Add Multiproofs activation task (Mainnet)

mainnet/.env

@@ -10,9 +10,9 @@ export BASE_SECURITY_COUNCIL=0x20AcF55A3DCfe07fC4cecaCFa1628F788EC8A4Dd
 export BATCH_INBOX=0xff00000000000000000000000000000000008453
 export BATCH_SENDER=0x5050f69a9786f081509234f1a7f4684b5e5b76c9
 export CB_MULTISIG=0x9855054731540A48b28990B63DcF4f33d8AE46A1
-export CHALLENGER=0x8Ca1E12404d16373Aef756179B185F27b2994F3a
+export CHALLENGER=0x819501cdA743a606A93dbEF254FE0D263Ce7d102
 export INCIDENT_MULTISIG=0x14536667Cd30e52C0b458BaACcB9faDA7046E056
-export PROPOSER=0x642229f238fb9de03374be34b0ed8d9de80752c5
+export PROPOSER=0xc1366Fabe614d42D367A1ecE61821238A1d31cF5
 export PROXY_ADMIN_OWNER=0x7bB41C3008B3f03FE483B28b8DB90e19Cf07595c
 
 # L1 Addresses

mainnet/2026-04-28-activate-multiproof/.env

@@ -0,0 +1,50 @@
+BASE_CONTRACTS_COMMIT=01dad230390cd69bcf130b5fc7a7a580b31650a7
+
+# Multiproof identity and deployment constants.
+GAME_TYPE=621
+SP1_VERIFIER=0x397A5f7f3dBd538f23DE225B51f532c34448dA9B
+TEE_IMAGE_HASH=TODO
+ZK_RANGE_HASH=TODO
+ZK_AGGREGATE_HASH=TODO
+CONFIG_HASH=TODO
+
+# Deployment timings and economic parameters.
+BLOCK_INTERVAL=600
+INTERMEDIATE_BLOCK_INTERVAL=30
+PROOF_THRESHOLD=1
+INIT_BOND=50000000000000000
+PROOF_MATURITY_DELAY_SECONDS=86400
+DISPUTE_GAME_FINALITY_DELAY_SECONDS=0
+DELAYED_WETH_DELAY_SECONDS=86400
+
+# TEE roles.
+TEE_PROVER_REGISTRY_OWNER=0x9855054731540A48b28990B63DcF4f33d8AE46A1
+TEE_PROVER_REGISTRY_MANAGER=0xd87488Dbb5b6F47cc6c15Dd95Bb60c83D3031b04
+
+# NitroEnclaveVerifier deployment.
+NITRO_INITIAL_MAX_TIME_DIFF_SECONDS=3600
+NITRO_INITIAL_ROOT_CERT=0x641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b
+RISC0_VERIFIER_ROUTER=0x8EaB2D97Dfce405A1692a21b3ff3A172d593D319
+RISC0_SET_VERIFIER=0x5005aBa3DFf7C940fcc1e48DccCAD611a80eEB85
+RISC0_SET_BUILDER_IMAGE_ID=0x70909b25db0db00f1d4b4016aeb876f53568a3e5a8e6397cb562d79947a02cc9
+NITRO_ZK_VERIFIER_ID=0x15051db631d6ed382d957c795a558a0abdd00d0d22a1670455721bc2712d3d6e
+NITRO_VERIFIER_PROOF_ID=0x00640947da751a4ae37280ab2f6572319795ae5c88973d042d657a7bbba60ca2
+NITRO_REVOKER=0xd87488Dbb5b6F47cc6c15Dd95Bb60c83D3031b04
+
+# AnchorStateRegistry bootstrap values for the reinitializer.
+STARTING_ANCHOR_ROOT=TODO
+STARTING_ANCHOR_L2_BLOCK_NUMBER=TODO
+
+# Re-exported for task simulation UI.
+PROXY_ADMIN_OWNER=0x7bB41C3008B3f03FE483B28b8DB90e19Cf07595c
+L1_PROXY_ADMIN=0x0475cBCAebd9CE8AfA5025828d5b98DFb67E059E
+SYSTEM_CONFIG=0x73a79Fab69143498Ed3712e519A88a918e1f4072
+OPTIMISM_PORTAL=0x49048044D57e1C92A77f79988d21Fa8fAF74E97e
+DISPUTE_GAME_FACTORY_PROXY=0x43edB88C4B80fDD2AdFF2412A7BebF9dF42cB40e
+ANCHOR_STATE_REGISTRY_PROXY=0x909f6cf47ed12f010A796527f562bFc26C7F4E72
+PROPOSER=0xc1366Fabe614d42D367A1ecE61821238A1d31cF5
+CHALLENGER=0x819501cdA743a606A93dbEF254FE0D263Ce7d102
+L2_CHAIN_ID=8453
+
+# Validation generation.
+RECORD_STATE_DIFF=true

