证金（`CHALLENGER_BOND`），将游戏从 Unchallenged 转为 Challenged，并重置 deadline 为 prove 窗口。 -- If `parentIndex == type(uint32).max`: uses anchor state from `AnchorStateRegistry.anchors(GAME_TYPE)` -- Otherwise: reads `rootClaim` and `l2SequenceNumber` from the parent TeeDisputeGame proxy +### prove() -### Initialization Side Effects +仅 proposer 可调用——防止第三方抢先提交观察到的证明数据窃取 prover 身份。 -- Sets `claimData` with deadline = `now + MAX_CHALLENGE_DURATION` -- Records `proposer = tx.origin` -- Credits `refundModeCredit[proposer] += msg.value` (the bond) -- Sets `createdAt` and `wasRespectedGameTypeWhenCreated` +**关键设计决策**： +- **提前证明**：prove() 可在 Unchallenged 状态下调用（无需等待挑战），因为 TEE 被信任，有效证明即意味着 claim 正确 +- **证明即终局**：一旦证明成功，gameOver() 立即为 true，阻止后续 challenge()——这是有意设计，不是 bug +- **无需保证金**：证明者不需要质押，激励及时响应挑战 --- -## 5. Challenge-Prove Model +## 5. TEE 证明安全模型 -### Single-Round vs Multi-Round +### 信任链 -| Aspect | TeeDisputeGame | FaultDisputeGame | -|----------------------------|----------------------------------------------|---------------------------------------------------| -| Dispute model | Single-round: challenge + prove | Multi-round interactive bisection + step | -| Claim structure | Single `ClaimData` struct | Append-only `ClaimData[]` array (DAG) | -| Challenge mechanism | `challenge()` with fixed bond | `move()` (attack/defend) with position-based bonds | -| Proof | TEE ECDSA batch signatures | On-chain VM single instruction step | -| Resolution complexity | O(1) - single resolve call | O(n) - bottom-up subgame resolution | -| Time model | Fixed deadlines (challenge window, prove window) | Chess clock with extensions | +TEE 证明本质上是 **Owner 控制的备案制**： -### challenge() +``` +Owner + └─ register() ──→ TeeProofVerifier 备案 enclave EOA + └─ verifyBatch() ──→ 检查签名者是否已备案 + └─ TeeDisputeGame.prove() 接受 +``` -- Requires: `Unchallenged` status, whitelisted challenger, game not over, exact bond amount -- Effects: sets `counteredBy`, transitions to `Challenged`, resets deadline to `now + MAX_PROVE_DURATION` -- Bond: credited to `refundModeCredit[challenger]` +**核心信任假设**：合约无条件信任 Owner 注册的 TEE EOA 签署的状态转移。ZK 证明（RISC Zero）仅用于注册环节验证 TEE attestation 的合法性，不参与运行时的 batch 验证。 -### prove() +**信任边界**： +- Owner 有权注册恶意 enclave +- 已注册 enclave 签署的任何 batch digest 都会被接受 +- 链上不验证状态转移的正确性，只验证"签名者是否在备案名单中" -- Can be called in both `Unchallenged` and `Challenged` states (early proving is by design — TEE is trusted) -- Requires game status `IN_PROGRESS` (cannot prove after resolution) -- Accepts ABI-encoded `BatchProof[]` array -- Verifies chain of batch proofs (see Section 6) -- Records `prover = msg.sender` -- No bond required from prover -- Only the proposer can call `prove()` (`if (msg.sender != proposer) revert BadAuth()`) — this prevents frontrunning attacks where a third party could steal prover credit by submitting observed proof data -- Once proved, `gameOver()` returns true, which blocks further `challenge()` calls — this is intentional since a valid TEE proof confirms the claim is correct +### Enclave 生命周期 ---- +| 阶段 | 动作 | 控制方 | +|------|------|--------| +| 注册 | `register(seal, attestationData)` — ZK 证明验证 Nitro attestation 后备案 EOA | Owner | +| 运行 | `verifyBatch(digest, signature)` — ecrecover + 检查备案状态 | 任何人（view） | +| 单个撤销 | `revoke(address)` — 移除单个备案 | Owner | +| 批量撤销 | `revokeAll()` — 递增 generation，O(1) 撤销所有备案 | Owner | -## 6. Batch Proof Verification +### 批量证明验证概述 -### BatchProof Structure +`prove()` 接受 `BatchProof[]` 数组，验证从 `startingOutputRoot` 到 `rootClaim` 的完整状态转移链： -```solidity -struct BatchProof { - bytes32 startBlockHash; - bytes32 startStateHash; - bytes32 endBlockHash; - bytes32 endStateHash; - uint256 l2Block; - bytes signature; // 65 bytes ECDSA (r + s + v) -} -``` +1. 首个 batch 的起点必须等于锚定状态 +2. 相邻 batch 首尾相连（链式连续性） +3. L2 区块号严格单调递增 +4. 每个 batch 的 EIP-712 签名由已备案 enclave 签署 +5. 末尾 batch 的终点必须等于 rootClaim，区块号等于 l2SequenceNumber -### Verification Steps +### EIP-712 签名方案 -For a `BatchProof[] proofs` array: +batchDigest 使用 EIP-712 typed data hash，domainSeparator 包含 `block.chainid` + `TEE_PROOF_VERIFIER` 地址，提供跨链和跨部署的 replay 保护。`verifyingContract` 使用 `TEE_PROOF_VERIFIER` 而非游戏实例地址，因为 verifier 是签名验证端点且每条链部署唯一。 -1. **Start anchor**: `keccak256(abi.encode(proofs[0].startBlockHash, proofs[0].startStateHash))` must equal `startingOutputRoot.root` -2. **Chain continuity** (for i > 0): `proofs[i].start{Block,State}Hash == proofs[i-1].end{Block,State}Hash` -3. **Monotonic blocks**: `proofs[i].l2Block > prevBlock` (starting from `startingOutputRoot.l2SequenceNumber`) -4. **TEE signature**: For each batch, compute `batchDigest = keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block))` and call `TEE_PROOF_VERIFIER.verifyBatch(batchDigest, signature)` -5. **End anchor**: `keccak256(abi.encode(proofs[last].endBlockHash, proofs[last].endStateHash))` must equal `rootClaim()` -6. **Final block**: `proofs[last].l2Block` must equal `l2SequenceNumber()` +--- -### batchDigest Computation +## 6. 保证金经济学 -``` -batchDigest = keccak256(abi.encode( - startBlockHash, // bytes32 - startStateHash, // bytes32 - endBlockHash, // bytes32 - endStateHash, // bytes32 - l2Block // uint256 -)) -``` +### 保证金流向 -### TeeProofVerifier.verifyBatch() +| 角色 | 时机 | 金额 | 计入 | +|-----------|-------------------|---------------------|----------------------------------| +| Proposer | `initialize()` | `msg.value`（任意，无最低限额） | `refundModeCredit[proposer]` | +| Challenger| `challenge()` | `CHALLENGER_BOND` | `refundModeCredit[challenger]` | -1. `ECDSA.tryRecover(digest, signature)` to recover signer -2. Check `registeredEnclaves[recovered].registeredAt != 0` -3. Return signer address +### resolve() 时的保证金分配 -### Enclave Registration (TeeProofVerifier.register()) +| ProposalStatus | 赢家 | 分配方式 | +|-----------------------------------------------|------------------|------------------------------------------------------| +| Unchallenged（deadline 过期） | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | +| Challenged（deadline 过期，无证明） | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | +| UnchallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | +| ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance`（proposer 获得全部保证金，因为只有 proposer 能 prove）| +| 父游戏 CHALLENGER_WINS（子游戏已被挑战） | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | +| 父游戏 CHALLENGER_WINS（子游戏未被挑战） | Proposer 退款 (CHALLENGER_WINS) | `normalModeCredit[proposer] = balance` | -- Owner-only function -- Verifies RISC Zero ZK proof of AWS Nitro attestation -- Parses journal: timestamp, PCR hash, root key, secp256k1 public key, user data -- Validates root key matches AWS Nitro official root -- Extracts Ethereum address from public key -- Stores `EnclaveInfo{pcrHash, registeredAt}` mapping +### closeGame() 和 BondDistributionMode ---- +领取保证金前，`closeGame()` 根据 ASR 状态决定分配模式（幂等，只执行一次）： + +- **NORMAL 模式**：ASR 判定游戏为 proper（已注册、未黑名单、未退休、未暂停）→ 赢家获得全部保证金 +- **REFUND 模式**：ASR 判定游戏非 proper → 各方退还原始存入金额（安全兜底） -## 7. Bond Economics +暂停期间 closeGame() 会 revert，防止游戏在临时暂停时被永久推入 REFUND 模式。 -### Bond Flow +**与 FaultDisputeGame 的关键区别**：FDG 使用 `DelayedWETH`（deposit/unlock/withdraw 模式）托管保证金，owner 有 `hold()` 紧急恢复函数。TeeDisputeGame 直接在合约中持有 ETH（`address(this).balance`），finality delay 由 `ASR.isGameFinalized()` 强制。 -| Actor | When | Amount | Credited To | -|-----------|-------------------|----------------------|---------------------------| -| Proposer | `initialize()` | `msg.value` (any) | `refundModeCredit[proposer]` | -| Challenger| `challenge()` | `CHALLENGER_BOND` | `refundModeCredit[challenger]` | +**设计理由**：TZ 的 Proposer 和 Challenger 均为特权白名单地址（非 permissionless），不需要 DelayedWETH 的额外延迟和紧急恢复机制。直接持有 ETH 更简单，ASR 的 finality delay + REFUND 模式已提供足够的安全兜底。 -### Bond Distribution on resolve() +--- -| ProposalStatus | Winner | Distribution | -|---------------------------------------|------------------|--------------------------------------------------------------------------------------------------| -| Unchallenged (deadline expired) | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | -| Challenged (deadline expired, no proof) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | -| UnchallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` | -| ChallengedAndValidProofProvided | Proposer (DEFENDER_WINS) | `normalModeCredit[proposer] = balance` (proposer gets all bonds since only proposer can prove) | -| Parent game CHALLENGER_WINS (child challenged) | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | -| Parent game CHALLENGER_WINS (child unchallenged) | Proposer refunded (CHALLENGER_WINS) | `normalModeCredit[proposer] = balance` | +## 7. 父子链式关联 -### closeGame() and BondDistributionMode +### 设计概述 -Before credits can be claimed, `closeGame()` determines the distribution mode: +游戏通过 `parentIndex` 引用父游戏（`0xFFFFFFFF` 表示无父游戏，使用 ASR 锚定状态）。子游戏的 `startingOutputRoot` 继承自父游戏的 `rootClaim`。 -1. Check `ANCHOR_STATE_REGISTRY.isGameFinalized()` (resolved + finality delay elapsed) -2. Try to set this game as the new anchor state -3. Check `ANCHOR_STATE_REGISTRY.isGameProper()` (registered, not blacklisted, not retired, not paused) -4. If proper: `NORMAL` mode (winners get bonds). If not: `REFUND` mode (everyone gets their deposit back) +### 跨类型隔离 -### claimCredit() +父游戏的 GameType 必须与当前游戏一致。TEE 游戏只能链接到其他 TEE 游戏，防止被攻破的 FaultDisputeGame 被用作 TEE 链的起点。 -1. Calls `closeGame()` (idempotent) -2. Reads credit based on `bondDistributionMode` -3. Zeroes both credit mappings -4. Transfers ETH via low-level `call` +### 父游戏失效级联 -**Key difference from FaultDisputeGame:** FDG uses `DelayedWETH` (deposit/unlock/withdraw pattern) for bond custody. TeeDisputeGame holds ETH directly in the contract (`address(this).balance`). +- 父游戏未 resolve 时，子游戏不能 resolve（阻塞等待） +- 父游戏 resolve 为 CHALLENGER_WINS → 子游戏自动 CHALLENGER_WINS + - 子游戏已被挑战：challenger 获得全部保证金 + - 子游戏未被挑战：proposer 保证金被退还（不惩罚无辜 proposer） +- 父游戏 resolve 为 DEFENDER_WINS（或无父游戏）→ 正常解决逻辑 --- -## 8. Parent-Child Chaining +## 8. 访问控制 -### How Games Reference Parents +### 角色总览 -- `parentIndex` is a `uint32` stored in CWIA calldata at offset `0x74` -- `type(uint32).max` (0xFFFFFFFF) means "no parent" (uses anchor state from ASR) -- Any other value is an index into `DisputeGameFactory.gameAtIndex()` +| 角色 | 合约 | 能力 | 说明 | +|------|------|------|------| +| PROPOSER | TeeDisputeGame（immutable） | 创建游戏（tx.origin）、调用 prove() | 单地址，不可变 | +| CHALLENGER | TeeDisputeGame（immutable） | 调用 challenge() | 单地址，不可变 | +| Owner | TeeProofVerifier（Ownable） | 注册/撤销 enclave、更新 verifier/imageId/rootKey | 信任根，详见 Section 5 | +| Guardian | ASR（来自 SystemConfig） | pause/blacklist/retire 游戏 | 间接影响 bond 分配，详见 Section 10 | -### Parent Validation (in initialize()) +**设计说明**： +- Proposer 使用 `tx.origin` 检查（与 PermissionedDisputeGame 一致），Challenger 使用 `msg.sender` 检查 +- 两个地址均在 constructor 设置，所有 Clone 实例共享，更改需部署新 implementation +- TeeProofVerifier 的 Owner 权限极大（可绕过 ZK 门控注册任意地址），是整个系统的信任根 -``` -parentIndex != type(uint32).max: - 1. parentGameType must == GAME_TYPE (cross-type isolation) - 2. Parent must be respected (ASR.isGameRespected) - 3. Parent must not be blacklisted (ASR.isGameBlacklisted) - 4. Parent must not be retired (ASR.isGameRetired) - 5. Parent must not be CHALLENGER_WINS - - startingOutputRoot = { - l2SequenceNumber: parent.l2SequenceNumber(), - root: Hash.wrap(parent.rootClaim().raw()) - } -``` +--- -### Cross-Chain Isolation +## 9. 全系统不变量 -The `GameType` check (`parentGameType == GAME_TYPE`) ensures TEE games can only chain to other TEE games. This prevents a compromised FaultDisputeGame from being used as a starting point for a TEE chain. +以下不变量必须在所有状态下成立。审计和测试应围绕证伪这些性质展开。 -### resolve() Parent Dependency +### 资金安全 -- If parent exists and is still `IN_PROGRESS`: `resolve()` reverts with `ParentGameNotResolved` -- If parent resolved as `CHALLENGER_WINS`: child automatically resolves as `CHALLENGER_WINS`. If the child was challenged, the challenger gets all bonds. If the child was never challenged, the proposer's bond is refunded. -- If parent resolved as `DEFENDER_WINS` (or no parent): normal resolution logic applies +**INV-1**: 合约持有的 ETH ≥ sum(normalModeCredit) + sum(refundModeCredit) +— 任何时刻，合约余额不低于所有未领取 credit 之和 ---- +**INV-2**: claimCredit() 转出的 ETH 总量 ≤ initialize() 和 challenge() 收到的 ETH 总量 +— 合约不会凭空多发 ETH -## 9. AnchorStateRegistry Integration +**INV-3**: REFUND 模式下，每个参与者领取的金额 == 其原始存入金额 +— refundModeCredit 精确等于存入时的 msg.value -### Functions Used by TeeDisputeGame +### 状态机完整性 -| ASR Function | Where Used | Purpose | -|------------------------------|-------------------------|-------------------------------------------------| -| `anchors(GAME_TYPE)` | `initialize()` | Get starting anchor when no parent | -| `respectedGameType()` | `initialize()` | Check if this game type is respected at creation| -| `isGameRespected(proxy)` | `initialize()` | Validate parent game | -| `isGameBlacklisted(proxy)` | `initialize()` | Validate parent game | -| `isGameRetired(proxy)` | `initialize()` | Validate parent game | -| `isGameFinalized(this)` | `closeGame()` | Check resolution + finality delay | -| `setAnchorState(this)` | `closeGame()` | Try to update anchor game | -| `isGameProper(this)` | `closeGame()` | Determine NORMAL vs REFUND mode | +**INV-4**: ProposalStatus 转移只有以下合法路径： +- Unchallenged → Challenged（仅 challenge()） +- Unchallenged → UnchallengedAndValidProofProvided（仅 prove()） +- Challenged → ChallengedAndValidProofProvided（仅 prove()） +- 任意非 Resolved → Resolved（仅 resolve()） -### Anchor State Update Flow +其他任何转移都不应发生。 -``` -claimCredit() -> closeGame() -> ASR.setAnchorState(this) [try/catch] - -> ASR.isGameProper(this) - -> set bondDistributionMode -``` +**INV-5**: GameStatus 一旦从 IN_PROGRESS 变为 DEFENDER_WINS 或 CHALLENGER_WINS，不可逆转 +— status 只能被 resolve() 修改一次 -`setAnchorState` will succeed only if: -- Game claim is valid (proper + respected + finalized + DEFENDER_WINS) -- Game's `l2SequenceNumber` > current anchor's block number +**INV-6**: resolve() 之后，claimData.prover / claimData.counteredBy 不可再变更 -### rootClaim Format +### 访问控制 -``` -rootClaim = keccak256(abi.encode(blockHash, stateHash)) -``` +**INV-7**: 只有 PROPOSER（tx.origin）能通过 Factory 创建游戏 -This differs from FaultDisputeGame where rootClaim is an output root hash directly. The ASR stores this combined hash as the anchor root. +**INV-8**: 只有 CHALLENGER（msg.sender）能调用 challenge() ---- +**INV-9**: 只有 proposer（msg.sender，即 initialize 时记录的地址）能调用 prove() -## 10. Access Control +### 证明完整性 -### Inline Immutable Pattern +**INV-10**: prove() 成功 ⟹ 存在从 startingOutputRoot 到 rootClaim 的完整、连续、单调递增的 batch proof 链，且每个 batch 由当前 generation 的注册 enclave 签名 -TeeDisputeGame uses simple immutable addresses for access control, matching PermissionedDisputeGame's pattern: +**INV-11**: 已 resolve 为 DEFENDER_WINS 的游戏必须满足以下之一： +- (a) 未被挑战且 challenge deadline 已过 +- (b) 提供了有效 TEE 证明（prover != address(0)） -| Role | Storage | Check | -|-------------|-------------------------------|---------------------------------------------| -| Proposer | `address internal immutable PROPOSER` | `initialize()`: `if (tx.origin != PROPOSER) revert BadAuth();` | -| Challenger | `address internal immutable CHALLENGER` | `challenge()`: `if (msg.sender != CHALLENGER) revert BadAuth();` | +### Bond 分配 -Both addresses are set in the constructor and shared across all Clone instances. No external contract calls are needed for access control checks. +**INV-12**: NORMAL 模式下，恰好一个地址的 normalModeCredit == address(this).balance（resolve 时刻），其余为 0 -### TeeProofVerifier Roles +**INV-13**: bondDistributionMode 一旦从 UNDECIDED 变为 NORMAL 或 REFUND，不可再变更 -| Role | Function | Description | -|----------|-------------------------|----------------------------------------------------| -| Owner | `register(seal, journal)` | Register enclave after ZK proof verification | -| Owner | `revoke(enclaveAddress)` | Remove enclave registration | -| Owner | `transferOwnership()` | Transfer ownership | -| Anyone | `verifyBatch()` | Verify batch signature (view, no state change) | +--- -### Comparison: TeeDisputeGame vs PermissionedDisputeGame Access Control +## 10. 