Se

README.md

@@ -4,10 +4,6 @@
 
 A bridge between Base and blockchains outside the Ethereum ecosystem. Currently has support for Solana.
 
-> [!WARNING]
->
-> The bridge is only live on testnet between Solana Devnet <> Base Sepolia. The code is a WIP and has not yet been audited. Do not use in production!!
-
 <!-- Badge row 1 - status -->
 
 [![GitHub contributors](https://img.shields.io/github/contributors/base/bridge)](https://github.com/base/bridge/graphs/contributors)

SECURITY.md

@@ -0,0 +1,22 @@
+# Security
+
+## Bug bounty program
+
+In line with our strategy of being the safest way for users to access crypto:
+
++ Coinbase extended our [best-in-industry](https://www.coinbase.com/blog/celebrating-10-years-of-our-bug-bounty-program) million-dollar [HackerOne bug bounty program](https://hackerone.com/coinbase?type=team) to cover the Base network and Base infrastructure.
+
++ Coinbase has launched a 5 million-dollar [Cantina bug bounty program](https://cantina.xyz/code/55316f42-3c5e-4746-9bd0-0f18dcbc344b) to cover all deployed smart contracts for Base, and those used as part of Coinbase products and services.
+
+## Reporting vulnerabilities
+
+All potential vulnerability reports can be submitted via the following platforms:
+
+1. [**HackerOne**](https://hackerone.com/coinbase): For offchain components and services.
+   For more information on reporting vulnerabilities and our HackerOne bug bounty program, view our [security program policies](https://hackerone.com/coinbase?view_policy=true).
+
+2. [**Cantina**](https://cantina.xyz/bounties/55316f42-3c5e-4746-9bd0-0f18dcbc344b): For deployed smart contracts.
+   For more information on what smart contracts are considered within the scope of the Cantina bug bounty program, view our [Tier 0](https://cantina.xyz/code/55316f42-3c5e-4746-9bd0-0f18dcbc344b/overview?overviewTab=1&assetGroup=0) and [Tier 1](https://cantina.xyz/code/55316f42-3c5e-4746-9bd0-0f18dcbc344b/overview?overviewTab=1&assetGroup=1) scope guides.
+
+
+For all other security related inquiries, please reach out to [[email protected]](mailto:[email protected]).

base/Makefile

@@ -1,34 +1,93 @@
 -include .env
 
-BASE_RPC=https://base-sepolia.cbhq.net
-# BASE_RPC=https://mainnet.base.org
-
-# Update values in this section to specify token recipients / token amount
-####################################################################################################
-# alpha or prod
-ENV_NAME=alpha
-
-SOLANA_SOL_RECEIVER = 0x9827993b7b317eb6c74279d49074a13b33a3495a30637c86a7513922014ba424
-USER_SPL_ATA = 0x6621d2d930ef7ada6260d3e0a5679a8fe81fde41262314f2efbf9c4c828550b1
-USER_REMOTE_ERC20_ATA = 0x4394d16902c022f8f87c7667429bc8b2860d033e316b9f9515534505fae314e9
-USER_REMOTE_ETH_ATA = 0x15e9307085f98b2e64eb3dd36b7fbafea201cc2a9fcb36c8c207e99bc7b97f30
-
-AMOUNT = 1000000000
-####################################################################################################
-
-BRIDGE = $(shell jq -r '.Bridge' deployments/base_sepolia_$(ENV_NAME).json)
-LOCAL_SOL = $(shell jq -r '.WrappedSOL' deployments/base_sepolia_$(ENV_NAME).json)
-REMOTE_SOL = $(shell jq -r '.RemoteSOL' deployments/base_sepolia_$(ENV_NAME).json)
-LOCAL_SPL = $(shell jq -r '.WrappedSPL' deployments/base_sepolia_$(ENV_NAME).json)
-REMOTE_SPL = $(shell jq -r '.RemoteSPL' deployments/base_sepolia_$(ENV_NAME).json)
-REMOTE_ERC20 = $(shell jq -r '.RemoteERC20' deployments/base_sepolia_$(ENV_NAME).json)
-REMOTE_ETH = $(shell jq -r '.RemoteETH' deployments/base_sepolia_$(ENV_NAME).json)
-
+# Environment mapping: ENV -> RPC URL, deployment file, BRIDGE_ENVIRONMENT
+# Usage: make <target> ENV={testnet-alpha|testnet-prod|mainnet}
+VALID_ENVS := testnet-alpha testnet-prod mainnet
+
+ifeq ($(ENV),testnet-alpha)
+  BASE_RPC := https://base-sepolia.cbhq.net
+  DEPLOYMENT_FILE := deployments/base_sepolia_alpha.json
+  BRIDGE_ENV := alpha
+else ifeq ($(ENV),testnet-prod)
+  BASE_RPC := https://base-sepolia.cbhq.net
+  DEPLOYMENT_FILE := deployments/base_sepolia_prod.json
+  BRIDGE_ENV := prod
+else ifeq ($(ENV),mainnet)
+  BASE_RPC := https://mainnet.base.org
+  DEPLOYMENT_FILE := deployments/base_mainnet.json
+  BRIDGE_ENV := mainnet
+endif
+
+ifndef LEDGER_ACCOUNT
+override LEDGER_ACCOUNT = 0
+endif
+
+# Recipient addresses and amount (override via make args or env vars)
+SOLANA_SOL_RECEIVER ?= 0x6e0019e37547b086395a9a6834f731bab5b631004ac22a6c9102047301e40c77
+USER_SPL_ATA ?= 0xfc6697ab185712eed628c12e499a3f4c2d4f73ced9dcc6eab8658bea86adb0e7
+USER_REMOTE_ERC20_ATA ?= 0x7227267f49cac157705e1a5f7ac9f9933c902ae5368cbcc2a12e06d0566f826c
+USER_REMOTE_ETH_ATA ?= 0x3e506b04e88dab39a3687fc5eb822c18f8301fc09cfe945c3394fc6baf9aef25
+
+AMOUNT ?= 1000000000
+
+# Contract addresses (read from deployment file, only when ENV is set)
 LOCAL_ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE
-LOCAL_ERC20 = 0x62C1332822983B8412A6Ffda0fd77cd7d5733Ee9
 
