feat(l2): make L1 contracts upgradeable (#2660)

**Motivation**

<!-- Why does this pull request exist? What are its goals? -->
We want the L1 contracts to be upgradeable so it's possible to fix bugs
and introduce new features.

**Description**

<!-- A clear and concise general description of the changes this PR
introduces -->
Changed the contracts to follow the UUPS proxy pattern (from
OpenZeppelin's library). The deployer binary now deploys both the
implementation and the proxy.

<!-- Link to issues: Resolves #111, Resolves #222 -->

Author: ManuelBilbao

crates/l2/Makefile

@@ -120,6 +120,8 @@ deploy-l1: ## 📜 Deploys the L1 contracts
 	--sp1.verifier-address 0x00000000000000000000000000000000000000aa \
 	--pico.verifier-address 0x00000000000000000000000000000000000000aa \
 	--risc0.verifier-address 0x00000000000000000000000000000000000000aa \
+	--on-chain-proposer-owner 0x03d0a0aee676cc45bf7032649e0871927c947c8e \
+	--bridge-owner 0x03d0a0aee676cc45bf7032649e0871927c947c8e \
 	--deposit-rich
 
 ## Same as deploy-l1 but does not do deposits for rich accounts since that doesn't make sense for deployments to devnets/testnets i.e Sepolia

crates/l2/contracts/README.md

@@ -0,0 +1,22 @@
+# Ethrex L2 contracts
+
+There are two L1 contracts: OnChainProposer and CommonBridge. Both contracts are deployed using UUPS proxies, so they are upgradeables.
+
+### Upgrade the contracts
+
+To upgrade a contract, you have to create the new contract and, as the original one, inherit from OpenZeppelin's `UUPSUpgradeable`. Make sure to implement the `_authorizeUpgrade` function and follow the [proxy pattern restrictions](https://docs.openzeppelin.com/upgrades-plugins/writing-upgradeable).
+
+Once you have the new contract, you need to do the following two steps:
+
+1. Deploy the new contract
+  ```sh
+  rex deploy <NEW_IMPLEMENTATION_BYTECODE> 0 <DEPLOYER_PRIVATE_KEY>
+  ```
+2. Upgrade the proxy by calling the method `upgradeToAndCall(address newImplementation, bytes memory data)`. The `data` parameter is the calldata to call on the new implementation as an initialization, you can pass an empty stream.
+  ```sh
+  rex send <PROXY_ADDRESS> 0 <PRIVATE_KEY> -- 'upgradeToAndCall(address,bytes)' 0 <NEW_IMPLEMENTATION_ADDRESS> <INITIALIZATION_CALLDATA>
+  ```
+3. Check the proxy updated the pointed address to the new implementation. It should return the address of the new implementation:
+  ```sh
+  curl http://localhost:8545 -d '{"jsonrpc": "2.0", "id": "1", "method": "eth_getStorageAt", "params": [<PROXY_ADDRESS>, "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc", "latest"]}'
+  ```

crates/l2/contracts/bin/deployer/cli.rs

@@ -205,6 +205,22 @@ pub struct DeployerOptions {
         help = "If set to true, initializes the committer in validium mode."
     )]
     pub validium: bool,
+    #[arg(
+        long,
+        value_name = "ADDRESS",
+        env = "ETHREX_ON_CHAIN_PROPOSER_OWNER",
+        help_heading = "Deployer options",
+        help = "Address of the owner of the OnChainProposer contract, who can upgrade the contract."
+    )]
+    pub on_chain_proposer_owner: Address,
+    #[arg(
+        long,
+        value_name = "ADDRESS",
+        env = "ETHREX_BRIDGE_OWNER",
+        help_heading = "Deployer options",
+        help = "Address of the owner of the CommonBridge contract, who can upgrade the contract."
+    )]
+    pub bridge_owner: Address,
 }
 