外部依赖与信任假设 -| Aspect | TeeDisputeGame | PermissionedDisputeGame | -|----------------------------|----------------------------------------------|---------------------------------------------| -| Proposer check | `tx.origin != PROPOSER` (single address) | `tx.origin == PROPOSER` (single address) | -| Challenger check | `msg.sender != CHALLENGER` (single address) | `msg.sender == PROPOSER \|\| msg.sender == CHALLENGER` | -| Multiple proposers? | No (single immutable address) | No (single immutable address) | -| Permissionless fallback? | No | No | -| Role management | Immutable constructor params | Immutable constructor params | +### 10.1 DisputeGameFactory ---- +**信任级别**：高度信任 -## 11. Comparison with Existing Contracts - -### Feature Comparison Table - -| Feature | TeeDisputeGame | FaultDisputeGame | PermissionedDisputeGame | -|--------------------------------|----------------------------------------|-----------------------------------------|-----------------------------------------| -| **Proof mechanism** | TEE ECDSA batch signatures | Interactive bisection + VM step | Interactive bisection + VM step (gated) | -| **Dispute rounds** | 1 (challenge + prove) | Many (bisection tree) | Many (bisection tree, permissioned) | -| **Claims** | Single ClaimData struct | Append-only ClaimData[] array | Append-only ClaimData[] array | -| **Resolution** | O(1), single resolve() | O(n), bottom-up resolveClaim() | O(n), bottom-up resolveClaim() | -| **Bond custody** | Native ETH in contract | DelayedWETH | DelayedWETH | -| **Bond model** | Fixed challenger bond | Position-dependent bond curve | Position-dependent bond curve | -| **Time model** | Fixed deadlines (challenge, prove) | Chess clock with extensions | Chess clock with extensions | -| **Access control** | Single proposer + challenger addresses | Permissionless | Single proposer + challenger addresses | -| **Parent chaining** | Explicit parentIndex in extraData | N/A (uses ASR anchor only) | N/A (uses ASR anchor only) | -| **L2 block challenge** | N/A (blockHash in extraData) | `challengeRootL2Block()` + RLP proof | `challengeRootL2Block()` + RLP proof | -| **ASR anchor source** | `anchors(GAME_TYPE)` (legacy path) | `getAnchorRoot()` (unified path) | `getAnchorRoot()` (unified path) | -| **Clone pattern** | Solady Clone | Solady Clone | Solady Clone (inherits FDG) | -| **Game type** | 1960 | Configurable | Configurable | -| **Pause handling** | Via ASR.isGameProper (closeGame) | ASR.paused() blocks closeGame | ASR.paused() blocks closeGame | -| **l2SequenceNumber source** | CWIA extraData | CWIA extraData (= l2BlockNumber) | CWIA extraData (= l2BlockNumber) | +**假设**： +- Factory 忠实地调用 initialize()，不会注入恶意 calldata +- Factory 的 gameAtIndex() 返回正确的游戏记录 +- Factory 是可升级合约（由 L1 admin 控制），如果被恶意升级： + - 可伪造 parentIndex 对应的游戏记录 + - 可创建任意 rootClaim 的游戏实例 ---- +**风险缓解**：Factory 的升级由 L1 multisig + timelock 控制 -## 12. Security Considerations +### 10.2 AnchorStateRegistry (ASR) -### Trust Model +**信任级别**：高度信任 -1. **TEE enclave integrity**: The system trusts that registered TEE enclaves correctly execute state transitions. If an enclave is compromised, it could sign invalid state transitions. +**间接依赖链**：ASR 并非独立合约，其关键能力来自 SystemConfig / SuperchainConfig： -2. **TeeProofVerifier owner**: The owner can register arbitrary addresses as enclaves (the ZK proof verification is a trust gate, but the owner controls registration). A compromised owner could register a non-enclave address. +``` +ASR.paused() → SystemConfig.paused() → SuperchainConfig.paused() +ASR._assertOnlyGuardian() → SystemConfig.guardian() +ASR.initialize() → ProxyAdminOwnedBase（需要 ProxyAdmin 授权） +ASR 升级 → ProxyAdmin.upgrade() +``` -3. **Proposer/Challenger immutability**: The PROPOSER and CHALLENGER addresses are immutable constructor params. Changing them requires deploying a new implementation contract. +**假设**： +- ASR 的 guardian（来自 SystemConfig）可以 pause / unpause / blacklist / retire 游戏 +- ASR pause 期间，closeGame() 会 revert（`TeeDisputeGame.sol:431`），意味着所有进行中游戏的 bond 领取被暂停 +- ASR 的 isGameProper() 判定直接决定 NORMAL vs REFUND 模式 +- 如果 ASR guardian 被恶意控制： + - 可通过 blacklist 强制所有游戏进入 REFUND 模式 + - 可通过 pause 永久冻结所有 bond（但不能直接盗取） -4. **Single challenge model**: Unlike FaultDisputeGame's multi-round bisection, only ONE challenger can challenge a proposal. If the challenger fails to follow through with a proof, the proposal is accepted. There is no mechanism for a second challenger. +**风险缓解**：guardian 由 multisig 控制；REFUND 模式是安全兜底 -5. **`tx.origin` usage**: `initialize()` checks `tx.origin != PROPOSER`. Using `tx.origin` means the proposer's EOA is checked regardless of intermediate contracts, which is consistent with PermissionedDisputeGame but has known risks (e.g., meta-transaction relayers would inherit the tx.origin of the outer caller). +#### ⏳ 待决策：TZ 的 SystemConfig / SuperchainConfig 部署方案 -### Potential Risks +TZ 自身不使用 SystemConfig 和 SuperchainConfig，但 ASR 依赖它们。两个候选方案： -1. **Parent chain invalidation cascade**: If a parent game is resolved as CHALLENGER_WINS after child games are created, all children automatically resolve as CHALLENGER_WINS. If the child was challenged, the challenger gets all bonds. If the child was never challenged, the proposer's bond is refunded (not burned to address(0)). +| 维度 | 方案 A：统一管理（复用 XL） | 方案 B：最小化 Stub | +|------|-----------------------------------|-------------------| +| **方案描述** | TZ 的 ASR `systemConfig` 指向 XL 已部署的 SystemConfig | TZ 部署仅实现 `paused()` + `guardian()` 的轻量合约 | +| **部署成本** | 零额外合约 | 需部署 + 测试一个 stub 合约 | +| **运维成本** | 零（XL 团队统一运维） | 低（功能极简，但需关注上游兼容性） | +| **操作独立性** | ✗ — XL pause = TZ pause；XL guardian 控制 TZ 游戏 | ✓ — TZ 有独立的 pause 开关和 guardian | +| **安全隔离** | ✗ — XL guardian 被攻破时 TZ 同时受影响 | ✓ — TZ 和 XL 完全隔离 | +| **风险耦合** | 高 — XL 因自身原因 pause 时，TZ bond 领取也被冻结 | 无 | +| **上游兼容性** | ✓ — 使用标准 SystemConfig，上游升级无影响 | ⚠️ — 上游 ASR 若调用更多 SystemConfig 函数，stub 可能不兼容 | +| **适用前提** | TZ 和 XL 同一团队运营 | TZ 需要独立控制权，但不想 fork ASR | -2. **No replay protection on prove()**: The same proof bytes can be submitted to different game instances if they happen to cover the same state range. This is not a vulnerability (the proof is still valid), but it means provers don't need unique proofs per game. +### 10.3 IRiscZeroVerifier -3. **resolve() when parent not resolved**: If the parent game's status is IN_PROGRESS, `resolve()` reverts with `ParentGameNotResolved`. This blocks resolution until the parent resolves, which could delay credit claims. +**信任级别**：信任其正确性 -4. **Bond held as native ETH**: Unlike FaultDisputeGame which uses DelayedWETH for withdrawal delays, TeeDisputeGame holds ETH directly. The finality delay is enforced by `ASR.isGameFinalized()` instead. +**假设**： +- verify(seal, imageId, journalDigest) 正确验证 RISC Zero Groth16 证明 +- 如果 verifier 有 bug 或被替换为恶意实现： + - 可注册非法 enclave 地址 + - 后果：非法地址可签署任意 batch proof → 伪造状态转移 -5. **Enclave registration root key comparison**: `TeeProofVerifier.register()` compares root keys via `keccak256(rootKey) != keccak256(expectedRootKey)`, which is correct but uses dynamic memory allocation for the hash. The `expectedRootKey` is stored as `bytes` (storage-heavy) rather than a `bytes32` hash. +**风险缓解**： +- TeeProofVerifier.setRiscZeroVerifier() 为 Owner-only +- 建议：verifier 地址变更应经过 timelock ---- +### 10.4 AWS Nitro Root Key -## 13. Optimization Suggestions +**信任级别**：信任 AWS 硬件安全 -### 1. Use `getAnchorRoot()` instead of `anchors()` +**假设**： +- expectedRootKey 是 AWS Nitro 的官方 P384 公钥 +- AWS 可能轮换 root key（历史上未发生，但理论上可能） -In `initialize()`, when `parentIndex == type(uint32).max`: +**生命周期管理**： +- TeeProofVerifier.setExpectedRootKey() 可由 Owner 更新 +- ⚠️ 无 timelock，Owner 可立即替换为任意 key +- ⚠️ 替换后，之前用旧 key 注册的 enclave 不会自动失效（它们的 enclaveRegisteredGeneration 未受影响） +- 建议：root key 变更应配合 revokeAll() 使用 -```solidity -// Current (uses legacy function): -(startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = - IAnchorStateRegistry(ANCHOR_STATE_REGISTRY).anchors(GAME_TYPE); +### 10.5 TEE Enclave 硬件 -// Suggested (uses current function): -(startingOutputRoot.root, startingOutputRoot.l2SequenceNumber) = - ANCHOR_STATE_REGISTRY.getAnchorRoot(); -``` +**信任级别**：信任 enclave 在未被攻破时正确执行 -The `anchors()` function is explicitly marked `@custom:legacy` in AnchorStateRegistry and ignores the `GameType` parameter entirely. Using `getAnchorRoot()` is more correct and future-proof. +**假设**： +- 注册的 enclave 忠实执行状态转移并签名 +- 如果 enclave 被攻破（旁路攻击、供应链攻击等）： + - 可签署任意虚假状态转移 + - 需要 Owner 通过 revoke() 或 revokeAll() 撤销 + - 在撤销前，已签名的虚假 proof 可能已被提交 -### 2. Add pause check in closeGame() +--- -FaultDisputeGame's `closeGame()` explicitly checks `ANCHOR_STATE_REGISTRY.paused()` and reverts with `GamePaused()` to prevent games from entering REFUND mode during temporary pauses. TeeDisputeGame relies on `isGameProper()` returning false during pauses (which sends games to REFUND mode), but this means paused games permanently enter REFUND mode rather than waiting. Consider adding: +## 11. 应急机制与升级路径 -```solidity -if (ANCHOR_STATE_REGISTRY.paused()) revert GamePaused(); -``` +### 11.1 Enclave 撤销机制 -### 3. Add resolvedAt check in closeGame() +**单个撤销**： +- `TeeProofVerifier.revoke(address)` — Owner 移除单个 enclave -FaultDisputeGame's `closeGame()` explicitly checks `resolvedAt.raw() != 0` before proceeding. TeeDisputeGame relies on `ASR.isGameFinalized()` to check this, but adding an explicit local check would be defensive: +**批量撤销（Generation 机制）**： +- `TeeProofVerifier.revokeAll()` — Owner 递增 enclaveGeneration +- 效果：所有当前 generation 的 enclave 立即失效（O(1)） +- ⚠️ 已提交的 proof 不受影响 — prove() 在调用时验证签名，如果 enclave 在 prove() 调用之前被撤销，该 proof 将失败 +- ⚠️ 已 resolve 的游戏不受影响 — 即使事后发现 enclave 被攻破，已完成的游戏状态不可逆转。应通过 ASR blacklist 处理 -```solidity -if (resolvedAt.raw() == 0) revert GameNotResolved(); -``` +### 11.2 ASR Pause 对进行中游戏的影响 -### 4. Store expectedRootKey as bytes32 hash +| 游戏阶段 | Pause 影响 | +|----------|-----------| +| Unchallenged（等待挑战） | challenge() 不受影响（无 pause 检查）| +| Challenged（等待证明） | prove() 不受影响（无 pause 检查）| +| 等待 resolve | resolve() 不受影响（无 pause 检查）| +| 已 resolve，等待 closeGame | closeGame() 被阻塞 → bond 无法领取 | +| 已 close，等待 claimCredit | claimCredit() 不受影响（close 是幂等的）| -In TeeProofVerifier, storing `expectedRootKey` as `bytes` uses ~3 storage slots (96 bytes). Instead, store the keccak256 hash: +**关键结论**：pause 只影响 bond 领取，不影响游戏逻辑本身。长时间 pause 不会导致资金丢失，但会延迟资金释放。 -```solidity -bytes32 public immutable expectedRootKeyHash; -// In register(): if (keccak256(rootKey) != expectedRootKeyHash) revert InvalidRootKey(); -``` +### 11.3 升级路径 + +**TeeDisputeGame**： +- Clone proxy 模式，implementation 不可升级 +- 如需修复漏洞：部署新 implementation → Factory 注册新 gameType → ASR retire 旧 gameType +- 已创建的旧游戏继续运行，但无法作为新游戏的 parent（因为 parentGameType != 新 GAME_TYPE） + +**TeeProofVerifier**： +- 非 proxy，不可升级 +- 但 Owner 可更新关键参数：riscZeroVerifier / imageId / expectedRootKey +- 如需替换：部署新合约 → 部署新 TeeDisputeGame implementation 指向新 verifier -### 5. Consider allowing multiple challengers +### 11.4 应急 SOP（建议） + +如果发现 TEE enclave 被攻破： +1. Owner 调用 `revokeAll()` 撤销所有 enclave +2. Guardian 通过 ASR blacklist 被攻破 enclave 签名的游戏 +3. 排查受影响游戏，blacklist 后这些游戏进入 REFUND 模式 +4. 重新注册可信 enclave +5. 新游戏从 anchor state 继续 + +--- -The current model allows only one challenger per game. If the first challenger colludes with the proposer (challenges but never provides proof), the game resolves in the challenger's favor, not a third party's. While the bond economics discourage this, allowing multiple challengers or a challenge-replacement mechanism would be more robust. +## 12. 超出范围的威胁 -### 6. Use EIP-712 typed data for batchDigest +以下威胁被认为超出本合约系统的防御范围： -The current `batchDigest` is a plain `keccak256(abi.encode(...))`. Using EIP-712 structured data would: -- Prevent cross-contract replay if another contract uses the same digest scheme -- Provide better wallet UX for TEE key management +1. **TEE 硬件级攻击**：旁路攻击、电压故障注入等物理攻击。缓解依赖 AWS Nitro 硬件安全保证。 -### 7. Add explicit receive()/fallback() +2. **L1 Reorg**：深度 L1 重组可能导致已 resolve 的游戏状态回滚。这是 L1 共识层风险，非合约层可防御。 -The contract accepts ETH via `initialize()` and `challenge()` (both `payable`), but has no `receive()` function. If ETH is accidentally sent directly, it will be lost. Consider adding a `receive()` that reverts. +3. **Owner / Guardian 密钥泄露**：如果 Owner multisig 被完全攻破，攻击者可注册恶意 enclave、替换 verifier、修改 root key。缓解依赖密钥管理实践和 multisig/timelock 配置。 -### 8. Consider reentrancy guard on claimCredit() +4. **L1 Gas Price 攻击**：攻击者通过操纵 L1 gas price 阻止 challenger/prover 在 deadline 内提交交易。缓解依赖合理设置 MAX_CHALLENGE_DURATION 和 MAX_PROVE_DURATION。 -`claimCredit()` makes a low-level `call` to `_recipient` before the function completes. While credits are zeroed before the call, a reentrancy guard would be a defense-in-depth measure consistent with best practices. +5. **跨链 MEV**：利用 L1/L2 之间的信息不对称进行的套利。不在合约层面防御。 -### 9. Align resolve() checks with FaultDisputeGame +6. **DisputeGameFactory 升级攻击**：Factory 由 L1 governance 控制，恶意升级可绕过所有游戏安全假设。依赖治理安全。 -FaultDisputeGame uses `GameNotInProgress` error for the "already resolved" check. TeeDisputeGame uses `ClaimAlreadyResolved`. Consider using the same error for consistency, or renaming to avoid confusion (since `ClaimAlreadyResolved` is also used in FDG's `resolveClaim` with a different semantic meaning). +7. **OptimismPortal 提款证明**：TZ 不使用 OptimismPortal 进行 L1↔L2 提款。TZ 的 dispute game 仅用于将 state root 和 TEE proof 公布在 L1 上，跨链桥和提款机制不依赖游戏结果。因此 OptimismPortal 相关的安全假设（`wasRespectedGameTypeWhenCreated`、withdrawal finality 等）不在 TZ 的审计范围内。 From c2b317ef4b2efad8a73e455cbbd6ba07d891b5ea Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 26 Mar 2026 16:25:15 +0800 Subject: [PATCH 20/24] refactor: make key parameters immutable in TeeProofVerifier Update TeeProofVerifier contract to set riscZeroVerifier, imageId, and expectedRootKey as immutable after deployment, enhancing security by preventing runtime changes. Remove associated setter functions and update tests to reflect immutability. Revise TEE Dispute Game specification to clarify the implications of these changes on system trust and owner permissions. --- .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 26 ++++++------ .../src/dispute/tee/TeeProofVerifier.sol | 36 ++++------------- .../test/dispute/tee/TeeProofVerifier.t.sol | 40 ++++--------------- 3 files changed, 26 insertions(+), 76 deletions(-) diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index a3042108ddc1a..b64f655e4a377 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -286,13 +286,13 @@ batchDigest 使用 EIP-712 typed data hash，domainSeparator 包含 `block.chain |------|------|------|------| | PROPOSER | TeeDisputeGame（immutable） | 创建游戏（tx.origin）、调用 prove() | 单地址，不可变 | | CHALLENGER | TeeDisputeGame（immutable） | 调用 challenge() | 单地址，不可变 | -| Owner | TeeProofVerifier（Ownable） | 注册/撤销 enclave、更新 verifier/imageId/rootKey | 信任根，详见 Section 5 | +| Owner | TeeProofVerifier（Ownable） | 注册/撤销 enclave | 信任根，详见 Section 5 | | Guardian | ASR（来自 SystemConfig） | pause/blacklist/retire 游戏 | 间接影响 bond 分配，详见 Section 10 | **设计说明**： - Proposer 使用 `tx.origin` 检查（与 PermissionedDisputeGame 一致），Challenger 使用 `msg.sender` 检查 - 两个地址均在 constructor 设置，所有 Clone 实例共享，更改需部署新 implementation -- TeeProofVerifier 的 Owner 权限极大（可绕过 ZK 门控注册任意地址），是整个系统的信任根 +- TeeProofVerifier 的 Owner 可注册任意 Enclave，只要是 AWS Enclave 就可以注册，是整个系统的信任根 --- @@ -409,13 +409,11 @@ TZ 自身不使用 SystemConfig 和 SuperchainConfig，但 ASR 依赖它们。 **假设**： - verify(seal, imageId, journalDigest) 正确验证 RISC Zero Groth16 证明 -- 如果 verifier 有 bug 或被替换为恶意实现： - - 可注册非法 enclave 地址 - - 后果：非法地址可签署任意 batch proof → 伪造状态转移 +- 如果 verifier 有 bug：可注册非法 enclave 地址 → 伪造状态转移 **风险缓解**： -- TeeProofVerifier.setRiscZeroVerifier() 为 Owner-only -- 建议：verifier 地址变更应经过 timelock +- `riscZeroVerifier` 为 immutable，部署后不可替换。如需更换 verifier 需部署新的 TeeProofVerifier 合约 +- `imageId` 为 immutable，部署后不可更改。如需更换 guest image 需部署新合约 ### 10.4 AWS Nitro Root Key @@ -426,10 +424,9 @@ TZ 自身不使用 SystemConfig 和 SuperchainConfig，但 ASR 依赖它们。 - AWS 可能轮换 root key（历史上未发生，但理论上可能） **生命周期管理**： -- TeeProofVerifier.setExpectedRootKey() 可由 Owner 更新 -- ⚠️ 无 timelock，Owner 可立即替换为任意 key -- ⚠️ 替换后，之前用旧 key 注册的 enclave 不会自动失效（它们的 enclaveRegisteredGeneration 未受影响） -- 建议：root key 变更应配合 revokeAll() 使用 +- `expectedRootKey` 在构造器中设置，部署后不可更改（无 setter 函数） +- 如果 AWS 轮换 root key：需部署新的 TeeProofVerifier → 部署新的 TeeDisputeGame implementation 指向新 verifier +- 此设计牺牲了运行时灵活性，换取了更小的 Owner 攻击面（Owner 无法在运行时替换 verifier/imageId/rootKey） ### 10.5 TEE Enclave 硬件 @@ -478,8 +475,9 @@ TZ 自身不使用 SystemConfig 和 SuperchainConfig，但 ASR 依赖它们。 **TeeProofVerifier**： - 非 proxy，不可升级 -- 但 Owner 可更新关键参数：riscZeroVerifier / imageId / expectedRootKey -- 如需替换：部署新合约 → 部署新 TeeDisputeGame implementation 指向新 verifier +- riscZeroVerifier / imageId / expectedRootKey 均为不可变参数，部署后无法更改 +- Owner 仅保留 enclave 注册/撤销权限 +- 如需更换 verifier / imageId / rootKey：部署新的 TeeProofVerifier → 部署新的 TeeDisputeGame implementation 指向新 verifier ### 11.4 应急 SOP（建议） @@ -500,7 +498,7 @@ TZ 自身不使用 SystemConfig 和 SuperchainConfig，但 ASR 依赖它们。 2. **L1 Reorg**：深度 L1 重组可能导致已 resolve 的游戏状态回滚。这是 L1 共识层风险，非合约层可防御。 -3. **Owner / Guardian 密钥泄露**：如果 Owner multisig 被完全攻破，攻击者可注册恶意 enclave、替换 verifier、修改 root key。缓解依赖密钥管理实践和 multisig/timelock 配置。 +3. **Owner / Guardian 密钥泄露**：如果 Owner multisig 被完全攻破，攻击者可注册恶意 enclave（但无法替换 verifier、imageId 或 rootKey，因为这些是不可变参数）。缓解依赖密钥管理实践和 multisig/timelock 配置。 4. **L1 Gas Price 攻击**：攻击者通过操纵 L1 gas price 阻止 challenger/prover 在 deadline 内提交交易。缓解依赖合理设置 MAX_CHALLENGE_DURATION 和 MAX_PROVE_DURATION。 diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol index 81aac9249ed34..17c00d503a4e8 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeProofVerifier.sol @@ -37,13 +37,15 @@ contract TeeProofVerifier is Ownable { // State Vars // //////////////////////////////////////////////////////////////// - /// @notice RISC Zero Groth16 verifier (only called during registration) - IRiscZeroVerifier public riscZeroVerifier; + /// @notice RISC Zero Groth16 verifier (only called during registration, immutable after deployment) + IRiscZeroVerifier public immutable riscZeroVerifier; - /// @notice RISC Zero guest image ID (hash of the attestation verification guest ELF) - bytes32 public imageId; + /// @notice RISC Zero guest image ID (hash of the attestation verification guest ELF, immutable after deployment) + bytes32 public immutable imageId; - /// @notice Expected AWS Nitro root public key (96 bytes, P384 without 0x04 prefix) + /// @notice Expected AWS Nitro root public key (96 bytes, P384 without 0x04 prefix). + /// Set in constructor and never changed. Cannot use `immutable` keyword because Solidity + /// does not support immutable for dynamic `bytes` type. bytes public expectedRootKey; /// @notice Current enclave generation (starts at 1, increments on bulk revocation) @@ -62,9 +64,6 @@ contract TeeProofVerifier is Ownable { event EnclaveRegistered(address indexed enclaveAddress, bytes32 indexed pcrHash, uint64 timestampMs); event EnclaveRevoked(address indexed enclaveAddress); event AllEnclavesRevoked(uint256 previousGeneration, uint256 newGeneration); - event RiscZeroVerifierUpdated(IRiscZeroVerifier indexed oldVerifier, IRiscZeroVerifier indexed newVerifier); - event ImageIdUpdated(bytes32 indexed oldImageId, bytes32 indexed newImageId); - event ExpectedRootKeyUpdated(bytes oldKey, bytes newKey); //////////////////////////////////////////////////////////////// // Errors // @@ -191,27 +190,6 @@ contract TeeProofVerifier is Ownable { emit AllEnclavesRevoked(previousGeneration, enclaveGeneration); } - /// @notice Update the RISC Zero verifier contract - function setRiscZeroVerifier(IRiscZeroVerifier _verifier) external onlyOwner { - IRiscZeroVerifier oldVerifier = riscZeroVerifier; - riscZeroVerifier = _verifier; - emit RiscZeroVerifierUpdated(oldVerifier, _verifier); - } - - /// @notice Update the RISC Zero guest image ID - function setImageId(bytes32 _imageId) external onlyOwner { - bytes32 oldImageId = imageId; - imageId = _imageId; - emit ImageIdUpdated(oldImageId, _imageId); - } - - /// @notice Update the expected AWS Nitro root public key - function setExpectedRootKey(bytes memory _rootKey) external onlyOwner { - bytes memory oldKey = expectedRootKey; - expectedRootKey = _rootKey; - emit ExpectedRootKeyUpdated(oldKey, _rootKey); - } - //////////////////////////////////////////////////////////////// // Internal Functions // //////////////////////////////////////////////////////////////// diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol index 2b3fd2b76eac0..9fd384e48059d 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeProofVerifier.t.sol @@ -3,7 +3,6 @@ pragma solidity ^0.8.15; import { Vm } from "forge-std/Vm.sol"; import { TeeProofVerifier } from "src/dispute/tee/TeeProofVerifier.sol"; -import { IRiscZeroVerifier } from "interfaces/dispute/IRiscZeroVerifier.sol"; import { MockRiscZeroVerifier } from "test/dispute/tee/mocks/MockRiscZeroVerifier.sol"; import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; @@ -219,43 +218,18 @@ contract TeeProofVerifierTest is TeeTestUtils { verifier.verifyBatch(digest, signature); } - // ============ Setter Tests ============ + // ============ Immutability Tests ============ - function test_setRiscZeroVerifier_succeeds() public { - MockRiscZeroVerifier newVerifier = new MockRiscZeroVerifier(); - verifier.setRiscZeroVerifier(newVerifier); - assertEq(address(verifier.riscZeroVerifier()), address(newVerifier)); + function test_riscZeroVerifier_isImmutable() public view { + assertEq(address(verifier.riscZeroVerifier()), address(riscZeroVerifier)); } - function test_setRiscZeroVerifier_revertNonOwner() public { - vm.prank(makeAddr("attacker")); - vm.expectRevert("Ownable: caller is not the owner"); - verifier.setRiscZeroVerifier(IRiscZeroVerifier(address(1))); - } - - function test_setImageId_succeeds() public { - bytes32 newImageId = keccak256("new-image"); - verifier.setImageId(newImageId); - assertEq(verifier.imageId(), newImageId); - } - - function test_setImageId_revertNonOwner() public { - vm.prank(makeAddr("attacker")); - vm.expectRevert("Ownable: caller is not the owner"); - verifier.setImageId(keccak256("new-image")); - } - - function test_setExpectedRootKey_succeeds() public { - bytes memory newKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); - verifier.setExpectedRootKey(newKey); - assertEq(keccak256(verifier.expectedRootKey()), keccak256(newKey)); + function test_imageId_isImmutable() public view { + assertEq(verifier.imageId(), IMAGE_ID); } - function test_setExpectedRootKey_revertNonOwner() public { - bytes memory newKey = abi.encodePacked(bytes32(uint256(4)), bytes32(uint256(5)), bytes32(uint256(6))); - vm.prank(makeAddr("attacker")); - vm.expectRevert("Ownable: caller is not the owner"); - verifier.setExpectedRootKey(newKey); + function test_expectedRootKey_isSetInConstructor() public view { + assertEq(keccak256(verifier.expectedRootKey()), keccak256(expectedRootKey)); } // ============ Ownership Tests ============ From 68826d8d57a59e76249288757efb0e40cf501046 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Thu, 26 Mar 2026 16:46:35 +0800 Subject: [PATCH 21/24] test: add boundary, invariant, and edge-case tests for TEE dispute game Add 11 deterministic unit tests and 5 Foundry invariant tests based on audit report recommendations. Covers INV-1 (balance >= credits), INV-4 (status monotonicity), INV-5 (GameStatus irreversible), INV-6 (claimData immutable after resolve), INV-12 (single NORMAL credit recipient), and INV-13 (bondDistributionMode irreversible). Also adds double-prove, double-resolve, prove-then-challenge, and deadline boundary revert tests. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../test/dispute/tee/TeeDisputeGame.t.sol | 289 ++++++++++++++++++ .../dispute/tee/TeeDisputeGameInvariant.t.sol | 278 +++++++++++++++++ 2 files changed, 567 insertions(+) create mode 100644 packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameInvariant.t.sol diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol index af695d7734738..541f01b4fcdd9 100644 --- a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGame.t.sol @@ -11,8 +11,10 @@ import { ClaimAlreadyChallenged, InvalidParentGame, ParentGameNotResolved, + GameOver, GameNotOver } from "src/dispute/tee/lib/Errors.sol"; +import { ClaimAlreadyResolved } from "src/dispute/lib/Errors.sol"; import { BondDistributionMode, Duration, GameType, Claim, Hash, GameStatus } from "src/dispute/lib/Types.sol"; import { MockAnchorStateRegistry } from "test/dispute/tee/mocks/MockAnchorStateRegistry.sol"; import { MockDisputeGameFactory } from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; @@ -671,6 +673,293 @@ contract TeeDisputeGameTest is TeeTestUtils { game.resolve(); } + //////////////////////////////////////////////////////////////// + // Audit: Boundary & Invariant Tests // + //////////////////////////////////////////////////////////////// + + /// @notice INV-6: prove() should revert after resolve (claimData immutable) + function test_prove_revertAfterResolve() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + // Wait for challenge deadline to expire, then resolve + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + // prove after resolve should revert + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() + ); + + vm.prank(proposer); + vm.expectRevert(ClaimAlreadyResolved.selector); + game.prove(abi.encode(proofs)); + } + + /// @notice INV-6: challenge() should revert after resolve (claimData immutable) + function test_challenge_revertAfterResolve() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + vm.prank(challenger); + vm.expectRevert(ClaimAlreadyChallenged.selector); + game.challenge{ value: CHALLENGER_BOND }(); + } + + /// @notice Double prove: second prove() should revert with GameOver + function test_prove_revertWhenAlreadyProved() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() + ); + + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // Second prove should revert (gameOver = true because prover != address(0)) + vm.prank(proposer); + vm.expectRevert(GameOver.selector); + game.prove(abi.encode(proofs)); + } + + /// @notice challenge should revert after prove (gameOver blocks further challenges) + function test_challenge_revertAfterProve() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() + ); + + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // After prove, status is UnchallengedAndValidProofProvided. + // challenge() checks status != Unchallenged first → revert ClaimAlreadyChallenged + vm.prank(challenger); + vm.expectRevert(ClaimAlreadyChallenged.selector); + game.challenge{ value: CHALLENGER_BOND }(); + } + + /// @notice challenge should revert after deadline expires + function test_challenge_revertAfterDeadline() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + + vm.prank(challenger); + vm.expectRevert(GameOver.selector); + game.challenge{ value: CHALLENGER_BOND }(); + } + + /// @notice Double resolve should revert + function test_resolve_revertWhenAlreadyResolved() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + vm.expectRevert(ClaimAlreadyResolved.selector); + game.resolve(); + } + + /// @notice INV-6: claimData.prover and claimData.counteredBy cannot change after resolve + function test_invariant6_claimDataImmutableAfterResolve() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + // Challenge + vm.prank(challenger); + game.challenge{ value: CHALLENGER_BOND }(); + + // Prove + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() + ); + vm.prank(proposer); + game.prove(abi.encode(proofs)); + + // resolve + game.resolve(); + + // Snapshot claimData after resolve + (, address counteredBy, address prover,, TeeDisputeGame.ProposalStatus postStatus,) = game.claimData(); + assertEq(counteredBy, challenger); + assertEq(prover, proposer); + assertEq(uint8(postStatus), uint8(TeeDisputeGame.ProposalStatus.Resolved)); + + // Confirm prove / challenge cannot modify claimData + vm.prank(proposer); + vm.expectRevert(ClaimAlreadyResolved.selector); + game.prove(abi.encode(proofs)); + + vm.prank(challenger); + vm.expectRevert(ClaimAlreadyChallenged.selector); + game.challenge{ value: CHALLENGER_BOND }(); + + // claimData remains unchanged + (, address counteredBy2, address prover2,, TeeDisputeGame.ProposalStatus postStatus2,) = game.claimData(); + assertEq(counteredBy2, challenger); + assertEq(prover2, proposer); + assertEq(uint8(postStatus2), uint8(TeeDisputeGame.ProposalStatus.Resolved)); + } + + /// @notice INV-1: contract balance >= active mode credit sum after resolve + /// @dev Both normalModeCredit and refundModeCredit coexist in storage, but claimCredit + /// only reads one mode. Correct invariant: balance >= max(sum(normal), sum(refund)). + function test_invariant1_balanceCoversCredits_defenderWins() public { + bytes32 endBlockHash = keccak256("end-block"); + bytes32 endStateHash = keccak256("end-state"); + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, endBlockHash, endStateHash); + + vm.prank(challenger); + game.challenge{ value: CHALLENGER_BOND }(); + + teeProofVerifier.setRegistered(executor, true); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + proofs[0] = buildBatchProof( + BatchInput({ + startBlockHash: ANCHOR_BLOCK_HASH, + startStateHash: ANCHOR_STATE_HASH, + endBlockHash: endBlockHash, + endStateHash: endStateHash, + l2Block: game.l2SequenceNumber() + }), + DEFAULT_EXECUTOR_KEY, + game.domainSeparator() + ); + vm.prank(proposer); + game.prove(abi.encode(proofs)); + game.resolve(); + + // INV-1: balance ≥ max(sum(normalModeCredit), sum(refundModeCredit)) + uint256 totalNormal = game.normalModeCredit(proposer) + game.normalModeCredit(challenger); + uint256 totalRefund = game.refundModeCredit(proposer) + game.refundModeCredit(challenger); + assertGe(address(game).balance, totalNormal, "INV-1: balance < sum(normalModeCredit)"); + assertGe(address(game).balance, totalRefund, "INV-1: balance < sum(refundModeCredit)"); + + // INV-12: In NORMAL mode, exactly one address has normalModeCredit (proposer wins) + assertGt(game.normalModeCredit(proposer), 0); + assertEq(game.normalModeCredit(challenger), 0); + } + + /// @notice INV-1 + INV-12: balance covers credit when CHALLENGER_WINS + function test_invariant1_balanceCoversCredits_challengerWins() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.prank(challenger); + game.challenge{ value: CHALLENGER_BOND }(); + + vm.warp(block.timestamp + MAX_PROVE_DURATION + 1); + game.resolve(); + + // INV-1: balance ≥ max(sum(normalModeCredit), sum(refundModeCredit)) + uint256 totalNormal = game.normalModeCredit(proposer) + game.normalModeCredit(challenger); + uint256 totalRefund = game.refundModeCredit(proposer) + game.refundModeCredit(challenger); + assertGe(address(game).balance, totalNormal, "INV-1: balance < sum(normalModeCredit)"); + assertGe(address(game).balance, totalRefund, "INV-1: balance < sum(refundModeCredit)"); + + // INV-12: when challenger wins, only challenger has credit + assertEq(game.normalModeCredit(proposer), 0); + assertGt(game.normalModeCredit(challenger), 0); + } + + /// @notice INV-5: GameStatus is irreversible — status unchanged after resolve + function test_invariant5_gameStatusIrreversible() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + GameStatus statusAfterResolve = game.status(); + assertEq(uint8(statusAfterResolve), uint8(GameStatus.DEFENDER_WINS)); + + // Second resolve should revert + vm.expectRevert(ClaimAlreadyResolved.selector); + game.resolve(); + + // Status unchanged + assertEq(uint8(game.status()), uint8(statusAfterResolve)); + } + + /// @notice INV-13: bondDistributionMode is irreversible once set + function test_invariant13_bondDistributionModeIrreversible() public { + (TeeDisputeGame game,,) = + _createGame(proposer, ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + + vm.warp(block.timestamp + MAX_CHALLENGE_DURATION + 1); + game.resolve(); + + // Set ASR flags so closeGame can execute + anchorStateRegistry.setGameFlags(game, true, true, false, false, true, true, false); + game.closeGame(); + + BondDistributionMode modeAfterClose = game.bondDistributionMode(); + assertEq(uint8(modeAfterClose), uint8(BondDistributionMode.NORMAL)); + + // closeGame is idempotent, mode unchanged + game.closeGame(); + assertEq(uint8(game.bondDistributionMode()), uint8(modeAfterClose)); + } + function _createGame( address creator, uint256 l2SequenceNumber, diff --git a/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameInvariant.t.sol b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameInvariant.t.sol new file mode 100644 index 0000000000000..2a3dbeba96085 --- /dev/null +++ b/packages/contracts-bedrock/test/dispute/tee/TeeDisputeGameInvariant.t.sol @@ -0,0 +1,278 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.15; + +import { IDisputeGameFactory } from "interfaces/dispute/IDisputeGameFactory.sol"; +import { IDisputeGame } from "interfaces/dispute/IDisputeGame.sol"; +import { IAnchorStateRegistry } from "interfaces/dispute/IAnchorStateRegistry.sol"; +import { ITeeProofVerifier } from "interfaces/dispute/ITeeProofVerifier.sol"; +import { TeeDisputeGame, TEE_DISPUTE_GAME_TYPE } from "src/dispute/tee/TeeDisputeGame.sol"; +import { BondDistributionMode, Duration, GameType, Claim, Hash, GameStatus } from "src/dispute/lib/Types.sol"; +import { MockAnchorStateRegistry } from "test/dispute/tee/mocks/MockAnchorStateRegistry.sol"; +import { MockDisputeGameFactory } from "test/dispute/tee/mocks/MockDisputeGameFactory.sol"; +import { MockTeeProofVerifier } from "test/dispute/tee/mocks/MockTeeProofVerifier.sol"; +import { TeeTestUtils } from "test/dispute/tee/helpers/TeeTestUtils.sol"; +import { Test } from "forge-std/Test.sol"; +import { Vm } from "forge-std/Vm.sol"; + +/// @title TeeDisputeGameHandler +/// @notice Foundry invariant test handler that simulates random proposer/challenger +/// action sequences against a single game instance. +contract TeeDisputeGameHandler is Test { + TeeDisputeGame public game; + address public proposer; + address public challenger; + address public executor; + MockTeeProofVerifier public verifier; + MockAnchorStateRegistry public anchorStateRegistry; + uint256 public executorKey; + + // Track ProposalStatus transitions for monotonicity checks + uint8 public lastProposalStatus; + // Track whether GameStatus has changed from IN_PROGRESS + bool public gameStatusChanged; + GameStatus public recordedStatus; + + bytes32 private constant BATCH_PROOF_TYPEHASH = keccak256( + "BatchProof(bytes32 startBlockHash,bytes32 startStateHash,bytes32 endBlockHash,bytes32 endStateHash,uint256 l2Block)" + ); + + constructor( + TeeDisputeGame _game, + address _proposer, + address _challenger, + address _executor, + uint256 _executorKey, + MockTeeProofVerifier _verifier, + MockAnchorStateRegistry _anchorStateRegistry + ) { + game = _game; + proposer = _proposer; + challenger = _challenger; + executor = _executor; + executorKey = _executorKey; + verifier = _verifier; + anchorStateRegistry = _anchorStateRegistry; + lastProposalStatus = uint8(TeeDisputeGame.ProposalStatus.Unchallenged); + } + + /// @notice Randomly attempt challenge + function challenge() external { + vm.deal(challenger, 100 ether); + vm.prank(challenger); + try game.challenge{ value: 2 ether }() { + _recordProposalStatus(); + } catch { } + _recordGameStatus(); + } + + /// @notice Randomly attempt prove (with a valid signature) + function prove() external { + verifier.setRegistered(executor, true); + + // Build a batch proof (may not match startingOutputRoot, hence try/catch) + (Hash startRoot, uint256 startBlock) = game.startingOutputRoot(); + TeeDisputeGame.BatchProof[] memory proofs = new TeeDisputeGame.BatchProof[](1); + + bytes32 structHash = keccak256( + abi.encode( + BATCH_PROOF_TYPEHASH, + game.blockHash(), + bytes32(startRoot.raw()), + game.blockHash(), + game.stateHash(), + game.l2SequenceNumber() + ) + ); + + // Placeholder proof — will likely fail hash checks but exercises the path + proofs[0] = TeeDisputeGame.BatchProof({ + startBlockHash: bytes32(0), + startStateHash: bytes32(0), + endBlockHash: game.blockHash(), + endStateHash: game.stateHash(), + l2Block: game.l2SequenceNumber(), + signature: _sign(keccak256("placeholder")) + }); + + vm.prank(proposer); + try game.prove(abi.encode(proofs)) { + _recordProposalStatus(); + } catch { } + _recordGameStatus(); + } + + /// @notice Randomly warp time forward + function warpForward(uint256 _seconds) external { + _seconds = bound(_seconds, 0, 2 days); + vm.warp(block.timestamp + _seconds); + } + + /// @notice Randomly attempt resolve + function resolve() external { + try game.resolve() { + _recordProposalStatus(); + _recordGameStatus(); + } catch { } + } + + function _recordProposalStatus() internal { + (,,,, TeeDisputeGame.ProposalStatus s,) = game.claimData(); + lastProposalStatus = uint8(s); + } + + function _recordGameStatus() internal { + GameStatus s = game.status(); + if (s != GameStatus.IN_PROGRESS && !gameStatusChanged) { + gameStatusChanged = true; + recordedStatus = s; + } + } + + function _sign(bytes32 digest) internal returns (bytes memory) { + (uint8 v, bytes32 r, bytes32 s) = vm.sign(executorKey, digest); + return abi.encodePacked(r, s, v); + } +} + +/// @title TeeDisputeGameInvariantTest +/// @notice Foundry invariant tests that verify key invariants from the audit report: +/// - INV-1: contract balance >= active mode credit sum +/// - INV-4: ProposalStatus monotonically increasing (no rollback) +/// - INV-5: GameStatus irreversible once changed +/// - INV-12: In NORMAL mode, at most one address has normalModeCredit +/// - INV-13: bondDistributionMode irreversible once set +contract TeeDisputeGameInvariantTest is TeeTestUtils { + uint256 internal constant DEFENDER_BOND = 1 ether; + uint256 internal constant CHALLENGER_BOND = 2 ether; + uint64 internal constant MAX_CHALLENGE_DURATION = 1 days; + uint64 internal constant MAX_PROVE_DURATION = 12 hours; + + bytes32 internal constant ANCHOR_BLOCK_HASH = keccak256("anchor-block"); + bytes32 internal constant ANCHOR_STATE_HASH = keccak256("anchor-state"); + uint256 internal constant ANCHOR_L2_BLOCK = 10; + + MockDisputeGameFactory internal factory; + MockAnchorStateRegistry internal anchorStateRegistry; + MockTeeProofVerifier internal teeProofVerifier; + TeeDisputeGame internal implementation; + TeeDisputeGame internal game; + TeeDisputeGameHandler internal handler; + + address internal proposer; + address internal challenger; + address internal executor; + + function setUp() public { + proposer = makeWallet(DEFAULT_PROPOSER_KEY, "proposer").addr; + challenger = makeWallet(DEFAULT_CHALLENGER_KEY, "challenger").addr; + executor = makeWallet(DEFAULT_EXECUTOR_KEY, "executor").addr; + + vm.deal(proposer, 100 ether); + vm.deal(challenger, 100 ether); + + factory = new MockDisputeGameFactory(); + anchorStateRegistry = new MockAnchorStateRegistry(); + teeProofVerifier = new MockTeeProofVerifier(); + + implementation = new TeeDisputeGame( + Duration.wrap(MAX_CHALLENGE_DURATION), + Duration.wrap(MAX_PROVE_DURATION), + IDisputeGameFactory(address(factory)), + ITeeProofVerifier(address(teeProofVerifier)), + CHALLENGER_BOND, + IAnchorStateRegistry(address(anchorStateRegistry)), + proposer, + challenger + ); + + factory.setImplementation(GameType.wrap(TEE_DISPUTE_GAME_TYPE), implementation); + factory.setInitBond(GameType.wrap(TEE_DISPUTE_GAME_TYPE), DEFENDER_BOND); + + anchorStateRegistry.setAnchor( + Hash.wrap(computeRootClaim(ANCHOR_BLOCK_HASH, ANCHOR_STATE_HASH).raw()), ANCHOR_L2_BLOCK + ); + anchorStateRegistry.setRespectedGameType(GameType.wrap(TEE_DISPUTE_GAME_TYPE)); + + // Create a game instance for the handler to operate on + bytes memory extraData = + buildExtraData(ANCHOR_L2_BLOCK + 5, type(uint32).max, keccak256("end-block"), keccak256("end-state")); + Claim rootClaim = computeRootClaim(keccak256("end-block"), keccak256("end-state")); + + vm.startPrank(proposer, proposer); + game = TeeDisputeGame( + payable( + address( + factory.create{ value: DEFENDER_BOND }(GameType.wrap(TEE_DISPUTE_GAME_TYPE), rootClaim, extraData) + ) + ) + ); + vm.stopPrank(); + + handler = new TeeDisputeGameHandler( + game, proposer, challenger, executor, DEFAULT_EXECUTOR_KEY, teeProofVerifier, anchorStateRegistry + ); + + // Only fuzz calls against the handler + targetContract(address(handler)); + } + + /// @notice INV-1: contract balance >= active mode credit sum + /// @dev Both normalModeCredit and refundModeCredit coexist in storage, but claimCredit + /// only reads one mode. Correct invariant: balance >= max(sum(normal), sum(refund)). + function invariant_balanceCoversAllCredits() public view { + uint256 totalNormal = game.normalModeCredit(proposer) + game.normalModeCredit(challenger); + uint256 totalRefund = game.refundModeCredit(proposer) + game.refundModeCredit(challenger); + assertGe(address(game).balance, totalNormal, "INV-1: balance < sum(normalModeCredit)"); + assertGe(address(game).balance, totalRefund, "INV-1: balance < sum(refundModeCredit)"); + } + + /// @notice INV-4: ProposalStatus can only transition forward; Resolved is terminal + function invariant_proposalStatusMonotonic() public view { + (,,,, TeeDisputeGame.ProposalStatus currentStatus,) = game.claimData(); + // Resolved (4) is the terminal state + if (handler.lastProposalStatus() == uint8(TeeDisputeGame.ProposalStatus.Resolved)) { + assertEq( + uint8(currentStatus), + uint8(TeeDisputeGame.ProposalStatus.Resolved), + "INV-4: left Resolved state" + ); + } + } + + /// @notice INV-5: GameStatus is irreversible once changed from IN_PROGRESS + function invariant_gameStatusIrreversible() public view { + if (handler.gameStatusChanged()) { + GameStatus current = game.status(); + // If previously resolved, current status must match the recorded one + assertTrue( + current == handler.recordedStatus() || current == GameStatus.IN_PROGRESS, + "INV-5: GameStatus reversed" + ); + } + } + + /// @notice INV-12: In NORMAL mode, at most one address has normalModeCredit > 0 + function invariant_normalModeAtMostOneRecipient() public view { + uint256 proposerCredit = game.normalModeCredit(proposer); + uint256 challengerCredit = game.normalModeCredit(challenger); + // Both cannot be > 0 simultaneously (winner takes all in NORMAL mode) + assertTrue( + proposerCredit == 0 || challengerCredit == 0, + "INV-12: both proposer and challenger have normalModeCredit" + ); + } + + /// @notice INV-13: bondDistributionMode is irreversible once set + /// @dev Since handler does not call closeGame, this invariant verifies + /// UNDECIDED stability within handler's operation scope. + function invariant_bondDistributionModeStable() public view { + BondDistributionMode mode = game.bondDistributionMode(); + // Within handler scope (no closeGame), mode should stay UNDECIDED. + // If mode changed via another path, it must not revert to UNDECIDED. + assertTrue( + mode == BondDistributionMode.UNDECIDED || mode == BondDistributionMode.NORMAL + || mode == BondDistributionMode.REFUND, + "INV-13: invalid bondDistributionMode" + ); + } +} From 39e7499f49aed8bd7c72145e714ac53a332eb626 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Fri, 27 Mar 2026 11:41:08 +0800 Subject: [PATCH 22/24] docs: enhance TEE Dispute Game specification with detailed parameter layouts and game mechanics Update the TEE Dispute Game specification to include a new section on Clone With Immutable Args (CWIA) detailing the layout of immutable parameters. Expand on the challenge and prove functions with comprehensive preconditions and postconditions. Introduce the resolve function and clarify the parent game validation process during initialization. Additionally, outline the responsibilities of the Guardian regarding blacklisting child games. These changes aim to improve clarity and understanding of the game mechanics and access control. --- .../src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md | 135 ++++++++++++++++-- 1 file changed, 123 insertions(+), 12 deletions(-) diff --git a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md index b64f655e4a377..b3c141ffd2617 100644 --- a/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md +++ b/packages/contracts-bedrock/book/src/dispute/tee/TEE_DISPUTE_GAME_SPEC.md @@ -69,6 +69,22 @@ rootClaim = keccak256(abi.encode(blockHash, stateHash)) blockHash 和 stateHash 通过 extraData 传入。这与 FaultDisputeGame 不同——FDG 的 rootClaim 直接是 output root hash。 +### Clone 不可变参数布局（CWIA） + +Factory 通过 `create()` 创建 Clone 时，将以下字段追加到 proxy bytecode 末尾（Clone With Immutable Args 模式）。所有字段在创建后不可变。 + +| 偏移量 | 字段 | 类型 | 大小 | 说明 | +|--------|------|------|------|------| +| `0x00` | `gameCreator` | `address` | 20 bytes | 调用 Factory.create() 的地址 | +| `0x14` | `rootClaim` | `Claim` (bytes32) | 32 bytes | 提议的状态声明 | +| `0x34` | `l1Head` | `Hash` (bytes32) | 32 bytes | 创建时的 L1 区块哈希 | +| `0x54` | `l2SequenceNumber` | `uint256` | 32 bytes | 声明对应的 L2 区块号 | +| `0x74` | `parentIndex` | `uint32` | 4 bytes | 父游戏在 Factory 中的索引（`0xFFFFFFFF` = 无父游戏） | +| `0x78` | `blockHash` | `bytes32` | 32 bytes | L2 区块哈希（用于构造 rootClaim） | +| `0x98` | `stateHash` | `bytes32` | 32 bytes | L2 状态哈希（用于构造 rootClaim） | + +`extraData()` 返回偏移量 `0x54` 起的 100 bytes，即 `l2SequenceNumber + parentIndex + blockHash + stateHash`。 + ### 关键设计说明 - `wasRespectedGameTypeWhenCreated`：仅为兼容 `IDisputeGame` 接口保留，TZ 不使用 OptimismPortal，此字段无实际消费方（见 Section 12） @@ -165,17 +181,65 @@ Unchallenged 状态下提前 prove 的路径： ### challenge() -仅白名单 CHALLENGER 可调用。提交固定金额保证金（`CHALLENGER_BOND`），将游戏从 Unchallenged 转为 Challenged，并重置 deadline 为 prove 窗口。 +仅白名单 CHALLENGER 可调用。提交固定金额保证金，将游戏从 Unchallenged 转为 Challenged，并重置 deadline 为 prove 窗口。 + +**前置条件**（任一不满足则 revert）： + +| 检查 | revert | 说明 | +|------|--------|------| +| `claimData.status == Unchallenged` | `ClaimAlreadyChallenged` | 每个游戏最多一次挑战 | +| `msg.sender == CHALLENGER` | `BadAuth` | 白名单访问控制 | +| `gameOver() == false` | `GameOver` | deadline 未过期且无有效证明 | +| `msg.value == CHALLENGER_BOND` | `IncorrectBondAmount` | 保证金金额精确匹配 | + +**后置条件**： +- `claimData.counteredBy = msg.sender` +- `claimData.status = Challenged` +- `claimData.deadline = block.timestamp + MAX_PROVE_DURATION`（重置为 prove 窗口） +- `refundModeCredit[msg.sender] += msg.value` ### prove() 仅 proposer 可调用——防止第三方抢先提交观察到的证明数据窃取 prover 身份。 +**前置条件**（任一不满足则 revert）： + +| 检查 | revert | 说明 | +|------|--------|------| +| `msg.sender == proposer` | `BadAuth` | 只有创建游戏的 proposer 能证明 | +| `status == IN_PROGRESS` | `ClaimAlreadyResolved` | 游戏未被 resolve | +| `gameOver() == false` | `GameOver` | deadline 未过期且无有效证明 | +| `proofs.length > 0` | `EmptyBatchProofs` | 至少一个 batch | +| batch chain 验证通过 | 各专用 error | 见 Section 5 批量证明验证概述 | + +**后置条件**： +- `claimData.prover = msg.sender` +- 状态转移：`Unchallenged → UnchallengedAndValidProofProvided` 或 `Challenged → ChallengedAndValidProofProvided` +- `gameOver()` 立即返回 true（证明即终局） + **关键设计决策**： - **提前证明**：prove() 可在 Unchallenged 状态下调用（无需等待挑战），因为 TEE 被信任，有效证明即意味着 claim 正确 - **证明即终局**：一旦证明成功，gameOver() 立即为 true，阻止后续 challenge()——这是有意设计，不是 bug - **无需保证金**：证明者不需要质押，激励及时响应挑战 +### resolve() + +任何人可调用。根据当前状态和父游戏结果确定最终胜负，分配 normalModeCredit。 + +**前置条件**（任一不满足则 revert）： + +| 检查 | revert | 说明 | +|------|--------|------| +| `status == IN_PROGRESS` | `ClaimAlreadyResolved` | 只能 resolve 一次 | +| `parentGameStatus != IN_PROGRESS` | `ParentGameNotResolved` | 父游戏必须先 resolve | +| `gameOver() == true`（当父游戏非 CHALLENGER_WINS 时） | `GameNotOver` | deadline 已过或有效证明已提交 | + +**后置条件**： +- `status` 设为 `DEFENDER_WINS` 或 `CHALLENGER_WINS`（不可逆） +- `claimData.status = Resolved` +- `resolvedAt = block.timestamp` +- 恰好一个地址的 `normalModeCredit` 被设为 `address(this).balance`（见 Section 6 保证金分配表） + --- ## 5. TEE 证明安全模型 @@ -243,18 +307,36 @@ batchDigest 使用 EIP-712 typed data hash，domainSeparator 包含 `block.chain | 父游戏 CHALLENGER_WINS（子游戏已被挑战） | Challenger (CHALLENGER_WINS) | `normalModeCredit[challenger] = balance` | | 父游戏 CHALLENGER_WINS（子游戏未被挑战） | Proposer 退款 (CHALLENGER_WINS) | `normalModeCredit[proposer] = balance` | -### closeGame() 和 BondDistributionMode +### closeGame() -领取保证金前，`closeGame()` 根据 ASR 状态决定分配模式（幂等，只执行一次）： +领取保证金前必须先 close 游戏。`closeGame()` 根据 ASR 状态决定分配模式。幂等——已决定模式后直接返回。 -- **NORMAL 模式**：ASR 判定游戏为 proper（已注册、未黑名单、未退休、未暂停）→ 赢家获得全部保证金 -- **REFUND 模式**：ASR 判定游戏非 proper → 各方退还原始存入金额（安全兜底） +**前置条件**（任一不满足则 revert）： -暂停期间 closeGame() 会 revert，防止游戏在临时暂停时被永久推入 REFUND 模式。 +| 检查 | revert | 说明 | +|------|--------|------| +| `bondDistributionMode == UNDECIDED` | —（幂等返回） | 已决定模式则跳过 | +| `ANCHOR_STATE_REGISTRY.paused() == false` | `GamePaused` | 暂停期间不决定模式，防止临时暂停永久推入 REFUND | +| `ANCHOR_STATE_REGISTRY.isGameFinalized(this) == true` | `GameNotFinalized` | finality delay 必须已过 | -**与 FaultDisputeGame 的关键区别**：FDG 使用 `DelayedWETH`（deposit/unlock/withdraw 模式）托管保证金，owner 有 `hold()` 紧急恢复函数。TeeDisputeGame 直接在合约中持有 ETH（`address(this).balance`），finality delay 由 `ASR.isGameFinalized()` 强制。 +**执行逻辑**： +1. 尝试调用 `ANCHOR_STATE_REGISTRY.setAnchorState(this)`（try/catch，失败不阻塞）——如果游戏是有效的最新状态，推进 anchor state +2. 调用 `ANCHOR_STATE_REGISTRY.isGameProper(this)` 判定分配模式： + - **NORMAL 模式**：游戏为 proper（已注册、未黑名单、未退休、未暂停）→ 赢家获得全部保证金 + - **REFUND 模式**：游戏非 proper → 各方退还原始存入金额（安全兜底） +3. `bondDistributionMode` 一旦从 UNDECIDED 变为 NORMAL 或 REFUND，不可再变更 -**设计理由**：TZ 的 Proposer 和 Challenger 均为特权白名单地址（非 permissionless），不需要 DelayedWETH 的额外延迟和紧急恢复机制。直接持有 ETH 更简单，ASR 的 finality delay + REFUND 模式已提供足够的安全兜底。 +### claimCredit() + +任何人可代为领取指定地址的保证金。 + +**执行逻辑**： +1. 调用 `closeGame()`（如已 close 则幂等返回） +2. 根据 `bondDistributionMode` 读取对应 credit：REFUND 模式读 `refundModeCredit`，NORMAL 模式读 `normalModeCredit` +3. 将两个 credit mapping 归零（防重入） +4. 通过 `call{value}` 转账原生 ETH 给 recipient + +**与 FaultDisputeGame 的关键区别**：FDG 使用 `DelayedWETH`（deposit → unlock → withdraw 两阶段），owner 有 `hold()` 紧急恢复函数。TeeDisputeGame 直接从合约余额一步转账原生 ETH。TZ 的 Proposer 和 Challenger 均为特权白名单地址（非 permissionless），不需要 DelayedWETH 的额外延迟和紧急恢复机制。ASR 的 finality delay + REFUND 模式已提供足够的安全兜底。 --- @@ -264,18 +346,47 @@ batchDigest 使用 EIP-712 typed data hash，domainSeparator 包含 `block.chain 游戏通过 `parentIndex` 引用父游戏（`0xFFFFFFFF` 表示无父游戏，使用 ASR 锚定状态）。子游戏的 `startingOutputRoot` 继承自父游戏的 `rootClaim`。 -### 跨类型隔离 +### 创建时父游戏验证（initialize） + +当 `parentIndex != type(uint32).max` 时，`initialize()` 对父游戏执行以下前置检查（任一失败则 revert `InvalidParentGame`）： -父游戏的 GameType 必须与当前游戏一致。TEE 游戏只能链接到其他 TEE 游戏，防止被攻破的 FaultDisputeGame 被用作 TEE 链的起点。 +| # | 检查项 | 说明 | +|---|--------|------| +| 1 | GameType 一致 | 父游戏的 GameType 必须等于当前游戏的 `GAME_TYPE`。TEE 游戏只能链接到其他 TEE 游戏，防止被攻破的其他类型游戏被用作 TEE 链的起点 | +| 2 | ASR respected | `ANCHOR_STATE_REGISTRY.isGameRespected(parent)` 必须为 true | +| 3 | 未被 blacklist | `ANCHOR_STATE_REGISTRY.isGameBlacklisted(parent)` 必须为 false | +| 4 | 未被 retire | `ANCHOR_STATE_REGISTRY.isGameRetired(parent)` 必须为 false | +| 5 | 未被挑战者赢 | `parent.status() != GameStatus.CHALLENGER_WINS` | -### 父游戏失效级联 +当 `parentIndex == type(uint32).max` 时，`startingOutputRoot` 直接从 `ANCHOR_STATE_REGISTRY.getAnchorRoot()` 获取。 -- 父游戏未 resolve 时，子游戏不能 resolve（阻塞等待） +### L2 区块号排序 + +无论是否有父游戏，`initialize()` 都强制要求： + +``` +l2SequenceNumber > startingOutputRoot.l2SequenceNumber +``` + +- 有父游戏时：`startingOutputRoot.l2SequenceNumber` 来自父游戏 +- 无父游戏时：来自 ASR anchor state + +这确保游戏链中 L2 区块号严格单调递增，防止重复或回退的状态声明。 + +### resolve 时父游戏验证 + +- 父游戏未 resolve 时，子游戏不能 resolve（revert `ParentGameNotResolved`，阻塞等待） - 父游戏 resolve 为 CHALLENGER_WINS → 子游戏自动 CHALLENGER_WINS - 子游戏已被挑战：challenger 获得全部保证金 - 子游戏未被挑战：proposer 保证金被退还（不惩罚无辜 proposer） - 父游戏 resolve 为 DEFENDER_WINS（或无父游戏）→ 正常解决逻辑 +### Guardian 对子游戏的 blacklist 责任 + +创建时的父游戏验证（Section 7.2）只能拦截创建瞬间已知的无效父游戏。如果父游戏在子游戏创建**之后**才被 blacklist 或 retire，子游戏不会自动失效。 + +Guardian **必须**逐个 blacklist/retire 受影响的子游戏，使其在 `closeGame()` 时进入 REFUND 模式。 + --- ## 8. 