-check:
-	@echo $(REMOTE_ERC20)
+ifdef DEPLOYMENT_FILE
+BRIDGE = $(shell jq -r '.Bridge' $(DEPLOYMENT_FILE))
+LOCAL_SOL = $(shell jq -r '.WrappedSOL' $(DEPLOYMENT_FILE))
+REMOTE_SOL = $(shell jq -r '.RemoteSOL' $(DEPLOYMENT_FILE))
+LOCAL_SPL = $(shell jq -r '.WrappedSPL' $(DEPLOYMENT_FILE))
+REMOTE_SPL = $(shell jq -r '.RemoteSPL' $(DEPLOYMENT_FILE))
+REMOTE_ERC20 = $(shell jq -r '.RemoteERC20' $(DEPLOYMENT_FILE))
+REMOTE_ETH = $(shell jq -r '.RemoteETH' $(DEPLOYMENT_FILE))
+LOCAL_ERC20 = $(shell jq -r '.LocalERC20' $(DEPLOYMENT_FILE))
+endif
+
+# Environment validation
+.PHONY: validate-env
+validate-env:
+ifndef ENV
+	$(error ENV is required. Usage: make <target> ENV={testnet-alpha|testnet-prod|mainnet})
+endif
+ifeq ($(filter $(ENV),$(VALID_ENVS)),)
+	$(error Invalid ENV='$(ENV)'. Must be one of: $(VALID_ENVS))
+endif
+
+.PHONY: help
+help:
+	@echo "Usage: make <target> ENV={testnet-alpha|testnet-prod|mainnet}"
+	@echo ""
+	@echo "Environments:"
+	@echo "  testnet-alpha  Base Sepolia (alpha deployment)"
+	@echo "  testnet-prod   Base Sepolia (prod deployment)"
+	@echo "  mainnet        Base Mainnet"
+	@echo ""
+	@echo "Bridge targets (require ENV):"
+	@echo "  bridge-sol-to-solana    Bridge wrapped SOL to Solana"
+	@echo "  bridge-spl-to-solana    Bridge wrapped SPL to Solana"
+	@echo "  bridge-erc20-to-solana  Bridge ERC20 to Solana"
+	@echo "  bridge-eth-to-solana    Bridge ETH to Solana"
+	@echo ""
+	@echo "Deployment targets (require ENV):"
+	@echo "  deploy                  Deploy bridge contracts"
+	@echo "  upgrade                 Upgrade bridge contracts"
+	@echo "  create-wrapped-spl      Create wrapped SPL token"
+	@echo "  create-mock-token       Deploy a mock ERC20"
+	@echo ""
+	@echo "Query targets (require ENV):"
+	@echo "  check-root              Check the bridge root"
+	@echo "  check-count             Check the bridge message count"
+	@echo ""
+	@echo "Other targets:"
+	@echo "  deps                    Install forge dependencies"
+	@echo "  bindings                Generate Go bindings"
+	@echo "  coverage                Run test coverage"
+	@echo ""
+	@echo "Overridable variables:"
+	@echo "  AMOUNT                  Token amount (default: 1000000000)"
+	@echo "  SOLANA_SOL_RECEIVER     SOL recipient address"
+	@echo "  LEDGER_ACCOUNT          Ledger HD account index (default: 0)"
 