 impl Default for DeployerOptions {
@@ -258,6 +274,16 @@ impl Default for DeployerOptions {
             sp1_deploy_verifier: false,
             randomize_contract_deployment: false,
             validium: false,
+            // 0x03d0a0aee676cc45bf7032649e0871927c947c8e
+            on_chain_proposer_owner: H160([
+                0x03, 0xd0, 0xa0, 0xae, 0xe6, 0x76, 0xcc, 0x45, 0xbf, 0x70, 0x32, 0x64, 0x9e, 0x08,
+                0x71, 0x92, 0x7c, 0x94, 0x7c, 0x8e,
+            ]),
+            // 0x03d0a0aee676cc45bf7032649e0871927c947c8e
+            bridge_owner: H160([
+                0x03, 0xd0, 0xa0, 0xae, 0xe6, 0x76, 0xcc, 0x45, 0xbf, 0x70, 0x32, 0x64, 0x9e, 0x08,
+                0x71, 0x92, 0x7c, 0x94, 0x7c, 0x8e,
+            ]),
         }
     }
 }

crates/l2/contracts/bin/deployer/main.rs

@@ -15,7 +15,8 @@ use ethrex_common::{Address, U256};
 use ethrex_l2::utils::test_data_io::read_genesis_file;
 use ethrex_l2_sdk::{
     calldata::{encode_calldata, Value},
-    compile_contract, deploy_contract, get_address_from_secret_key, initialize_contract,
+    compile_contract, deploy_contract, deploy_with_proxy, get_address_from_secret_key,
+    initialize_contract,
 };
 use ethrex_rpc::{
     clients::{eth::BlockByNumber, EthClientError, Overrides},
@@ -28,8 +29,8 @@ mod cli;
 mod error;
 
 const INITIALIZE_ON_CHAIN_PROPOSER_SIGNATURE: &str =
-    "initialize(address,address,address,address,address[])";
-const BRIDGE_INITIALIZER_SIGNATURE: &str = "initialize(address)";
+    "initialize(bool,address,address,address,address,address,address[])";
+const BRIDGE_INITIALIZER_SIGNATURE: &str = "initialize(address,address)";
 
 #[tokio::main]
 async fn main() -> Result<(), DeployerError> {
@@ -88,12 +89,13 @@ fn download_contract_deps(opts: &DeployerOptions) -> Result<(), DeployerError> {
     })?;
 
     git_clone(
-        "https://github.com/OpenZeppelin/openzeppelin-contracts.git",
+        "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable.git",
         opts.contracts_path
-            .join("lib/openzeppelin-contracts")
+            .join("lib/openzeppelin-contracts-upgradeable")
             .to_str()
             .ok_or(DeployerError::FailedToGetStringFromPath)?,
         None,
+        true,
     )?;
 
     git_clone(
@@ -103,6 +105,7 @@ fn download_contract_deps(opts: &DeployerOptions) -> Result<(), DeployerError> {
             .to_str()
             .ok_or(DeployerError::FailedToGetStringFromPath)?,
         None,
+        false,
     )?;
 
     git_clone(
@@ -112,6 +115,7 @@ fn download_contract_deps(opts: &DeployerOptions) -> Result<(), DeployerError> {
             .to_str()
             .ok_or(DeployerError::FailedToGetStringFromPath)?,
         Some("evm"),
+        false,
     )?;
 
     Ok(())
@@ -121,6 +125,7 @@ pub fn git_clone(
     repository_url: &str,
     outdir: &str,
     branch: Option<&str>,
+    submodules: bool,
 ) -> Result<ExitStatus, DeployerError> {
     let mut git_cmd = Command::new("git");
 
@@ -130,6 +135,10 @@ pub fn git_clone(
         git_clone_cmd.arg("--branch").arg(branch);
     }
 