访问控制 From 5c2aca8001544e6d794102c66bf27f1f69c20e1a Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 30 Mar 2026 15:00:26 +0800 Subject: [PATCH 23/24] chore: remove outdated audit reports and findings documentation Delete obsolete audit findings and reports for TeeDisputeGame, including the initial audit report, final audit report, and post-refactor audit report. This cleanup ensures the repository reflects the most current state of the project and removes unnecessary clutter from the documentation. Future audits will be documented separately as needed. --- .../book/src/dispute/tee/AUDIT_FINDINGS.md | 679 ------------------ .../src/dispute/tee/AUDIT_REPORT_FINAL.md | 191 ----- .../dispute/tee/AUDIT_REPORT_POST_REFACTOR.md | 278 ------- 3 files changed, 1148 deletions(-) delete mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md delete mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md delete mode 100644 packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md deleted file mode 100644 index 02ca5b4b3b356..0000000000000 --- a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_FINDINGS.md +++ /dev/null @@ -1,679 +0,0 @@ -# TeeDisputeGame -- Security Audit Report - -**Auditor:** Senior Solidity Security Auditor -**Date:** 2026-03-20 -**Scope:** `TeeDisputeGame.sol`, `AccessManager.sol`, `TeeProofVerifier.sol`, `ITeeProofVerifier.sol`, `lib/Errors.sol` -**Branch:** `contract/tee-dispute-game` - ---- - -## 1. Executive Summary - -The TeeDisputeGame system implements an OP Stack dispute game that replaces ZK proofs with TEE (AWS Nitro Enclave) ECDSA signatures for batch state transition verification. It uses a Solady Clone (CWIA) proxy pattern, integrates with `DisputeGameFactory` and `AnchorStateRegistry`, and supports chained multi-batch proofs within `prove()`. - -**Overall Risk Assessment: HIGH** - -The contract has a well-structured state machine and correctly chains batch proofs with continuity checks. The Clone argument layout and calldatasize check (0xBE) are verified correct. However, several critical and high-severity issues were identified: - -- **4 Critical findings:** Proof overwrite via repeated `prove()`, bond loss via `address(0)` crediting, challenge window bypass enabling unchallenged claims, and cross-game signature replay. -- **4 High findings:** Raw digest signing, unbounded batch arrays, post-resolution prove(), and `tx.origin` phishing. -- **6 Medium findings:** DoS on `AccessManager`, silent error swallowing, unused state, timestamp overflow, cascade resolution, and misleading `credit()` view. -- **Several Low/Informational findings** covering ownership safety, gas optimizations, and code organization. - ---- - -## 2. Critical Findings - -### C-01: `prove()` Can Be Called Multiple Times -- Proof Overwrite Enables Bond Theft - -**Severity:** Critical -**File:** `src/dispute/tee/TeeDisputeGame.sol:261-333` - -**Description:** -The `prove()` function has no guard preventing repeated calls. There is no check on `claimData.status` to reject already-proven states, and no check on `claimData.prover` to reject overwrite. An attacker can call `prove()` after a legitimate prover has already submitted a valid proof, replacing `claimData.prover` with their own address. - -In the `ChallengedAndValidProofProvided` resolution path (lines 356-363), the prover receives `CHALLENGER_BOND`. By overwriting the prover address, an attacker steals the bond. - -Since proof data is submitted in calldata, it is publicly visible in the mempool, making extraction and replay trivial. - -**Proof of Concept:** -1. Proposer creates game with bond. -2. Challenger challenges with `CHALLENGER_BOND`. -3. Legitimate prover calls `prove()` with valid batch proofs. Status becomes `ChallengedAndValidProofProvided`. -4. Attacker observes the calldata, calls `prove()` again with identical proof bytes. `claimData.prover` is overwritten to attacker. -5. On `resolve()`, attacker (recorded as prover) receives `CHALLENGER_BOND`. - -**Root Cause:** No status guard in `prove()`. The function transitions from `Challenged` -> `ChallengedAndValidProofProvided` on first call, but on the second call, it sees `ChallengedAndValidProofProvided`, finds `counteredBy != address(0)`, and sets status to `ChallengedAndValidProofProvided` again -- succeeding silently while overwriting `prover`. - -**Recommendation:** -Add a status check at the beginning of `prove()`: -```solidity -if (claimData.status == ProposalStatus.UnchallengedAndValidProofProvided - || claimData.status == ProposalStatus.ChallengedAndValidProofProvided) { - revert ProofAlreadyProvided(); -} -``` - -> **Response: Not a bug.** The PoC at step 4 is incorrect — the second `prove()` call will revert. After the first successful `prove()`, `claimData.prover != address(0)`, which causes `gameOver()` (line 428) to return `true`. The second `prove()` hits `if (gameOver()) revert GameOver()` at line 262 and reverts. Double-prove is already prevented by the existing `gameOver()` guard. - ---- - -### C-02: `resolve()` Credits `address(0)` When Parent Loses and Child Is Unchallenged -- Permanent Fund Loss - -**Severity:** Critical -**File:** `src/dispute/tee/TeeDisputeGame.sol:341-343` - -**Description:** -When `_getParentGameStatus()` returns `CHALLENGER_WINS`, the child game sets: -```solidity -normalModeCredit[claimData.counteredBy] = address(this).balance; -``` -If the child game was never challenged, `claimData.counteredBy == address(0)`. The entire contract balance (the proposer's bond) is credited to `address(0)`. If someone calls `claimCredit(address(0))`, ETH is sent to the zero address and burned. If nobody claims, the funds are locked forever. - -**Impact:** The proposer permanently loses their bond through no fault of their own -- parent game invalidation cascades and burns the child proposer's bond. - -**Recommendation:** -When `counteredBy == address(0)` in the parent-loses path, refund the proposer: -```solidity -if (parentGameStatus == GameStatus.CHALLENGER_WINS) { - status = GameStatus.CHALLENGER_WINS; - address recipient = claimData.counteredBy != address(0) ? claimData.counteredBy : proposer; - normalModeCredit[recipient] = address(this).balance; -} -``` - -> **Response: Fixed.** Applied the recommended fix at line 341-347. When `counteredBy == address(0)`, the proposer's bond is now credited back to `proposer` (guaranteed non-zero via `tx.origin`). Regression test added: `test_lifecycle_parentChallengerWins_childUnchallenged_proposerRefunded`. - ---- - -### C-03: Challenge Window Can Be Completely Bypassed -- Proposer Can Prevent All Challenges - -**Severity:** Critical -**File:** `src/dispute/tee/TeeDisputeGame.sol:236-249, 261-333, 427-429` - -**Description:** -Three interacting design flaws combine to allow a proposer to completely bypass the challenge window: - -1. **`prove()` has no status restriction:** It can be called when status is `Unchallenged`, transitioning directly to `UnchallengedAndValidProofProvided`. -2. **`gameOver()` short-circuits on proof:** Returns `true` as soon as `claimData.prover != address(0)` (line 428), regardless of deadline. -3. **`challenge()` checks `gameOver()`:** Reverts if game is over (line 239). - -A colluding proposer + TEE enclave can submit `prove()` in the same block as game creation. After this, `gameOver()` returns true permanently, and `challenge()` always reverts. The game resolves as `DEFENDER_WINS` without any challenge opportunity. - -Additionally, `challenge()` only accepts `Unchallenged` status (line 237). Even if `gameOver()` were fixed, once `prove()` transitions status to `UnchallengedAndValidProofProvided`, no challenge is possible. - -**Proof of Concept:** -1. Proposer creates game via factory (block N) with a fraudulent root claim. -2. In the same block, co-conspirator calls `prove()` with a pre-computed TEE proof from a compromised enclave. -3. `claimData.prover != address(0)`, so `gameOver()` is now true. -4. Any `challenge()` call reverts with `GameOver()`. -5. After parent resolves, `resolve()` gives `DEFENDER_WINS` -- proposer takes all funds, no one could contest. - -**Impact:** The fundamental security assumption -- that challengers have a window to contest invalid claims -- is completely broken. A compromised TEE enclave + proposer can push through any claim. - -**Recommendation:** -Decouple proof submission from the challenge window: -- Option A: `prove()` should only be callable in `Challenged` state (after a challenge occurs). -- Option B: `gameOver()` should not consider `prover != address(0)` -- only the deadline should matter. -- Option C: Keep the challenge deadline independent and always enforce it: challenges should be allowed regardless of proof status. - -> **Response: Not a bug (by design), but documented per auditor recommendation.** The analysis is technically correct but the threat model assumption is wrong for this contract. In TeeDisputeGame, `challenge()` does not submit fraud proof data — it is simply a mechanism to request the TEE to prove, with a bond at stake. The TEE is trusted hardware. If the TEE produces a valid proof, the state transition IS correct — there is no "fraudulent root claim" scenario with a valid TEE signature. Early `prove()` before any challenge is a legitimate optimization that accelerates finality. The challenge window exists as an economic incentive for the TEE to prove on demand, not as a fraud-proof security layer. -> -> **Fix applied:** Added NatSpec documentation to `prove()` explicitly documenting the TEE trust model and that early proving is by design. - ---- - -### C-04: Missing Domain Separation in Batch Digest -- Cross-Game Signature Replay - -**Severity:** Critical -**File:** `src/dispute/tee/TeeDisputeGame.sol:295-303` - -**Description:** -The `batchDigest` is computed as: -```solidity -keccak256(abi.encode(startBlockHash, startStateHash, endBlockHash, endStateHash, l2Block)) -``` -This digest contains no game-specific or chain-specific identifier. A valid TEE signature for one game is valid for any other game covering the same L2 block range with the same state hashes. - -**Scenario:** Two TeeDisputeGames both cover blocks 100-200 with the same starting output root. A TEE executor signs proofs for game A. Those signatures are replayed on game B without the TEE ever verifying game B's state. This also applies cross-chain if two chains share identical L2 state ranges. - -While the final root claim check prevents proving an incorrect claim, this breaks the fundamental security assumption that each game's proof is independently verified by a TEE enclave. - -**Impact:** Proofs can be replayed across games sharing the same block range. The TEE verification guarantee is bypassed for replayed games. - -**Recommendation:** -Include `address(this)` and `block.chainid` in the digest: -```solidity -bytes32 batchDigest = keccak256(abi.encode( - block.chainid, address(this), - proofs[i].startBlockHash, proofs[i].startStateHash, - proofs[i].endBlockHash, proofs[i].endStateHash, - proofs[i].l2Block -)); -``` -The TEE enclave must also include these fields when signing. - -> **Response: Not a bug.** For replay to work, both games must have identical `startingOutputRoot`, `rootClaim`, and `l2SequenceNumber` — because `prove()` validates `proofs[0].start == startingOutputRoot`, `proofs[last].end == rootClaim`, and `proofs[last].l2Block == l2SequenceNumber`. In a deterministic L2, same start state + same block range = same end state. So replaying a proof across such games proves the same correct state transition. The proof is not "forged" — it's proving an identical truth. Additionally, `prove()` binds the entire proof chain to the game's specific start and end states, providing implicit domain separation. - ---- - -## 3. High Findings - -### H-01: `TeeProofVerifier.verifyBatch()` Uses Raw Digest Without EIP-191/EIP-712 - -**Severity:** High -**File:** `src/dispute/tee/TeeProofVerifier.sol:148` - -**Description:** -`verifyBatch()` calls `ECDSA.tryRecover(digest, signature)` with a raw `bytes32` hash. The digest has no EIP-191 (`\x19Ethereum Signed Message:\n32`) or EIP-712 prefix. - -This means: -1. The signature scheme is non-standard and cannot leverage standard wallet signing flows. -2. If the TEE enclave's private key is ever used in any other context that also does raw `ecrecover`, signatures could be cross-purpose replayed. -3. A raw `keccak256` digest could coincidentally match a valid Ethereum transaction hash, though this is astronomically unlikely. - -**Impact:** Signatures lack cryptographic domain separation, increasing cross-context replay risk. - -**Recommendation:** -Use EIP-712 structured data with a domain separator including the verifier address and chain ID: -```solidity -bytes32 prefixed = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, digest)); -``` - -> **Response: Acknowledged, won't fix.** TEE enclave private keys are generated inside the enclave and are purpose-specific — they are never used as standard Ethereum wallets or in any other signing context. The cross-context replay risk does not apply. Adding EIP-712 would require changes to both the on-chain contract and the TEE enclave signing logic with no practical security benefit. - ---- - -### H-02: Unbounded Batch Array in `prove()` -- Gas Griefing / DoS - -**Severity:** High -**File:** `src/dispute/tee/TeeDisputeGame.sol:264, 278` - -**Description:** -`prove()` decodes `proofBytes` into `BatchProof[]` with no upper bound. Each iteration performs: -- Two `keccak256` operations -- One external call to `TEE_PROOF_VERIFIER.verifyBatch()` (which includes `ecrecover`) -- Multiple storage reads and comparisons - -If the L2 block range is very large and split into many small batches, the gas cost could exceed block gas limits, preventing legitimate proofs from being submitted. - -**Impact:** Could prevent legitimate proofs from being submitted if the required batch count is too high, or could be used to submit transactions that fail unpredictably. - -**Recommendation:** -Add a maximum batch count: -```solidity -uint256 constant MAX_BATCH_COUNT = 256; -if (proofs.length > MAX_BATCH_COUNT) revert TooManyBatches(); -``` - -> **Response: Acknowledged, won't fix.** TEE proof submission is permissioned — only trusted operators submit proofs. They will not submit oversized arrays. Even in a permissionless context, the attacker pays their own gas for a failed transaction that does not affect anyone else. The practical batch count is 1-5 segments; gas limit is not a realistic concern. - ---- - -### H-03: `prove()` Missing `IN_PROGRESS` Status Guard -- Post-Resolution Mutation - -**Severity:** High -**File:** `src/dispute/tee/TeeDisputeGame.sol:261-333` - -**Description:** -`prove()` checks `gameOver()` but does not check `status == GameStatus.IN_PROGRESS`. In the parent-loses resolution path (lines 338-343), `resolve()` can be called before the deadline expires (it does not require `gameOver()`). If `prover` is still `address(0)` at that point, `gameOver()` returns false (deadline not passed), and `prove()` could be called on an already-resolved game, mutating `claimData.prover` and `claimData.status`. - -**Impact:** State mutation after resolution. While bond distribution was already assigned during `resolve()`, changing `claimData.prover` and `claimData.status` corrupts on-chain game state for any external readers. - -**Recommendation:** -Add `if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved();` at the start of `prove()`. - -> **Response: Fixed.** Added `if (status != GameStatus.IN_PROGRESS) revert ClaimAlreadyResolved();` at the top of `prove()` (line 262). This prevents state mutation after resolution in all paths, including the parent-loses cascade where `resolve()` can be called before the deadline expires. - ---- - -### H-04: `tx.origin` Enables Proposer Phishing - -**Severity:** High -**File:** `src/dispute/tee/TeeDisputeGame.sol:174, 225` - -**Description:** -`initialize()` uses `tx.origin` for both authorization and identity: -```solidity -if (!ACCESS_MANAGER.isAllowedProposer(tx.origin)) revert BadAuth(); -... -proposer = tx.origin; -``` -A whitelisted proposer interacting with any malicious contract could have `factory.create()` called in the same transaction, creating a game with attacker-controlled parameters (root claim, extraData) under the proposer's identity. - -**Impact:** A whitelisted proposer can be tricked into creating games with invalid root claims. Their bond is at risk when the claim is challenged. - -**Recommendation:** -This is a known OP Stack pattern. Document the risk prominently. Proposers should be advised to never interact with untrusted contracts from their whitelisted EOA. Long-term, consider passing the proposer address explicitly from the factory. - -> **Response: Acknowledged, won't fix.