 .PHONY: deps
 deps: clean-lib forge-deps
@@ -55,70 +114,63 @@ bindings:
 coverage:
 	@ forge coverage --no-match-coverage "(script|test)"
 
-.PHONY: dev-deploy
-dev-deploy: deploy create-wrapped-sol create-wrapped-spl
-
 .PHONY: deploy
-deploy:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) forge script DeployScript --account testnet-admin --rpc-url $(BASE_RPC) --sender $(shell cast wallet address --account testnet-admin) --broadcast -vvvv
+deploy: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) forge script DeployScript --account testnet-admin --rpc-url $(BASE_RPC) --sender $(shell cast wallet address --account testnet-admin) --broadcast -vvvv
 
 .PHONY: upgrade
-upgrade:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) forge script UpgradeScript --account testnet-upgrade --rpc-url $(BASE_RPC) --broadcast -vvvv
-
-.PHONY: create-wrapped-sol
-create-wrapped-sol:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) TOKEN_NAME=WrappedSOL TOKEN_SYMBOL=wSOL REMOTE_TOKEN=$(REMOTE_SOL) forge script CreateTokenScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+upgrade: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) forge script UpgradeScript --account testnet-upgrade --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: create-wrapped-spl
-create-wrapped-spl:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) TOKEN_NAME=WrappedSPL TOKEN_SYMBOL=wSPL REMOTE_TOKEN=$(REMOTE_SPL) forge script CreateTokenScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+create-wrapped-spl: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) TOKEN_NAME=WrappedSPL TOKEN_SYMBOL=wSPL REMOTE_TOKEN=$(REMOTE_SPL) TOKEN_DECIMALS=9 forge script CreateTokenScript --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: create-mock-token
-create-mock-token:
-	ADMIN=$(shell cast wallet address --account testnet-admin) forge script DeployERC20 --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+create-mock-token: validate-env
+	ADMIN=0x644e3DedB0e4F83Bfcf8F9992964d240224B74dc forge script DeployERC20 --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: bridge-sol-to-solana
-bridge-sol-to-solana:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) \
+bridge-sol-to-solana: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) \
 	LOCAL_TOKEN=$(LOCAL_SOL) \
 	REMOTE_TOKEN=$(REMOTE_SOL) \
 	TO=$(SOLANA_SOL_RECEIVER) \
 	AMOUNT=$(AMOUNT) \
-	forge script BridgeTokensToSolanaScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+	forge script BridgeTokensToSolanaScript --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: bridge-spl-to-solana
-bridge-spl-to-solana:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) \
+bridge-spl-to-solana: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) \
 	LOCAL_TOKEN=$(LOCAL_SPL) \
 	REMOTE_TOKEN=$(REMOTE_SPL) \
 	TO=$(USER_SPL_ATA) \
 	AMOUNT=$(AMOUNT) \
-	forge script BridgeTokensToSolanaScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+	forge script BridgeTokensToSolanaScript --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: bridge-erc20-to-solana
-bridge-erc20-to-solana:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) \
+bridge-erc20-to-solana: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) \
 	LOCAL_TOKEN=$(LOCAL_ERC20) \
 	REMOTE_TOKEN=$(REMOTE_ERC20) \
 	TO=$(USER_REMOTE_ERC20_ATA) \
 	AMOUNT=$(AMOUNT) \
 	NEEDS_APPROVAL=true \
-	forge script BridgeTokensToSolanaScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+	forge script BridgeTokensToSolanaScript --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: bridge-eth-to-solana
-bridge-eth-to-solana:
-	BRIDGE_ENVIRONMENT=$(ENV_NAME) \
+bridge-eth-to-solana: validate-env
+	BRIDGE_ENVIRONMENT=$(BRIDGE_ENV) \
 	LOCAL_TOKEN=$(LOCAL_ETH) \
 	REMOTE_TOKEN=$(REMOTE_ETH) \
 	TO=$(USER_REMOTE_ETH_ATA) \
 	AMOUNT=$(AMOUNT) \
-	forge script BridgeTokensToSolanaScript --account testnet-admin --rpc-url $(BASE_RPC) --broadcast -vvvv
+	forge script BridgeTokensToSolanaScript --ledger --hd-paths "m/44'/60'/$(LEDGER_ACCOUNT)'/0/0" --rpc-url $(BASE_RPC) --broadcast -vvvv
 