mainnet/2026-04-28-activate-multiproof/FACILITATOR.md

@@ -0,0 +1,164 @@
+# Facilitator Guide
+
+Guide for facilitators managing this task.
+
+## Task Origin Signing
+
+After setting up the task, generate cryptographic attestations to prove who created and facilitated the task. These signatures are stored in `mainnet/signatures/2026-04-28-activate-multiproof/`.
+
+### Task creator
+
+```bash
+cd contract-deployments/mainnet/2026-04-28-activate-multiproof
+make sign-as-task-creator
+```
+
+### Base facilitator
+
+```bash
+cd contract-deployments/mainnet/2026-04-28-activate-multiproof
+make sign-as-base-facilitator
+```
+
+### Security Council facilitator
+
+```bash
+cd contract-deployments/mainnet/2026-04-28-activate-multiproof
+make sign-as-sc-facilitator
+```
+
+## Finalize task inputs
+
+Before collecting signatures, confirm that the task parameters in `.env` match the intended mainnet cutover values.
+
+Revalidate `STARTING_ANCHOR_*` against mainnet before collecting signatures.
+
+## Deployment prerequisites
+
+Before collecting signatures, complete all deploy steps:
+
+```bash
+cd contract-deployments
+git pull
+cd mainnet/2026-04-28-activate-multiproof
+make deps
+make deploy-nitro-verifier
+make deploy-multiproof
+make setup-nitro
+```
+
+`make deps` applies the local `AnchorStateRegistry` patch so the ASR reinitializer clears the old `anchorGame` pointer and the new `STARTING_ANCHOR_*` values take effect after cutover.
+
+`make deploy-nitro-verifier` deploys `NitroEnclaveVerifier` and wires the RiscZero verify route using the configured `RISC0_SET_VERIFIER`. Initializes `addresses.json`.
+
+`make deploy-multiproof` deploys the remaining contracts (`TEEProverRegistry`, `DelayedWETH`, `TEEVerifier`, `ZkVerifier`, `AggregateVerifier`, etc.). The `TEEProverRegistry` and `DelayedWETH` proxies are initialized at deploy time and their admin is transferred to the L1 `ProxyAdmin`. Appends addresses to `addresses.json`.
+
+`make setup-nitro` configures the `NitroEnclaveVerifier`: sets the `proofSubmitter` to the `TEEProverRegistry` proxy and transfers ownership to `TEE_PROVER_REGISTRY_OWNER`. This step runs directly via the deployer Ledger.
+
+The activation batch upgrades the L1 proxies, registers the new multiproof game type, and disables new `CANNON` game creation.
+
+Expected `addresses.json` keys:
+
+- `nitroEnclaveVerifier`
+- `teeProverRegistryImpl`
+- `teeProverRegistryProxy`
+- `teeVerifier`
+- `zkVerifier`
+- `delayedWETHImpl`
+- `delayedWETHProxy`
+- `aggregateVerifier`
+- `optimismPortal2Impl`
+- `disputeGameFactoryImpl`
+- `anchorStateRegistryImpl`
+
+## Generate validation files
+
+```bash
+cd contract-deployments
+git pull
+cd mainnet/2026-04-28-activate-multiproof
+make deps
+make gen-validation-multiproof-cb
+make gen-validation-multiproof-sc
+```
+
+This produces:
+
+- `validations/multiproof-cb-signer.json`
+- `validations/multiproof-sc-signer.json`
+
+Mainnet validation files must not contain `skipTaskOriginValidation`.
+
+## Pre-sign check: `STARTING_ANCHOR_*` correctness
+
+`STARTING_ANCHOR_ROOT` and `STARTING_ANCHOR_L2_BLOCK_NUMBER` are chain-critical.
+Before collecting signatures, verify both values against the target RPC endpoints.
+
+### 1. Validate that the anchor block number is expected
+
+Confirm `STARTING_ANCHOR_L2_BLOCK_NUMBER` matches the planned cutover value.
+
+```bash
+BLOCK=$STARTING_ANCHOR_L2_BLOCK_NUMBER
+cast block $BLOCK --rpc-url $L2_RPC_URL
+```
+
+### 2. Derive output root from that exact block
+
+Use `optimism_outputAtBlock` with the same block and compare to `STARTING_ANCHOR_ROOT` from `.env`.
+
+```bash
+BLOCK=$STARTING_ANCHOR_L2_BLOCK_NUMBER
+OUTPUT_ROOT=$(cast rpc optimism_outputAtBlock $(cast 2h $BLOCK) --rpc-url $OP_NODE_RPC_URL | jq -r '.outputRoot')
+echo $OUTPUT_ROOT
+echo $STARTING_ANCHOR_ROOT
+```
+
+Expected result:
+
+- `OUTPUT_ROOT == STARTING_ANCHOR_ROOT`
+
+## Execute the transaction
+
+### 1. Update repo
+
+```bash
+cd contract-deployments
+git pull
+cd mainnet/2026-04-28-activate-multiproof
+make deps
+```
+
+### 2. Collect signatures for `CB_MULTISIG`
+
+Concatenate all signatures and export as the `SIGNATURES` environment variable:
+
+```bash
+export SIGNATURES="[SIGNATURE1][SIGNATURE2]..."
+```
+
+Then run:
+
+```bash
+SIGNATURES=$SIGNATURES make approve-multiproof-cb
+```
+
+### 3. Collect signatures for `BASE_SECURITY_COUNCIL`
+
+Concatenate all signatures and export as the `SIGNATURES` environment variable:
+
+```bash
+export SIGNATURES="[SIGNATURE1][SIGNATURE2]..."
+```
+
+Then run:
+
+```bash
+SIGNATURES=$SIGNATURES make approve-multiproof-sc
+```
+
+### 4. Execute the multiproof activation batch
+
+```bash
+make execute-activate-multiproof
+```