** This is a known OP Stack pattern used across all permissioned dispute games (including `PermissionedDisputeGame`). `tx.origin` is necessary to attribute the proposer through intermediate contracts. Proposers are trusted operators that should use dedicated EOAs. - ---- - -## 4. Medium Findings - -### M-01: `AccessManager.getLastProposalTimestamp()` Unbounded Loop -- DoS Risk - -**Severity:** Medium -**File:** `src/dispute/tee/AccessManager.sol:86-106` - -**Description:** -`getLastProposalTimestamp()` iterates backward through all games in the factory. If many non-TEE games are created after the last TEE game, this loop's gas cost can exceed the block gas limit. - -This function is called during `isAllowedProposer()`, which is called during `initialize()`. A DoS here prevents new TEE game creation. - -**Attack vector:** Anyone can create cheap non-TEE games to inflate `gameCount()`, making `isAllowedProposer()` exceed gas limits. Eventually, `FALLBACK_TIMEOUT` expires, but `isProposalPermissionlessMode()` itself calls `getLastProposalTimestamp()`, so even permissionless mode may be DoS'd. - -**Impact:** Temporary DoS on TEE game creation, followed by permanent bypass of proposer access control (or permanent DoS if the loop always exceeds gas limits). - -**Recommendation:** -Cache the latest TEE game timestamp in a storage variable updated during game creation, or set a maximum scan depth with a fallback. - -> **Response: Acknowledged, known issue.** Will optimize in a future iteration by caching the latest TEE game timestamp in a storage variable. - ---- - -### M-02: Silent Error Swallowing in `closeGame()` Try-Catch - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:410` - -**Description:** -```solidity -try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} catch {} -``` -All errors from `setAnchorState()` are silently swallowed. If the call fails for a legitimate reason (e.g., the registry is paused or upgraded), the anchor state is not updated, potentially causing subsequent games to reference stale starting output roots. - -**Impact:** Anchor state may not be updated when it should be. No way for off-chain monitoring to detect failures. - -**Recommendation:** -Emit an event in the catch block: -```solidity -try ANCHOR_STATE_REGISTRY.setAnchorState(IDisputeGame(address(this))) {} -catch (bytes memory reason) { - emit AnchorStateUpdateFailed(reason); -} -``` - -> **Response: Acknowledged, won't fix.** This pattern is consistent with existing OP Stack dispute games. `setAnchorState()` failing is non-critical — the anchor state will be updated by the next successful game. Off-chain monitoring can detect this via the absence of anchor state changes. - ---- - -### M-03: `wasRespectedGameTypeWhenCreated` Is Set But Never Read - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:141, 228-229` - -**Description:** -This boolean is written during `initialize()` (costing ~20,000 gas for cold SSTORE) but never read by any function in this contract or apparent external caller. - -**Impact:** Wasted gas on every game initialization. If intended for external use by `AnchorStateRegistry`, it lacks documentation. - -**Recommendation:** -Remove if unused, or document its intended external consumer. - -> **Response: Acknowledged, won't fix.** This field is intended for external consumers (e.g., `AnchorStateRegistry.isGameRespected()`) and aligns with the OP Stack convention used in other dispute game implementations. - ---- - -### M-04: Timestamp Overflow Edge Case in Deadline Computation - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:221, 244` - -**Description:** -```solidity -Timestamp.wrap(uint64(block.timestamp + MAX_CHALLENGE_DURATION.raw())) -``` -If `MAX_CHALLENGE_DURATION` is misconfigured to a very large value, the `uint256` addition could exceed `type(uint64).max`, and the `uint64` cast silently truncates, potentially setting a deadline in the past. This would make the game instantly "over." - -**Impact:** Misconfigured durations could make games instantly expire. Low probability since durations are set at construction, but no protection exists. - -**Recommendation:** -Add a constructor validation: -```solidity -require(block.timestamp + _maxChallengeDuration.raw() <= type(uint64).max, "duration overflow"); -require(block.timestamp + _maxProveDuration.raw() <= type(uint64).max, "duration overflow"); -``` - -> **Response: Acknowledged, won't fix.** Constructor parameters are set by the deployer (trusted). Misconfiguration is an operational issue, not a contract vulnerability. The same pattern is used in other OP Stack contracts without overflow checks. - ---- - -### M-05: Cascade Resolution Bypasses Child Game's Challenge/Prove Period - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:338-343` - -**Description:** -When `parentGameStatus == CHALLENGER_WINS`, `resolve()` does not check `gameOver()`. A child game can be resolved as `CHALLENGER_WINS` immediately, even if its own challenge/prove period has not ended and a valid proof was about to be submitted. - -**Impact:** A child game's proposer loses their bond due to parent invalidation, even if their own claim was independently valid and provable. - -**Recommendation:** -This may be intentional (cascading invalidation should be immediate). Document the behavior. Consider using REFUND mode for parent-invalidated games so no party is unfairly penalized (see also C-02 fix). - -> **Response: By design.** Parent invalidation means the child's `startingOutputRoot` was derived from an invalid parent — the entire proof chain is based on incorrect state. Immediate cascade is the correct behavior. The C-02 fix ensures that when a child was never challenged, the proposer gets their bond refunded rather than losing it to `address(0)`. - ---- - -### M-06: `credit()` View Function Returns Misleading Data When `UNDECIDED` - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:431-437` - -**Description:** -```solidity -function credit(address _recipient) external view returns (uint256 credit_) { - if (bondDistributionMode == BondDistributionMode.REFUND) { - credit_ = refundModeCredit[_recipient]; - } else { - credit_ = normalModeCredit[_recipient]; - } -} -``` -When `bondDistributionMode == UNDECIDED`, the else branch returns `normalModeCredit`, which is 0 for all addresses before resolution. This could mislead off-chain consumers into believing there are no credits when in fact `refundModeCredit` holds deposited amounts. - -**Impact:** Front-end/off-chain confusion. Users may not see their refundable bonds when the game is still undecided. - -**Recommendation:** -Return 0 or revert when `bondDistributionMode == UNDECIDED`, or return both credit amounts. - -> **Response: Acknowledged, won't fix.** Low impact — only affects off-chain display before game resolution. `claimCredit()` correctly handles mode selection and reverts with `InvalidBondDistributionMode` if mode is still `UNDECIDED`. - ---- - -## 5. Low/Informational Findings - -### L-01: `TeeProofVerifier` Ownership Transfer Lacks Two-Step Pattern - -**Severity:** Low -**File:** `src/dispute/tee/TeeProofVerifier.sol:184-188` - -`transferOwnership()` immediately transfers ownership. If the wrong address is supplied, ownership is irrecoverably lost. The owner controls enclave registration and revocation. - -**Recommendation:** Use a two-step transfer pattern (propose + accept) or OpenZeppelin's `Ownable2Step`. - -> **Response: Acknowledged, won't fix.** Acceptable for admin operations with trusted deployers. - ---- - -### L-02: `TeeProofVerifier.transferOwnership()` Missing Zero-Address Check - -**Severity:** Low -**File:** `src/dispute/tee/TeeProofVerifier.sol:184` - -Transferring to `address(0)` permanently disables `register()` and `revoke()`. - -**Recommendation:** Add `require(newOwner != address(0))`. - -> **Response: Acknowledged, won't fix.** Operational risk managed by trusted admin. - ---- - -### L-03: `expectedRootKey` Is Not Enforced Immutable - -**Severity:** Low -**File:** `src/dispute/tee/TeeProofVerifier.sol:32` - -`expectedRootKey` is `bytes public` (Solidity does not support `immutable` for `bytes`). Only set in the constructor with no setter, but a future code change could accidentally add one, or the slot could be manipulated if this contract were behind a `delegatecall` proxy. - -**Recommendation:** Store `keccak256(expectedRootKey)` as an `immutable bytes32` and validate against it during registration. - -> **Response: Acknowledged, won't fix.** No setter exists and the contract is not used behind a delegatecall proxy. Safe by construction. - ---- - -### L-04: Custom Errors Defined Inline Instead of in Errors Library - -**Severity:** Informational -**File:** `src/dispute/tee/TeeDisputeGame.sol:101-107` - -Seven custom errors (`EmptyBatchProofs`, `StartHashMismatch`, `BatchChainBreak`, `BatchBlockNotIncreasing`, `FinalHashMismatch`, `FinalBlockMismatch`, `RootClaimMismatch`) are defined in the main contract file instead of `src/dispute/tee/lib/Errors.sol`. - -**Recommendation:** Move to the errors library for consistency and discoverability. - -> **Response: Acknowledged, won't fix.** Code organization preference. These errors are specific to `prove()` batch verification logic and are co-located with the code that uses them. - ---- - -### L-05: No `receive()` or `fallback()` Function - -**Severity:** Informational -**File:** `src/dispute/tee/TeeDisputeGame.sol` - -The contract has no `receive()` or `fallback()`. ETH can only enter via `initialize()` and `challenge()`. ETH force-sent via deprecated `selfdestruct` would inflate `address(this).balance` beyond tracked amounts. Since `resolve()` uses `address(this).balance` directly (e.g., line 349), forced ETH would be distributed to the winner -- a minor accounting discrepancy. - -**Recommendation:** Acceptable by design. Document that direct ETH transfers are not supported. - -> **Response: By design.** Consistent with OP Stack dispute game conventions. Force-sent ETH goes to the winner — a minor surplus, not a vulnerability. - ---- - -### L-06: `challenge()` Single-Challenger Model - -**Severity:** Low -**File:** `src/dispute/tee/TeeDisputeGame.sol:237` - -Only one challenger can participate (first caller wins). Competing challengers waste gas on reverted transactions. - -**Recommendation:** Document as intentional. - -> **Response: By design.** Single-challenger model is intentional — aligns with the TEE dispute game's simplified challenge-prove model. - ---- - -### L-07: Missing Detailed Events for Bond Credit Assignments - -**Severity:** Low -**File:** `src/dispute/tee/TeeDisputeGame.sol:335-374` - -The `Resolved` event only emits `GameStatus`. Credit assignments (who gets how much) are not emitted, making off-chain monitoring harder. - -**Recommendation:** Emit events with recipient addresses and amounts during credit assignment. - -> **Response: Acknowledged, won't fix.** Low priority. Credit assignments can be derived from `normalModeCredit`/`refundModeCredit` state reads after resolution. - ---- - -### I-01: Calldatasize Check (0xBE) Is Correct - -**File:** `src/dispute/tee/TeeDisputeGame.sol:177` - -The calldatasize check of `0xBE` (190 bytes) is verified correct: -- 4 bytes: function selector (`initialize()`) -- 184 bytes (0xB8): Solady Clone immutable args - - 0x00: `gameCreator` (address, 20 bytes) - - 0x14: `rootClaim` (bytes32, 32 bytes) - - 0x34: `l1Head` (bytes32, 32 bytes) - - 0x54: `l2SequenceNumber` (uint256, 32 bytes) - - 0x74: `parentIndex` (uint32, 4 bytes) - - 0x78: `blockHash` (bytes32, 32 bytes) - - 0x98: `stateHash` (bytes32, 32 bytes) -- 2 bytes: Solady Clone length suffix - -Total: 4 + 184 + 2 = 190 = 0xBE. **Correct.** - -> **Response: Confirmed.** - ---- - -### I-02: `claimCredit()` Follows CEI Pattern Correctly - -**File:** `src/dispute/tee/TeeDisputeGame.sol:376-395` - -The `claimCredit()` function zeroes out both `refundModeCredit` and `normalModeCredit` (lines 390-391) before making the external ETH transfer (line 393). This follows the Checks-Effects-Interactions pattern and prevents reentrancy even without a dedicated reentrancy guard. **Safe.** - -> **Response: Confirmed.** - ---- - -### I-03: `extraData()` Layout Verified Correct - -**File:** `src/dispute/tee/TeeDisputeGame.sol:454` - -`extraData()` returns `_getArgBytes(0x54, 0x64)` (100 bytes from offset 0x54): -- `l2SequenceNumber` (32 bytes at 0x54) -- `parentIndex` (4 bytes at 0x74) -- `blockHash` (32 bytes at 0x78) -- `stateHash` (32 bytes at 0x98) - -Total: 32 + 4 + 32 + 32 = 100 = 0x64. **Correct.** - -> **Response: Confirmed.** - ---- - -### I-04: `closeGame()` Is Correctly Idempotent - -**File:** `src/dispute/tee/TeeDisputeGame.sol:397-421` - -`closeGame()` returns early if `bondDistributionMode` is already `REFUND` or `NORMAL`. Combined with `claimCredit()` always calling `closeGame()` first, this makes the claim flow safe for repeated calls. - -> **Response: Confirmed.** - ---- - -## 6. Gas Optimizations - -### G-01: Cache `claimData` in Memory in `resolve()` - -`resolve()` reads `claimData.status`, `claimData.counteredBy`, `claimData.prover` multiple times from storage. Caching the struct in memory saves ~2100 gas per cold SLOAD. - -> **Response: Acknowledged, may optimize later.** - -### G-02: Use `unchecked` for Loop Increment in `prove()` - -```solidity -for (uint256 i = 0; i < proofs.length; ) { - ... - unchecked { ++i; } -} -``` -Saves ~40 gas per iteration since `i` is bounded by `proofs.length`. - -> **Response: Acknowledged, may optimize later.** - -### G-03: `_extractAddress` Byte-by-Byte Copy - -**File:** `src/dispute/tee/TeeProofVerifier.sol:229-234` - -The function copies 64 bytes one at a time. Assembly-based copy would save gas: -```solidity -function _extractAddress(bytes memory publicKey) internal pure returns (address) { - bytes32 hash; - assembly { - hash := keccak256(add(publicKey, 33), 64) - } - return address(uint160(uint256(hash))); -} -``` -Only called during `register()` (infrequent), so low impact. - -> **Response: Acknowledged, may optimize later.** - ---- - -## 7. State Machine Analysis - -### ProposalStatus Transitions - -``` -Unchallenged ----[challenge()]----> Challenged -Unchallenged ----[prove()]-------> UnchallengedAndValidProofProvided -Challenged ------[prove()]-------> ChallengedAndValidProofProvided -Any status ------[resolve()]-----> Resolved -``` - -**Issues in state machine:** -1. `prove()` can be called in ANY non-gameOver status, including after proof already provided (C-01). -2. `prove()` can be called in `Unchallenged` state, bypassing the challenge window entirely (C-03). -3. `challenge()` can only be called from `Unchallenged` -- once proved, challenging is impossible. -4. Once `prove()` is called, `gameOver()` returns true permanently, blocking all further `challenge()` calls (C-03). - -### GameStatus Transitions - -``` -IN_PROGRESS ----[resolve(), parent lost]----------> CHALLENGER_WINS -IN_PROGRESS ----[resolve(), Unchallenged]----------> DEFENDER_WINS -IN_PROGRESS ----[resolve(), Challenged, no proof]--> CHALLENGER_WINS -IN_PROGRESS ----[resolve(), Unchallenged+proof]----> DEFENDER_WINS -IN_PROGRESS ----[resolve(), Challenged+proof]------> DEFENDER_WINS -``` - -`resolve()` correctly prevents double-resolution via `status != GameStatus.IN_PROGRESS` check (line 336). - -> **Response: State machine analysis is correct. Points 1-4 under "Issues" are by design in the TEE trust model — see C-01 and C-03 responses above.** - ---- - -## 8. Bond Flow Analysis - -### Deposit Paths -| Action | Depositor | Amount | Credited To | -|--------|-----------|--------|-------------| -| `initialize()` | Proposer (`tx.origin`) | `msg.value` | `refundModeCredit[proposer]` | -| `challenge()` | Challenger (`msg.sender`) | `CHALLENGER_BOND` (exact) | `refundModeCredit[msg.sender]` | - -### Distribution Paths (Normal Mode) -| Scenario | Proposer | Challenger | Prover | -|----------|----------|------------|--------| -| Unchallenged, no proof | All balance | N/A | N/A | -| Unchallenged + proof | All balance | N/A | Nothing | -| Challenged, no proof (deadline) | Nothing | All balance | N/A | -| Challenged + proof, prover == proposer | All balance | Nothing | (same) | -| Challenged + proof, prover != proposer | Balance - CHALLENGER_BOND | Nothing | CHALLENGER_BOND | -| Parent lost, has challenger | Nothing | All balance | N/A | -| **Parent lost, no challenger** | **Nothing (BUG C-02)** | **N/A** | **N/A** | - -### Refund Mode -Each participant receives back exactly what they deposited via `refundModeCredit`. - -> **Response: Bond flow analysis is correct. The "Parent lost, no challenger" row has been fixed — proposer now receives their bond back. See C-02 fix.