 .PHONY: check-root
-check-root:
-	@ cast call $(BRIDGE) "getRoot()" --rpc-url https://base-sepolia-dev.cbhq.net:8545
+check-root: validate-env
+	@ cast call $(BRIDGE) "getRoot()" --rpc-url $(BASE_RPC)
 
 .PHONY: check-count
-check-count:
-	@ cast call 0xCdfe10f911eD5039E031D6a7be3a0F97fA061C38 "count()" --rpc-url https://base-sepolia-dev.cbhq.net:8545
+check-count: validate-env
+	@ cast call $(BRIDGE) "count()" --rpc-url $(BASE_RPC)

base/README.md

@@ -4,6 +4,7 @@ A cross-chain bridge implementation that enables seamless message passing and to
 
 ## Contract Addresses
 
+- **Base Mainnet Bridge**: `0x3eff766C76a1be2Ce1aCF2B69c78bCae257D5188`
 - **Base Sepolia Bridge**: `0x01824a90d32A69022DdAEcC6C5C14Ed08dB4EB9B`
 
 ## Overview

base/deployments/base_mainnet.json

@@ -0,0 +1,14 @@
+{
+  "Bridge": "0x3eff766C76a1be2Ce1aCF2B69c78bCae257D5188",
+  "BridgeValidator": "0xAF24c1c24Ff3BF1e6D882518120fC25442d6794B",
+  "CrossChainERC20Factory": "0xDD56781d0509650f8C2981231B6C917f2d5d7dF2",
+  "Twin": "0xb326c02150bb0De265Bb0eCeDA53531ab0163bf6",
+  "RelayerOrchestrator": "0x8Cfa6F29930E6310B6074baB0052c14a709B4741",
+  "RemoteSOL": "0x069be72ab836d4eacc02525b7350a78a395da2f1253a40ebafd6630000000000",
+  "RemoteSPL": "",
+  "RemoteERC20": "",
+  "RemoteETH": "",
+  "WrappedSOL": "0x311935Cd80B76769bF2ecC9D8Ab7635b2139cf82",
+  "WrappedSPL": "",
+  "LocalERC20": "0x4870D23984Dd663005EB8E2b616e4Ef62630183c"
+}

base/deployments/base_sepolia_alpha.json

@@ -1,13 +1,14 @@
 {
-  "Bridge": "0x91a5d5A71bC3Bd7a835050ED4A337B95De0Ae757",
-  "BridgeValidator": "0xBc540a534A6DE9Cb1B40b44bf3ABC6CdcE1C1eb1",
+  "Bridge": "0x64567a9147fa89B1edc987e36Eb6f4b6db71656b",
+  "BridgeValidator": "0xC05324843aca6C2b7446F15bdB17AF4599b761E6",
   "CrossChainERC20Factory": "0x8316DEBfdc3093DfFb10233B76F32481b7386950",
   "Twin": "0xc98727c438237BC7ABf0A1A9Ff25C74bAdcf9d11",
-  "RelayerOrchestrator": "0x5D988c61086839CeBd9eC714F3A6E23E0F05098F",
+  "RelayerOrchestrator": "0xfDa0B31c24316CA01DAa9d3E741729884C1e2ab8",
   "RemoteSOL": "0x069be72ab836d4eacc02525b7350a78a395da2f1253a40ebafd6630000000000",
   "RemoteSPL": "0x6ccf56ff18093bc61462cd67c8aa86216fbad049e41d9bffa0856e5f34af5498",
   "RemoteERC20": "0xba6a03ad9fe4921c8a5a4e8d3ef0a8d76ac6137ea1213879512abc24c6ab4376",
   "RemoteETH": "0x79f4f1fa82df5ae874eaff38c8288c15a0317eab263a6a2f4ed32ca9224ba62c",
-  "WrappedSOL": "0xC50EA8CAeDaE290FE4edA770b10aDEfc41CD698e",
-  "WrappedSPL": "0xCf8e666c57651670AA7266Aba3E334E3600B2306"
-}
+  "WrappedSOL": "0x003512146Fd54b71f926C7Fd4B7bd20Fc84E22c5",
+  "WrappedSPL": "0x80351342c4dd23C78c0837C640E041a239e67cD8",
+  "LocalERC20": "0x62C1332822983B8412A6Ffda0fd77cd7d5733Ee9"
+}