mainnet/2026-04-28-activate-multiproof/Makefile

@@ -0,0 +1,86 @@
+include ../../Makefile
+include ../../Multisig.mk
+include ../.env
+include .env
+
+SIGNER_TOOL_PATH = ../../signer-tool
+RPC_URL = $(L1_RPC_URL)
+DEPLOYER = $(shell cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH))
+ACTIVATE_MULTIPROOF_SCRIPT_NAME = script/ActivateMultiproofStack.s.sol:ActivateMultiproofStack
+MULTIPROOF_CB_SENDER = $(shell cast call $(CB_MULTISIG) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+MULTIPROOF_SC_SENDER = $(shell cast call $(BASE_SECURITY_COUNCIL) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+
+.PHONY: apply-patches
+apply-patches:
+	cd lib/contracts && patch -p1 < ../../patch/asr-reset-anchor-game.patch
+
+.PHONY: deps
+deps: task-extra-deps apply-patches
+
+.PHONY: task-extra-deps
+task-extra-deps:
+	forge install --no-git github.com/base/op-enclave@a2d5398f04c3a8e4df929d58ee638ba4a037bfec
+	forge install --no-git github.com/risc0/risc0-ethereum@a78ac4a52fe9cfa14120c3b496430f0d42e1d8d3
+	forge install --no-git github.com/succinctlabs/sp1-contracts@22c4a47cd0a388cb4e25b4f2513954e4275c74ca
+	git clone --no-checkout https://github.com/OpenZeppelin/openzeppelin-contracts.git lib/openzeppelin-contracts-v5 && \
+		cd lib/openzeppelin-contracts-v5 && git checkout dbb6104ce834628e473d2173bbc9d47f81a9eec3
+	git clone --no-checkout https://github.com/Vectorized/solady.git lib/solady-v0.0.245 && \
+		cd lib/solady-v0.0.245 && git checkout e0ef35adb0ccd1032794731a995cb599bba7b537
+
+##
+# Deployment
+##
+.PHONY: deploy-nitro-verifier
+deploy-nitro-verifier:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	forge script --rpc-url $(L1_RPC_URL) script/DeployNitroVerifier.s.sol:DeployNitroVerifier \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast --verify \
+		--verifier custom \
+		--verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) \
+		-vvvv --sender $(DEPLOYER)
+
+.PHONY: deploy-multiproof
+deploy-multiproof:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	forge script --rpc-url $(L1_RPC_URL) script/DeployMultiproofStack.s.sol:DeployMultiproofStack \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast --verify \
+		--verifier custom \
+		--verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) \
+		-vvvv --sender $(DEPLOYER)
+
+.PHONY: setup-nitro
+setup-nitro:
+	forge script --rpc-url $(L1_RPC_URL) script/SetupNitroEnclaveVerifier.s.sol:SetupNitroEnclaveVerifier \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv --sender $(DEPLOYER)
+
+##
+# Activate Multiproof
+##
+.PHONY: gen-validation-multiproof-cb
+gen-validation-multiproof-cb: deps-signer-tool
+	$(call GEN_VALIDATION,$(ACTIVATE_MULTIPROOF_SCRIPT_NAME),$(CB_MULTISIG),$(MULTIPROOF_CB_SENDER),multiproof-cb-signer.json,)
+
+.PHONY: gen-validation-multiproof-sc
+gen-validation-multiproof-sc: deps-signer-tool
+	$(call GEN_VALIDATION,$(ACTIVATE_MULTIPROOF_SCRIPT_NAME),$(BASE_SECURITY_COUNCIL),$(MULTIPROOF_SC_SENDER),multiproof-sc-signer.json,)
+
+.PHONY: approve-multiproof-cb
+approve-multiproof-cb: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+approve-multiproof-cb:
+	$(call MULTISIG_APPROVE,$(CB_MULTISIG),$(SIGNATURES))
+
+.PHONY: approve-multiproof-sc
+approve-multiproof-sc: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+approve-multiproof-sc:
+	$(call MULTISIG_APPROVE,$(BASE_SECURITY_COUNCIL),$(SIGNATURES))
+
+.PHONY: execute-activate-multiproof
+execute-activate-multiproof: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+execute-activate-multiproof:
+	$(call MULTISIG_EXECUTE,0x)