** - ---- - -## Summary Table - -| ID | Severity | Title | -|------|-------------|--------------------------------------------------------------------------| -| C-01 | Critical | `prove()` can be called multiple times -- proof overwrite enables theft | -| C-02 | Critical | `resolve()` credits `address(0)` when parent loses, child unchallenged | -| C-03 | Critical | Challenge window bypass -- proposer can prevent all challenges | -| C-04 | Critical | No domain separation in batch digest -- cross-game signature replay | -| H-01 | High | Raw digest signing without EIP-191/EIP-712 prefix | -| H-02 | High | Unbounded batch array in `prove()` -- gas griefing/DoS | -| H-03 | High | `prove()` missing `IN_PROGRESS` status guard -- post-resolution mutation | -| H-04 | High | `tx.origin` enables proposer phishing | -| M-01 | Medium | `AccessManager.getLastProposalTimestamp()` unbounded loop DoS | -| M-02 | Medium | Silent error swallowing in `closeGame()` try-catch | -| M-03 | Medium | `wasRespectedGameTypeWhenCreated` set but never read | -| M-04 | Medium | Timestamp overflow edge case in deadline computation | -| M-05 | Medium | Cascade resolution bypasses child game period | -| M-06 | Medium | `credit()` view returns misleading data when `UNDECIDED` | -| L-01 | Low | `TeeProofVerifier` ownership lacks two-step transfer | -| L-02 | Low | Missing zero-address check in `transferOwnership()` | -| L-03 | Low | `expectedRootKey` not enforced immutable | -| L-04 | Info | Custom errors defined inline instead of in Errors.sol | -| L-05 | Info | No `receive()`/`fallback()` -- force-sent ETH unaccounted | -| L-06 | Low | Single-challenger model enables front-running | -| L-07 | Low | Missing detailed events for bond credit assignments | - -**Priority Recommendations (before deployment):** -1. **Immediate:** Fix C-01 -- add status guard to `prove()` to prevent proof overwrite. -2. **Immediate:** Fix C-02 -- handle `counteredBy == address(0)` in parent-loses path. -3. **Immediate:** Fix C-03 -- enforce challenge window independently from proof submission. -4. **Immediate:** Fix C-04 -- add domain separation to `batchDigest`. -5. **High priority:** Add `IN_PROGRESS` check to `prove()` (H-03). -6. **High priority:** Add EIP-712 domain separator to TEE signing (H-01). -7. **Before mainnet:** Address AccessManager DoS vector (M-01). - -> **Response summary:** -> - **C-02: Fixed.** Bond now credited to proposer when `counteredBy == address(0)`. -> - **C-03: Documented.** Added NatSpec to `prove()` explicitly documenting TEE trust model and early prove design. -> - **C-01, C-04: Not bugs** under the TEE trust model — see individual responses above. -> - **H-01, H-02, H-04: Won't fix** — acceptable given permissioned TEE architecture. -> - **H-03: Fixed.** Added `IN_PROGRESS` status guard to `prove()`. -> - **M-01: Known issue** — will optimize in future iteration. -> - **M-02 through M-06: Won't fix / by design** — see individual responses. -> - **Additional fix (not from audit):** Cross-chain GameType isolation added in `initialize()` line 190-191. diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md deleted file mode 100644 index 3803ba9eddb41..0000000000000 --- a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_FINAL.md +++ /dev/null @@ -1,191 +0,0 @@ -# TeeDisputeGame -- Final Audit Report (Fix Verification) - -**Audit Date:** 2026-03-23 -**Auditor:** Senior Solidity Security Review -**Fix Commit:** `6f12abbcc8` (branch `contract/tee-dispute-game`) -**Base Audit:** Post-Refactor Audit Report at commit `bd3c50d1b6` -**Scope:** Verification of fixes for findings M-01 and M-02 from the post-refactor audit, plus review for newly introduced issues. - ---- - -## 1. Executive Summary - -The post-refactor audit identified two Medium-severity findings: - -- **M-01**: `prove()` was permissionless, allowing frontrunning of prover credit (CHALLENGER_BOND). -- **M-02**: `TeeProofVerifier.transferOwnership()` lacked a zero-address check; the custom ownership pattern was fragile. - -Both findings have been **fully and correctly fixed** in commit `6f12abbcc8`. The M-01 fix restricts `prove()` to the proposer via `msg.sender` check and simplifies the `resolve()` bond distribution. The M-02 fix replaces the custom ownership implementation with OpenZeppelin Ownable v4, which provides built-in zero-address validation and a battle-tested ownership model. - -One new low-severity observation is noted regarding the inherited `renounceOwnership()` function. No critical, high, or medium issues were introduced by the fixes. - -**Verdict: All Medium findings are resolved. The fixes are correct, complete, and well-tested.** - ---- - -## 2. Finding Verification - -### M-01: `prove()` is Permissionless -- Prover Credit Frontrunnable - -**Original Finding:** Any address could call `prove()` and be recorded as `claimData.prover`, allowing MEV bots to frontrun legitimate provers and steal the CHALLENGER_BOND reward in the `ChallengedAndValidProofProvided` resolution path. - -**Fix Applied:** - -In `TeeDisputeGame.sol`, line 272: - -```solidity -function prove(bytes calldata proofBytes) external returns (ProposalStatus) { - if (msg.sender != proposer) revert BadAuth(); - ... -``` - -The `proposer` state variable is set to `tx.origin` during `initialize()`, so only the original proposer EOA can call `prove()`. - -Additionally, `resolve()` bond distribution was simplified. Since `prover == proposer` is now guaranteed, the `ChallengedAndValidProofProvided` case awards `normalModeCredit[proposer] = address(this).balance` -- the proposer receives both their own bond and the challenger's bond. There is no longer a need for a separate prover/proposer split or third-party prover logic. - -**Verification:** - -1. **Access control correctness**: The `msg.sender != proposer` check uses the `proposer` state variable (set from `tx.origin` in `initialize()`), not the `PROPOSER` immutable. This is correct because it checks against the actual proposer of this specific game instance. The `BadAuth` error is the same error used for other access control checks in the contract, maintaining consistency. - -2. **State machine interaction**: The `BadAuth` revert occurs before any state mutation, so a rejected `prove()` call has no side effects. The check is positioned after `status != GameStatus.IN_PROGRESS` and before `gameOver()`, which is the correct ordering -- rejecting unauthorized callers early. - -3. **Bond distribution correctness in all resolve() paths**: - - `Unchallenged`: proposer gets `balance` (only proposer bond in contract). Correct. - - `Challenged` (no proof, timeout): challenger gets `balance` (proposer bond + challenger bond). Correct. - - `UnchallengedAndValidProofProvided`: proposer gets `balance`. Correct. - - `ChallengedAndValidProofProvided`: proposer gets `balance` (proposer bond + challenger bond). Correct -- proposer proved, so they win the challenger's bond. - - Parent `CHALLENGER_WINS` with child challenged: challenger gets `balance`. Correct. - - Parent `CHALLENGER_WINS` with child unchallenged: proposer gets `balance` (refund). Correct. - -4. **No remaining third-party prover references**: Searched for `thirdPartyProver`, `bond split`, and related terms across all TEE source and test files -- zero matches. - -5. **Test coverage**: `test_prove_revertUnauthorizedProver` explicitly tests that a non-proposer address receives `BadAuth`. The existing `test_prove_succeedsWithSingleBatch` and `test_prove_succeedsWithChainedBatches` tests call `prove()` via `vm.prank(proposer)`, confirming the happy path. Integration tests (`test_lifecycle_challenged_proveByProposer_defenderWins`, `test_lifecycle_viaRouter_fullCycle`) exercise the full lifecycle with proposer-only proving. - -**Status: FIXED** -- The fix fully addresses the finding with no residual risk. - ---- - -### M-02: `TeeProofVerifier.transferOwnership()` Lacks Zero-Address Check - -**Original Finding:** The custom `transferOwnership()` function did not validate `newOwner != address(0)`, risking irrecoverable loss of admin control over enclave registration and revocation. - -**Fix Applied:** - -The entire custom ownership implementation (state variable `owner`, `Unauthorized` error, `OwnerTransferred` event, `onlyOwner` modifier, and `transferOwnership()` function) was removed and replaced with inheritance from OpenZeppelin Ownable v4 (`@openzeppelin/contracts/access/Ownable.sol`): - -```solidity -import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; - -contract TeeProofVerifier is Ownable { - ... -} -``` - -**Verification:** - -1. **Zero-address protection**: OpenZeppelin Ownable v4's `transferOwnership()` includes `require(newOwner != address(0), "Ownable: new owner is the zero address")`. This is tested in `test_transferOwnership_revertZeroAddress` which expects the revert string `"Ownable: new owner is the zero address"`. - -2. **Constructor behavior**: OZ Ownable v4's constructor calls `_transferOwnership(_msgSender())`, setting the deployer as the initial owner. Since `TeeProofVerifier`'s constructor does not pass an explicit owner, the deployer address is used. This matches the previous behavior where `owner = msg.sender` was set in the constructor. - -3. **Storage layout**: OZ Ownable v4 uses a single `address private _owner` slot. The previous custom implementation also used a single `address public owner` slot. Since `TeeProofVerifier` is not upgradeable (no proxy), storage layout conflicts are not a concern. The visibility change from `public` to `private` (with a `public owner()` getter) is functionally equivalent. - -4. **Event name change**: The custom `OwnerTransferred(address, address)` event is replaced by OZ's `OwnershipTransferred(address indexed, address indexed)`. This is a breaking change for off-chain indexers monitoring the old event name. Since the contract is being deployed fresh (not upgraded), this is acceptable. - -5. **`onlyOwner` modifier**: OZ Ownable's `onlyOwner` modifier uses `require(owner() == _msgSender(), "Ownable: caller is not the owner")`. The `register()` and `revoke()` functions use `onlyOwner`, which is consistent with the previous behavior. Test `test_register_revertUnauthorizedCaller` validates this by expecting `"Ownable: caller is not the owner"`. - -6. **No remaining custom ownership references**: Searched for `Unauthorized`, `OwnerTransferred`, and custom ownership patterns across all TEE source files -- zero matches in source code. Test files reference `"Ownable: caller is not the owner"` (the OZ error string), confirming the migration. - -**Status: FIXED** -- The fix fully addresses the finding. OZ Ownable v4 is a well-audited, battle-tested implementation that provides zero-address validation, standard event names, and a clean API. - ---- - -## 3. New Findings - -### N-01: `renounceOwnership()` Is Inherited and Not Disabled - -**Severity:** Low -**File:** `src/dispute/tee/TeeProofVerifier.sol` - -**Description:** -OpenZeppelin Ownable v4 exposes `renounceOwnership()`, which sets the owner to `address(0)`. If the owner accidentally calls this function, all admin capabilities (enclave registration and revocation) are permanently lost. The `transferOwnership()` zero-address check does not protect against `renounceOwnership()`, which deliberately bypasses it via the internal `_transferOwnership(address(0))`. - -**Impact:** -Same as original M-02 -- permanent loss of admin control. However, the risk is lower because `renounceOwnership()` requires an explicit, deliberate call (not an accidental zero-address parameter), and the function name clearly communicates its intent. - -**Recommendation:** -Override `renounceOwnership()` to revert unconditionally: -```solidity -function renounceOwnership() public override onlyOwner { - revert("TeeProofVerifier: renounce disabled"); -} -``` -Alternatively, document that `renounceOwnership()` should never be called and rely on operational procedures. - ---- - -## 4. Test Coverage Assessment - -### M-01 Fix Tests - -| Test | File | What It Verifies | -|------|------|------------------| -| `test_prove_revertUnauthorizedProver` | `TeeDisputeGame.t.sol:551` | Non-proposer address gets `BadAuth` | -| `test_prove_succeedsWithSingleBatch` | `TeeDisputeGame.t.sol:223` | Proposer can prove, recorded as prover | -| `test_prove_succeedsWithChainedBatches` | `TeeDisputeGame.t.sol:250` | Multi-batch proving by proposer | -| `test_lifecycle_challenged_proveByProposer_defenderWins` | `TeeDisputeGameIntegration.t.sol:130` | Full lifecycle: challenge + proposer proves + resolve + claim | -| `test_lifecycle_viaRouter_fullCycle` | `TeeDisputeGameIntegration.t.sol:456` | Prove via router with proposer attribution | -| `test_claimCredit_challengerWinsNormalMode` | `TeeDisputeGame.t.sol:579` | Simplified bond distribution (challenger takes all) | -| `test_claimCredit_refundModeWhenBlacklisted` | `TeeDisputeGame.t.sol:607` | REFUND mode with proposer proving | - -**Assessment:** Excellent coverage. Both the access control rejection and the happy-path with simplified bond distribution are tested. Integration tests cover end-to-end flows. - -### M-02 Fix Tests - -| Test | File | What It Verifies | -|------|------|------------------| -| `test_transferOwnership_updatesOwner` | `TeeProofVerifier.t.sol:121` | Standard ownership transfer works | -| `test_transferOwnership_revertZeroAddress` | `TeeProofVerifier.t.sol:127` | Zero-address transfer is rejected | -| `test_register_revertUnauthorizedCaller` | `TeeProofVerifier.t.sol:36` | Non-owner cannot register (uses OZ error string) | - -**Assessment:** Good coverage for the ownership fix. The zero-address rejection test directly validates the M-02 fix. A test for `renounceOwnership()` behavior would strengthen coverage (see N-01). - -### Overall Test Quality - -- **4 test files** cover the TEE dispute game system: unit tests (`TeeDisputeGame.t.sol`), verifier tests (`TeeProofVerifier.t.sol`), integration tests (`TeeDisputeGameIntegration.t.sol`), and ASR compatibility tests (`AnchorStateRegistryCompatibility.t.sol`). -- Integration tests use real `DisputeGameFactory`, `AnchorStateRegistry`, and `TeeProofVerifier` contracts (only `RiscZeroVerifier` and `SystemConfig` are mocked). -- All game lifecycle paths are covered: unchallenged timeout, challenged + proved, challenged + timeout, blacklisted/refund, parent-child chaining, parent-loses scenarios, cross-chain isolation. -- Error paths are well-tested with `vm.expectRevert` for all custom errors. - ---- - -## 5. Residual Items from Post-Refactor Audit - -| ID | Severity | Title | Status Post-Fix | -|------|----------------|----------------------------------------------------------|---------------------| -| M-01 | Medium | `prove()` permissionless -- prover credit frontrunnable | **Fixed** | -| M-02 | Medium | `transferOwnership()` lacks zero-address check | **Fixed** | -| L-01 | Low | `tx.origin` for proposer authentication | Acknowledged (by design) | -| L-02 | Low | `_extractAddress` memory loop | Open | -| L-03 | Low | `expectedRootKey` not immutable | Open | -| I-01 | Informational | Unused error `ClaimNotChallenged` | Open | -| I-02 | Informational | Unused error `UnexpectedGameType` | Open | -| I-03 | Informational | `closeGame()` silently ignores `setAnchorState` failures | Acknowledged | -| I-04 | Informational | No `receive()`/`fallback()` | By Design | -| I-05 | Informational | AccessManager refactor completeness | Confirmed | -| N-01 | Low (New) | `renounceOwnership()` inherited, not disabled | Open | - ---- - -## 6. Conclusion - -Both Medium-severity findings from the post-refactor audit have been correctly and completely fixed: - -- **M-01** is resolved by restricting `prove()` to the proposer via `msg.sender` check, eliminating the frontrunning vector entirely. The `resolve()` bond distribution was properly simplified to reflect the proposer-only proving model. - -- **M-02** is resolved by replacing the custom ownership implementation with OpenZeppelin Ownable v4, which provides built-in zero-address validation on `transferOwnership()`, a standard `onlyOwner` modifier, and the well-known `OwnershipTransferred` event. - -The fixes are clean, minimal, and do not introduce storage layout issues or breaking behavioral changes. Test coverage adequately validates both the fix correctness and the absence of regressions. - -One new low-severity observation (N-01: inherited `renounceOwnership()` is not disabled) is noted for consideration but does not block deployment. - -**Final Assessment: The TeeDisputeGame system is ready for deployment. All Medium findings are resolved, and the codebase maintains its strong security posture.