+    if submodules {
+        git_clone_cmd.arg("--recurse-submodules");
+    }
+
     git_clone_cmd
         .arg(outdir)
         .spawn()
@@ -139,6 +148,7 @@ pub fn git_clone(
 }
 
 fn compile_contracts(opts: &DeployerOptions) -> Result<(), DeployerError> {
+    compile_contract(&opts.contracts_path, "lib/openzeppelin-contracts-upgradeable/lib/openzeppelin-contracts/contracts/proxy/ERC1967/ERC1967Proxy.sol", false)?;
     compile_contract(&opts.contracts_path, "src/l1/OnChainProposer.sol", false)?;
     compile_contract(&opts.contracts_path, "src/l1/CommonBridge.sol", false)?;
     compile_contract(
@@ -179,41 +189,48 @@ async fn deploy_contracts(
             .to_vec()
     };
 
-    let (on_chain_proposer_deployment_tx_hash, on_chain_proposer_address) = deploy_contract(
-        &[&[0u8; 31][..], &[u8::from(opts.validium)]].concat(),
-        &opts.contracts_path.join("solc_out/OnChainProposer.bin"),
-        &opts.private_key,
-        &salt,
+    let on_chain_proposer_deployment = deploy_with_proxy(
+        opts.private_key,
         eth_client,
+        &opts.contracts_path.join("solc_out"),
+        "OnChainProposer.bin",
+        &salt,
     )
     .await?;
 
     spinner.success(&format!(
-        "OnChainProposer:\n\tDeployed at address {}\n\tWith tx hash {}",
-        format!("{on_chain_proposer_address:#x}").bright_green(),
-        format!("{on_chain_proposer_deployment_tx_hash:#x}").bright_cyan()
+        r#"OnChainProposer:
+    Deployed implementation at address {}
+    With tx hash {},
+    Deployed proxy at address {}
+    With tx hash {}"#,
+        format!("{:#x}", on_chain_proposer_deployment.implementation_address).bright_green(),
+        format!("{:#x}", on_chain_proposer_deployment.implementation_tx_hash).bright_cyan(),
+        format!("{:#x}", on_chain_proposer_deployment.proxy_address).bright_green(),
+        format!("{:#x}", on_chain_proposer_deployment.proxy_tx_hash).bright_cyan()
     ));
 
     let mut spinner = Spinner::new(deploy_frames.clone(), "Deploying CommonBridge", Color::Cyan);
-    let (bridge_deployment_tx_hash, bridge_address) = deploy_contract(
-        &{
-            let deployer_address = get_address_from_secret_key(&opts.private_key)?;
-            let offset = 32 - deployer_address.as_bytes().len() % 32;
-            let mut encoded_owner = vec![0; offset];
-            encoded_owner.extend_from_slice(deployer_address.as_bytes());
-            encoded_owner
-        },
-        &opts.contracts_path.join("solc_out/CommonBridge.bin"),
-        &opts.private_key,
-        &salt,
+
+    let bridge_deployment = deploy_with_proxy(
+        opts.private_key,
         eth_client,
+        &opts.contracts_path.join("solc_out"),
+        "CommonBridge.bin",
+        &salt,
     )
     .await?;
 
     spinner.success(&format!(
-        "CommonBridge:\n\tDeployed at address {}\n\tWith tx hash {}",
-        format!("{bridge_address:#x}").bright_green(),
-        format!("{bridge_deployment_tx_hash:#x}").bright_cyan(),
+        r#"CommonBridge:
+    Deployed implementation at address {}
+    With tx hash {},
+    Deployed proxy at address {}
+    With tx hash {}"#,
+        format!("{:#x}", bridge_deployment.implementation_address).bright_green(),
+        format!("{:#x}", bridge_deployment.implementation_tx_hash).bright_cyan(),
+        format!("{:#x}", bridge_deployment.proxy_address).bright_green(),
+        format!("{:#x}", bridge_deployment.proxy_tx_hash).bright_cyan()
     ));
 
     let sp1_verifier_address = if opts.sp1_deploy_verifier {
@@ -273,8 +290,8 @@ async fn deploy_contracts(
             ))?;
 