mainnet/2026-04-28-activate-multiproof/README.md

@@ -0,0 +1,41 @@
+# Activate Multiproof
+
+Status: PENDING
+
+## Description
+
+This task deploys and activates multiproof on `mainnet`.
+
+- deploys `NitroEnclaveVerifier`
+- deploys the multiproof stack with `TEEVerifier`, `ZkVerifier`, and `AggregateVerifier`
+- activates the new multiproof game type through the mainnet `ProxyAdminOwner`
+- disables new `CANNON` game creation
+
+## Procedure
+
+## Sign Task
+
+### 1. Update repo
+
+```bash
+cd contract-deployments
+git pull
+```
+
+### 2. Run the signing tool
+
+```bash
+cd contract-deployments
+make sign-task
+```
+
+### 3. Open the UI at [http://localhost:3000](http://localhost:3000)
+
+- Select the correct signer role from the list of available users to sign.
+- After completion, close the signer tool with `Ctrl + C`.
+
+### 4. Send signature to facilitator
+
+Copy the signature output and send it to the designated facilitator via the agreed communication channel.
+
+For facilitator instructions, see `FACILITATOR.md`.

mainnet/2026-04-28-activate-multiproof/foundry.toml

@@ -0,0 +1,38 @@
+[profile.default]
+src = 'src'
+out = 'out'
+libs = ['lib']
+broadcast = 'records'
+fs_permissions = [{ access = "read-write", path = "./" }]
+optimizer = true
+optimizer_runs = 200
+auto_detect_solc = true
+evm_version = "prague"
+via-ir = false
+remappings = [
+    '@eth-optimism-bedrock/=lib/optimism/packages/contracts-bedrock/',
+    '@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts',
+    '@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts',
+    '@rari-capital/solmate/=lib/solmate/',
+    '@base-contracts/=lib/contracts/',
+    'solady/=lib/solady/src/',
+    '@solady/=lib/solady/src/',
+    '@solady-v0.0.245/=lib/solady-v0.0.245/src/',
+    '@lib-keccak/=lib/lib-keccak/contracts/lib',
+    'forge-std/=lib/forge-std/src/',
+    'interfaces/dispute/=lib/contracts/interfaces/dispute/',
+    'interfaces/cannon/=lib/contracts/interfaces/cannon/',
+    'interfaces/multiproof/=lib/contracts/interfaces/multiproof/',
+    'interfaces/universal/=lib/contracts/interfaces/universal/',
+    'interfaces/L1/=lib/contracts/interfaces/L1/',
+    'interfaces/legacy/=lib/contracts/interfaces/legacy/',
+    'src/dispute/=lib/contracts/src/dispute/',
+    'src/multiproof/=lib/contracts/src/multiproof/',
+    'src/universal/=lib/contracts/src/universal/',
+    'src/L1/=lib/contracts/src/L1/',
+    'src/cannon/=lib/contracts/src/cannon/',
+    'src/vendor/=lib/contracts/src/vendor/',
+    'src/libraries/=lib/contracts/src/libraries/',
+    'lib/op-enclave/=lib/op-enclave/',
+    'openzeppelin/=lib/risc0-ethereum/lib/openzeppelin-contracts/',
+]