base/deployments/base_sepolia_prod.json

@@ -9,5 +9,6 @@
   "RemoteERC20": "0xc7cfe164b0b61064d6f23734f906c8141788be442d94495852d8af53b40e3212",
   "RemoteETH": "0xcb3d6f70c63eee106144cdf6cf934901b684be88171380e87a3f8d03f720a185",
   "WrappedSOL": "0xCace0c896714DaF7098FFD8CC54aFCFe0338b4BC",
-  "WrappedSPL": "0x955C7356776F9304feD38ed5AeC5699436C7C614"
+  "WrappedSPL": "0x955C7356776F9304feD38ed5AeC5699436C7C614",
+  "LocalERC20": "0x62C1332822983B8412A6Ffda0fd77cd7d5733Ee9"
 }

base/deployments/template.json

@@ -9,5 +9,6 @@
   "WrappedSOL": "",
   "WrappedSPL": "",
   "RemoteERC20": "",
-  "RemoteETH": ""
+  "RemoteETH": "",
+  "LocalERC20": ""
 }

base/script/actions/CreateToken.s.sol

@@ -13,6 +13,7 @@ contract CreateTokenScript is DevOps {
     using LibString for string;
 
     bytes32 public immutable REMOTE_TOKEN = vm.envBytes32("REMOTE_TOKEN");
+    uint8 public immutable TOKEN_DECIMALS = uint8(vm.envUint("TOKEN_DECIMALS"));
     string public tokenName = vm.envString("TOKEN_NAME");
     string public tokenSymbol = vm.envString("TOKEN_SYMBOL");
 
@@ -25,7 +26,7 @@ contract CreateTokenScript is DevOps {
     function run() public {
         vm.startBroadcast();
         address token = crossChainErc20Factory.deploy({
-            remoteToken: REMOTE_TOKEN, name: tokenName, symbol: tokenSymbol, decimals: 9
+            remoteToken: REMOTE_TOKEN, name: tokenName, symbol: tokenSymbol, decimals: TOKEN_DECIMALS
         });
         console.log("Deployed Token at: %s", token);
         vm.stopBroadcast();

scripts/README.md

@@ -2,6 +2,10 @@
 
 Interactive command-line interface for managing the Base-Solana bridge operations.
 
+> [!WARNING]
+>
+> The scripts in this directory are for example purposes only and have not been audited. Use at your own risk.
+
 ## Setup
 
 ```bash

scripts/src/commands/sol/bridge/base-to-solana/prove-message.handler.ts

@@ -13,7 +13,7 @@ import {
   type Address,
   type Hash,
 } from "viem";
-import { baseSepolia } from "viem/chains";
+import { base, baseSepolia } from "viem/chains";
 import { decodeEventLog } from "viem/utils";
 
 import { fetchBridge, getProveMessageInstruction } from "@base/bridge/bridge";
@@ -25,7 +25,7 @@ import {
   getKeypairSignerFromPath,
   getIdlConstant,
 } from "@internal/sol";
-import { CONFIGS, DEPLOY_ENVS } from "@internal/constants";
+import { CONFIGS, DEPLOY_ENVS, type Config } from "@internal/constants";
 import { BRIDGE_ABI } from "@internal/base/abi";
 
 export const argsSchema = z.object({
@@ -82,6 +82,7 @@ export async function handleProveMessage(args: Args) {
     logger.info(`Output Root: ${outputRootAddress}`);
 
     const { event, rawProof } = await generateProof(
+      config,
       args.transactionHash as Hash,
       baseBlockNumber,
       config.base.bridgeContract
@@ -138,12 +139,13 @@ export async function handleProveMessage(args: Args) {
 }
 
 async function generateProof(
+  cfg: Config,
   transactionHash: Hash,
   bridgeBaseBlockNumber: bigint,
   baseBridgeAddress: Address
 ) {
   const publicClient = createPublicClient({
-    chain: baseSepolia,
+    chain: cfg.base.chain,
     transport: http(),
   });
 

scripts/src/commands/sol/bridge/index.ts

@@ -5,6 +5,7 @@ import { solVaultCommand } from "./sol-vault.command";
 import {
   bridgeCallCommand,
   bridgeSolCommand,
+  bridgeSolWithBcCommand,
   bridgeSplCommand,
   bridgeWrappedTokenCommand,
   wrapTokenCommand,
@@ -20,6 +21,7 @@ bridgeCommand.addCommand(solVaultCommand);
 
 bridgeCommand.addCommand(bridgeCallCommand);
 bridgeCommand.addCommand(bridgeSolCommand);
+bridgeCommand.addCommand(bridgeSolWithBcCommand);
 bridgeCommand.addCommand(bridgeSplCommand);
 bridgeCommand.addCommand(bridgeWrappedTokenCommand);
 bridgeCommand.addCommand(wrapTokenCommand);