     Ok((
-        on_chain_proposer_address,
-        bridge_address,
+        on_chain_proposer_deployment.proxy_address,
+        bridge_deployment.proxy_address,
         sp1_verifier_address,
         pico_verifier_address,
         risc0_verifier_address,
@@ -301,6 +318,8 @@ async fn initialize_contracts(
 
     let initialize_tx_hash = {
         let calldata_values = vec![
+            Value::Bool(opts.validium),
+            Value::Address(opts.on_chain_proposer_owner),
             Value::Address(bridge_address),
             Value::Address(risc0_verifier_address),
             Value::Address(sp1_verifier_address),
@@ -333,7 +352,10 @@ async fn initialize_contracts(
         Color::Cyan,
     );
     let initialize_tx_hash = {
-        let calldata_values = vec![Value::Address(on_chain_proposer_address)];
+        let calldata_values = vec![
+            Value::Address(opts.bridge_owner),
+            Value::Address(on_chain_proposer_address),
+        ];
         let bridge_initialization_calldata =
             encode_calldata(BRIDGE_INITIALIZER_SIGNATURE, &calldata_values)?;
 
@@ -403,7 +425,6 @@ async fn make_deposits(
         let overrides = Overrides {
             value: Some(value_to_deposit),
             from: Some(address),
-            gas_limit: Some(21000 * 5),
             max_fee_per_gas: Some(gas_price),
             max_priority_fee_per_gas: Some(gas_price),
             ..Overrides::default()

crates/l2/contracts/src/l1/CommonBridge.sol

@@ -1,14 +1,22 @@
 // SPDX-License-Identifier: MIT
 pragma solidity =0.8.29;
 
-import "../../lib/openzeppelin-contracts/contracts/access/Ownable.sol";
-import "../../lib/openzeppelin-contracts/contracts/utils/ReentrancyGuard.sol";
+import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
 import "./interfaces/ICommonBridge.sol";
 import "./interfaces/IOnChainProposer.sol";
 
 /// @title CommonBridge contract.
 /// @author LambdaClass
-contract CommonBridge is ICommonBridge, Ownable, ReentrancyGuard {
+contract CommonBridge is
+    ICommonBridge,
+    ReentrancyGuard,
+    Initializable,
+    UUPSUpgradeable,
+    OwnableUpgradeable
+{
     /// @notice Mapping of unclaimed withdrawals. A withdrawal is claimed if
     /// there is a non-zero value in the mapping (a merkle root) for the hash
     /// of the L2 transaction that requested the withdrawal.
@@ -45,10 +53,15 @@ contract CommonBridge is ICommonBridge, Ownable, ReentrancyGuard {
         _;
     }
 
-    constructor(address owner) Ownable(owner) {}
-
-    /// @inheritdoc ICommonBridge
-    function initialize(address onChainProposer) public nonReentrant {
+    /// @notice Initializes the contract.
+    /// @dev This method is called only once after the contract is deployed.
+    /// @dev It sets the OnChainProposer address.
+    /// @param owner the address of the owner who can perform upgrades.
+    /// @param onChainProposer the address of the OnChainProposer contract.
+    function initialize(
+        address owner,
+        address onChainProposer
+    ) public initializer {
         require(
             ON_CHAIN_PROPOSER == address(0),
             "CommonBridge: contract already initialized"
@@ -65,6 +78,8 @@ contract CommonBridge is ICommonBridge, Ownable, ReentrancyGuard {
 
         lastFetchedL1Block = block.number;
         depositId = 0;
+
+        OwnableUpgradeable.__Ownable_init(owner);
     }
 
     /// @inheritdoc ICommonBridge
@@ -248,4 +263,10 @@ contract CommonBridge is ICommonBridge, Ownable, ReentrancyGuard {
             withdrawalLeaf ==
             batchWithdrawalLogsMerkleRoots[withdrawalBatchNumber];
     }
+
+    /// @notice Allow owner to upgrade the contract.
+    /// @param newImplementation the address of the new implementation
+    function _authorizeUpgrade(
+        address newImplementation
+    ) internal virtual override onlyOwner {}
 }