** diff --git a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md b/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md deleted file mode 100644 index 1f1dcf334190b..0000000000000 --- a/packages/contracts-bedrock/book/src/dispute/tee/AUDIT_REPORT_POST_REFACTOR.md +++ /dev/null @@ -1,278 +0,0 @@ -# TeeDisputeGame -- Post-Refactor Security Audit Report - -**Audit Date:** 2026-03-23 -**Auditor:** Senior Solidity Security Review -**Commit:** `bd3c50d1b6` (branch `contract/tee-dispute-game`) -**Scope:** Post-refactor audit after replacing external `AccessManager` with inline immutable `PROPOSER`/`CHALLENGER` pattern. - ---- - -## 1. Scope - -| File | Description | -|------|-------------| -| `src/dispute/tee/TeeDisputeGame.sol` | Core dispute game contract | -| `src/dispute/tee/TeeProofVerifier.sol` | TEE enclave registration and batch signature verification | -| `src/dispute/tee/lib/Errors.sol` | Custom error definitions | -| `interfaces/dispute/ITeeProofVerifier.sol` | Verifier interface | -| `scripts/deploy/DeployTee.s.sol` | Deployment script | -| `test/dispute/tee/TeeDisputeGame.t.sol` | Unit tests | -| `test/dispute/tee/TeeDisputeGameIntegration.t.sol` | Integration tests | -| `test/dispute/tee/helpers/TeeTestUtils.sol` | Test utilities | -| `test/dispute/tee/mocks/MockTeeProofVerifier.sol` | Mock verifier | -| `test/dispute/tee/mocks/MockDisputeGameFactory.sol` | Mock factory | - ---- - -## 2. Executive Summary - -The TeeDisputeGame system implements a dispute game for OP Stack that substitutes traditional ZK proofs with TEE (Trusted Execution Environment) ECDSA signatures. The architecture is sound and follows established OP Stack dispute game patterns. - -The recent refactor replaced an external `AccessManager` contract (Ownable, whitelist mappings, O(n) fallback iteration) with inline immutable `PROPOSER`/`CHALLENGER` address checks, matching the `PermissionedDisputeGame` pattern. The refactor has been cleanly executed with **no remaining `AccessManager` references** in any TEE-related source file, test, or deploy script. - -The codebase demonstrates good security awareness: rootClaim integrity is verified at initialization, parent-child game chaining is properly validated, batch proof continuity is enforced on-chain, and bond distribution handles edge cases (including the previously-fixed C-02 parent-loses-child-unchallenged scenario). - -**Findings: 0 Critical | 0 High | 2 Medium | 3 Low | 5 Informational** - ---- - -## 3. Findings - -### M-01: `prove()` is Permissionless -- Any Account Can Claim Prover Credit - -**Severity:** Medium -**File:** `src/dispute/tee/TeeDisputeGame.sol:271-344` - -**Description:** -The `prove()` function has no access control. Any address can call it and become `claimData.prover`. While the TEE signature within each `BatchProof` must be valid (signed by a registered enclave), the `msg.sender` who submits the transaction is recorded as the prover and receives the challenger's bond in the `ChallengedAndValidProofProvided` resolution path. This means anyone who observes a valid proof in the mempool can frontrun the intended prover's transaction and steal the prover reward. - -**Impact:** -A MEV bot or frontrunner can extract the proof data from a pending transaction, submit it in their own transaction with higher gas, and receive the `CHALLENGER_BOND` reward that was meant for the legitimate prover. The proposer is unaffected (they still get their bond back), but the third-party prover economic incentive is undermined. - -**Affected Code:** Line 334: `claimData.prover = msg.sender` - -**Recommendation:** -Consider one of: -1. Require that the prover is either the proposer or a registered enclave address recovered from the signature. -2. Use a commit-reveal scheme for proof submission. -3. Document the frontrunning risk as accepted, since the proposer (who is likely the intended prover) can always prove as themselves. - ---- - -### M-02: `TeeProofVerifier.transferOwnership()` Lacks Zero-Address Check - -**Severity:** Medium -**File:** `src/dispute/tee/TeeProofVerifier.sol:184-188` - -**Description:** -The `transferOwnership()` function does not validate that `newOwner != address(0)`. If the owner accidentally passes `address(0)`, ownership is irrecoverably lost, and no new enclaves can be registered or revoked. - -**Impact:** -Permanent loss of admin control over the verifier contract. No new TEE enclaves can be registered, and compromised enclaves cannot be revoked. This effectively bricks the security model of the entire system since enclave lifecycle management is the critical trust boundary. - -**Recommendation:** -Add a zero-address check: -```solidity -function transferOwnership(address newOwner) external onlyOwner { - if (newOwner == address(0)) revert Unauthorized(); - address oldOwner = owner; - owner = newOwner; - emit OwnerTransferred(oldOwner, newOwner); -} -``` - ---- - -### L-01: `tx.origin` Used for Proposer Authentication - -**Severity:** Low -**File:** `src/dispute/tee/TeeDisputeGame.sol:177,228` - -**Description:** -The `initialize()` function uses `tx.origin` for access control (`if (tx.origin != PROPOSER) revert BadAuth()`) and bond credit attribution (`proposer = tx.origin`). While `tx.origin` is necessary to identify the proposer EOA through intermediate contracts (Factory, Router), it means smart contract wallets (e.g., Safe multisigs, ERC-4337 account abstractions) cannot act as proposers. - -**Impact:** -Deliberate design choice aligned with OP Stack permissioned games, but limits future flexibility. The `tx.origin` usage is safe against reentrancy in this context since it's only checked during initialization. - -**Recommendation:** -This is documented and intentional. For future-proofing, consider supporting an alternative authentication mechanism (e.g., an optional `_proposer` parameter in the factory's `create()` calldata) to allow smart contract wallets. - ---- - -### L-02: `_extractAddress` Uses Memory Loop Instead of Assembly - -**Severity:** Low (Gas) -**File:** `src/dispute/tee/TeeProofVerifier.sol:229-235` - -**Description:** -`TeeProofVerifier._extractAddress()` copies 64 bytes from the public key using a Solidity for-loop, which is significantly more expensive than an assembly-based approach. - -**Impact:** -Wasted gas on every `register()` call. The function is owner-only and called infrequently, so the practical impact is minimal. - -**Recommendation:** -Replace the loop with: -```solidity -function _extractAddress(bytes memory publicKey) internal pure returns (address) { - bytes32 hash; - assembly { - hash := keccak256(add(publicKey, 33), 64) - } - return address(uint160(uint256(hash))); -} -``` - ---- - -### L-03: `expectedRootKey` Is Not Immutable - -**Severity:** Low -**File:** `src/dispute/tee/TeeProofVerifier.sol:32` - -**Description:** -`expectedRootKey` is declared as `bytes public` rather than as an immutable. While it is only set in the constructor and has no setter, it occupies storage slots and requires SLOAD on every `register()` call. - -**Impact:** -Minor gas overhead on `register()` calls. No security impact since there is no setter. - -**Recommendation:** -Since `bytes` cannot be `immutable` in Solidity, consider storing `keccak256(expectedRootKey)` as an `immutable bytes32` and comparing against that hash in `register()`, avoiding the storage read entirely. - ---- - -### I-01: Unused Error `ClaimNotChallenged` in `lib/Errors.sol` - -**Severity:** Informational -**File:** `src/dispute/tee/lib/Errors.sol:33` - -**Description:** -The error `ClaimNotChallenged()` is defined but never used in `TeeDisputeGame.sol`. Appears to be a remnant from a previous design. - -**Recommendation:** Remove the unused error. - ---- - -### I-02: Unused Error `UnexpectedGameType` in `lib/Errors.sol` - -**Severity:** Informational -**File:** `src/dispute/tee/lib/Errors.sol:12` - -**Description:** -The error `UnexpectedGameType()` is defined but never referenced. The game type mismatch during initialization uses `InvalidParentGame` instead. - -**Recommendation:** Remove the unused error. - ---- - -### I-03: `closeGame()` Silently Ignores `setAnchorState` Failures - -**Severity:** Informational -**File:** `src/dispute/tee/TeeDisputeGame.sol:425` - -**Description:** -The call to `ANCHOR_STATE_REGISTRY.setAnchorState()` is wrapped in a try-catch that silently swallows all errors. This is intentional (a `CHALLENGER_WINS` game should not update the anchor), but unexpected revert reasons are also silently ignored. - -**Recommendation:** Consider emitting an event on failure for off-chain observability, or adding a comment clarifying the expected failure cases. - ---- - -### I-04: No `receive()` / `fallback()` Function - -**Severity:** Informational -**File:** `src/dispute/tee/TeeDisputeGame.sol` - -**Description:** -The contract has no `receive()` or `fallback()`. ETH enters only through `initialize()` and `challenge()`. This prevents accidental ETH deposits, which is the correct behavior. - -**Impact:** None in the current design. - -**Recommendation:** No change needed. This is the correct design. - ---- - -### I-05: AccessManager Refactor Completeness - -**Severity:** Informational - -**Description:** -A comprehensive search for `AccessManager` across all TEE-related source files (`src/dispute/tee/`, `test/dispute/tee/`, `scripts/deploy/DeployTee.s.sol`) returned **zero matches**. The only `AccessManager` references in the repository are in OpenZeppelin's own library files (`lib/openzeppelin-contracts-v5/`), which are unrelated third-party code. - -The refactor from an external `AccessManager` to inline immutable `PROPOSER`/`CHALLENGER` checks is complete and clean. - -**Recommendation:** No action needed. - ---- - -## 4. Architecture Review - -### Overall Design - -The system follows a well-established pattern from the OP Stack dispute game framework: - -1. **Clone (CWIA) Pattern**: Games are deployed as minimal clones via `LibClone.clone()` with immutable arguments appended to the bytecode. The calldatasize check at line 180 requires exactly `0xBE` (190 bytes), which is verified correct: 4-byte selector + 0xB8 bytes clone data + 0x02 Solady length suffix. - -2. **Two-Layer Trust Model**: TEE enclave identity is established via ZK proof of Nitro attestation (one-time registration), while batch correctness is verified via ECDSA signature (per-game). This separation is clean and appropriate. - -3. **State Machine**: The `ProposalStatus` enum has five states with well-defined transitions: - - `Unchallenged` -> `Challenged` (via `challenge()`) - - `Unchallenged` -> `UnchallengedAndValidProofProvided` (via `prove()`) - - `Challenged` -> `ChallengedAndValidProofProvided` (via `prove()`) - - Any non-Resolved -> `Resolved` (via `resolve()`) - - Transitions are correctly enforced. There is no way to go from a proved state back to unproved. - -4. **Parent-Child Chaining**: The parent game validation in `initialize()` correctly checks game type, respected/blacklisted/retired status, and rejects `CHALLENGER_WINS` parents. The `resolve()` function properly short-circuits when a parent has been invalidated, with the fix for C-02 (crediting proposer instead of `address(0)` when child is unchallenged and parent loses). - -5. **Bond Distribution**: The dual `normalModeCredit`/`refundModeCredit` pattern with lazy `closeGame()` determination is sound. Credits are zeroed before ETH transfer, preventing reentrancy. - -### Positive Security Properties - -- **Reentrancy-safe**: `claimCredit()` follows checks-effects-interactions -- zeroes both credit mappings *before* the ETH transfer. -- **Double-resolve prevention**: `resolve()` checks `status != GameStatus.IN_PROGRESS` at entry. -- **Double-prove prevention**: `gameOver()` returns true once `claimData.prover != address(0)`, so `prove()` cannot be called twice. -- **Cross-chain isolation**: Parent games are validated by `GameType`, preventing cross-type parent references. Integration tests explicitly verify this. -- **Bond accounting**: `address(this).balance` is used as the total pool in `resolve()`, correctly capturing all deposited bonds. -- **Access control refactor**: The new inline `PROPOSER`/`CHALLENGER` immutable pattern is simpler, cheaper (no external call overhead), and eliminates the O(n) `getLastProposalTimestamp()` DoS vector from the prior `AccessManager`. - ---- - -## 5. Gas Optimizations - -| ID | Description | Estimated Savings | Location | -|----|-------------|-------------------|----------| -| G-01 | `_extractAddress` loop can be replaced with assembly (see L-02) | ~400 gas per `register()` | `TeeProofVerifier.sol:230-233` | -| G-02 | `prove()` recomputes `proofs.length` on every loop iteration; cache in a local variable | ~20 gas per batch | `TeeDisputeGame.sol:289` | -| G-03 | `keccak256(rootKey) != keccak256(expectedRootKey)` computes two hashes; store `keccak256(expectedRootKey)` as immutable `bytes32` | ~200 gas per `register()` | `TeeProofVerifier.sol:114` | -| G-04 | `claimData` is read from storage multiple times in `resolve()`; cache the full struct in memory | ~200 gas per `resolve()` | `TeeDisputeGame.sol:346-389` | -| G-05 | In `prove()`, `startingOutputRoot` is an SLOAD; consider caching it | ~100 gas | `TeeDisputeGame.sol:281,287` | - -Overall gas efficiency is reasonable. The primary gas cost is in the `prove()` loop which involves per-batch `keccak256` + external call to `TEE_PROOF_VERIFIER.verifyBatch()` + `ecrecover`. These are inherent to the verification logic and cannot be meaningfully reduced. - ---- - -## 6. Summary Table - -| ID | Severity | Title | Status | -|------|----------------|--------------------------------------------------------------------|---------------| -| M-01 | Medium | `prove()` is permissionless -- prover credit is frontrunnable | Fixed | -| M-02 | Medium | `TeeProofVerifier.transferOwnership()` lacks zero-address check | Fixed | -| L-01 | Low | `tx.origin` used for proposer authentication | Acknowledged | -| L-02 | Low | `_extractAddress` uses memory loop instead of assembly | Open | -| L-03 | Low | `expectedRootKey` is not immutable | Open | -| I-01 | Informational | Unused error `ClaimNotChallenged` in `lib/Errors.sol` | Open | -| I-02 | Informational | Unused error `UnexpectedGameType` in `lib/Errors.sol` | Open | -| I-03 | Informational | `closeGame()` silently ignores `setAnchorState` failures | Acknowledged | -| I-04 | Informational | No `receive()`/`fallback()` function | By Design | -| I-05 | Informational | AccessManager refactor completeness -- zero remaining references | Confirmed | - ---- - -## 7. Conclusion - -The TeeDisputeGame system is well-designed and demonstrates strong security engineering. The codebase is clean, well-commented, and follows established OP Stack patterns. The AccessManager-to-immutable refactor has been executed completely with no residual references. - -The two Medium findings (frontrunnable prover credit and missing zero-address check on ownership transfer) are the most actionable. The Low and Informational findings are minor improvements. - -Test coverage is comprehensive, including both unit tests with mocks and integration tests with real contracts, covering the full game lifecycle, parent-child chains, cross-chain isolation, bond distribution modes, and error paths. - -**Overall Assessment: The contract is well-suited for deployment with the recommended mitigations applied.** The core security properties -- bond safety, state machine correctness, proof verification integrity, and access control -- are sound. From 3601be5d418091520a45bf5b695a1464221d57b0 Mon Sep 17 00:00:00 2001 From: "jason.huang" Date: Mon, 30 Mar 2026 15:42:34 +0800 Subject: [PATCH 24/24] refactor: change GAME_TYPE from immutable to constant, gameType()/gameData() from view to pure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GAME_TYPE is always GameType.wrap(1960), a compile-time constant — no need for runtime immutable assignment. This aligns with ZKDisputeGame's pure pattern and gives the compiler stricter guarantees. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol index a7124e93dabed..686c273c2b002 100644 --- a/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol +++ b/packages/contracts-bedrock/src/dispute/tee/TeeDisputeGame.sol @@ -124,9 +124,9 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // Immutables // //////////////////////////////////////////////////////////////// + GameType internal constant GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); Duration internal immutable MAX_CHALLENGE_DURATION; Duration internal immutable MAX_PROVE_DURATION; - GameType internal immutable GAME_TYPE; IDisputeGameFactory internal immutable DISPUTE_GAME_FACTORY; ITeeProofVerifier internal immutable TEE_PROOF_VERIFIER; uint256 internal immutable CHALLENGER_BOND; @@ -170,7 +170,6 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { address _proposer, address _challenger ) { - GAME_TYPE = GameType.wrap(TEE_DISPUTE_GAME_TYPE); MAX_CHALLENGE_DURATION = _maxChallengeDuration; MAX_PROVE_DURATION = _maxProveDuration; DISPUTE_GAME_FACTORY = _disputeGameFactory; @@ -468,7 +467,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { // IDisputeGame Impl // //////////////////////////////////////////////////////////////// - function gameType() public view returns (GameType gameType_) { + function gameType() public pure returns (GameType gameType_) { gameType_ = GAME_TYPE; } @@ -516,7 +515,7 @@ contract TeeDisputeGame is Clone, ISemver, IDisputeGame { extraData_ = _getArgBytes(0x54, 0x64); } - function gameData() external view returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { + function gameData() external pure returns (GameType gameType_, Claim rootClaim_, bytes memory extraData_) { gameType_ = gameType(); rootClaim_ = rootClaim(); extraData_ = extraData();