verify op block loaded from DB

risc0 · Jan 11, 2024 · b8bbceb · b8bbceb
1 parent fbe4255
commit b8bbceb
Show file tree

Hide file tree

Showing 2 changed files with 51 additions and 12 deletions.
diff --git a/lib/src/optimism/config.rs b/lib/src/optimism/config.rs
@@ -23,10 +23,12 @@ use super::system_config::SystemConfig;
 pub struct ChainConfig {
     /// The initial system config value
     pub system_config: SystemConfig,
-    // The L1 attributes depositor address
+    /// The L1 attributes depositor address
     pub l1_attributes_depositor: Address,
     /// The L1 attributes contract
     pub l1_attributes_contract: Address,
+    /// The L2 address accumulating any transaction priority fee
+    pub sequencer_fee_vault: Address,
     /// The batch inbox address
     pub batch_inbox: Address,
     /// The deposit contract address
@@ -57,6 +59,7 @@ impl ChainConfig {
             },
             l1_attributes_depositor: address!("deaddeaddeaddeaddeaddeaddeaddeaddead0001"),
             l1_attributes_contract: address!("4200000000000000000000000000000000000015"),
+            sequencer_fee_vault: address!("4200000000000000000000000000000000000011"),
             batch_inbox: address!("ff00000000000000000000000000000000000010"),
             deposit_contract: address!("bEb5Fc579115071764c7423A4f12eDde41f106Ed"),
             system_config_contract: address!("229047fed2591dbec1eF1118d64F7aF3dB9EB290"),

diff --git a/lib/src/optimism/mod.rs b/lib/src/optimism/mod.rs
@@ -243,22 +243,51 @@ impl<D: BatcherDb> DeriveMachine<D> {
                         Vec::new()
                     };
 
-                // Obtain new Op head
+                // obtain verified op block header
                 let new_op_head = {
                     let new_op_head = self
                         .derive_input
                         .db
                         .get_op_block_header(self.op_block_no)
-                        .context("block not found")?;
+                        .context("op block not found")?;
 
-                    // Verify new op head has the expected parent
-                    assert_eq!(
-                        new_op_head.parent_hash,
-                        self.op_batcher.state.safe_head.hash
+                    // Verify that the op block header loaded from the DB matches the payload
+                    // attributes of the batch.
+                    ensure!(
+                        new_op_head.parent_hash == self.op_batcher.state.safe_head.hash,
+                        "Invalid op block parent hash"
+                    );
+                    ensure!(
+                        new_op_head.beneficiary == self.op_batcher.config.sequencer_fee_vault,
+                        "Invalid op block beneficiary"
+                    );
+                    ensure!(
+                        new_op_head.gas_limit == self.op_batcher.config.system_config.gas_limit,
+                        "Invalid op block gas limit"
+                    );
+                    ensure!(
+                        new_op_head.timestamp == U256::from(op_batch.essence.timestamp),
+                        "Invalid op block timestamp"
+                    );
+                    ensure!(
+                        new_op_head.extra_data.is_empty(),
+                        "Invalid op block extra data"
                     );
 
-                    // Verify that the new op head transactions are consistent with the batch
-                    // transactions
+                    // verify that the new op head mix hash matches the mix hash of the L1 block
+                    {
+                        let l1_epoch_header = self
+                            .derive_input
+                            .db
+                            .get_eth_block_header(op_batch.essence.epoch_num)
+                            .context("eth block not found")?;
+                        ensure!(
+                            new_op_head.mix_hash == l1_epoch_header.mix_hash,
+                            "Invalid op block mix hash"
+                        );
+                    }
+
+                    // verify that the new op head transactions match the batch transactions
                     {
                         // From the spec:
                         // The first transaction MUST be a L1 attributes deposited transaction,
@@ -274,11 +303,18 @@ impl<D: BatcherDb> DeriveMachine<D> {
                             let trie_key = tx_no.to_rlp();
                             tx_trie.insert(&trie_key, tx)?;
                         }
-                        if tx_trie.hash() != new_op_head.transactions_root {
-                            bail!("Invalid op block transaction data! Transaction trie root does not match")
-                        }
+
+                        ensure!(
+                            tx_trie.hash() == new_op_head.transactions_root,
+                            "Invalid op block transactions"
+                        );
                     }
 
+                    ensure!(
+                        new_op_head.withdrawals_root.is_none(),
+                        "Invalid op block withdrawals"
+                    );
+
                     new_op_head
                 };