feat(token-price-oracle): add multi-source price feeds

node/derivation/config.go

@@ -108,8 +108,11 @@ func DefaultConfig() *Config {
 			// tag: 10 blocks (~2 min on mainnet) keeps lag low, and the always-on
 			// L1 reorg detector (SPEC-005 §4.7.6 in reorg.go) rewinds the
 			// derivation cursor on hash mismatch so a deeper reorg is recoverable.
-			// Operators wanting strict no-reorg-possible reads can still set
-			// --derivation.confirmations=-3 (rpc.FinalizedBlockNumber).
+			// Applies to every verify mode. Layer1 validators derive their whole
+			// chain from L1, so a deeper default translates directly into head
+			// lag and into delayed batch-divergence alerts; deployments that
+			// want a consensus-backed read instead set
+			// --derivation.confirmations=-4 (safe) or -3 (finalized) explicitly.
 			Confirmations: DefaultConfirmations,
 		},
 		PollInterval:        DefaultPollInterval,
@@ -194,14 +197,6 @@ func (c *Config) SetCliContext(ctx *cli.Context) error {
 		c.MetricsPort = ctx.GlobalUint64(flags.MetricsPort.Name)
 	}
 
-	// Layer1-verify validators historically derived only from finalized L1 data
-	// (the pre-centralized-sequencer default). Preserve that: unless the operator
-	// explicitly set --derivation.confirmations, a layer1 node reads finalized
-	// rather than the fixed-depth latest-N default that consensus fullnodes use.
-	if c.VerifyMode == VerifyModeLayer1 && !ctx.GlobalIsSet(flags.DerivationConfirmations.Name) {
-		c.L1.Confirmations = rpc.FinalizedBlockNumber
-	}
-
 	if ctx.GlobalIsSet(flags.DerivationReorgCheckDepth.Name) {
 		c.ReorgCheckDepth = ctx.GlobalUint64(flags.DerivationReorgCheckDepth.Name)
 	}

node/derivation/reorg.go

@@ -20,11 +20,10 @@ import (
 // derivation cursor + clears stale records.
 //
 // This is always-on regardless of the --derivation.confirmations setting.
-// When confirmations=finalized (default), L1 finalized doesn't reorg by
-// Ethereum consensus assumption, so detectReorg's fast path always returns
-// (no reorg) at one L1 RPC per poll. When confirmations is configured below
-// finalized (e.g. safe), detection becomes load-bearing without any code
-// path divergence.
+// At the fixed-depth default it is load-bearing; when an operator sets
+// confirmations=finalized, L1 finalized doesn't reorg by Ethereum consensus
+// assumption, so detectReorg's fast path always returns (no reorg) at one L1
+// RPC per poll. Neither case diverges in code path.
 //
 // L1 reorg does NOT directly trigger an L2 chain rollback in this PR. The
 // L2 rollback executor (verifyBlockContext + halted state machine +

node/flags/flags.go

@@ -292,7 +292,7 @@ var (
 
 	DerivationConfirmations = cli.Int64Flag{
 		Name:   "derivation.confirmations",
-		Usage:  "The number of confirmations needed on L1 for finalization. If not set, the default value is l1.confirmations",
+		Usage:  "How deep derivation reads L1: a positive number is a fixed depth below latest, -1 latest, -3 finalized, -4 safe. Applies to every verify mode; defaults to 10 blocks paired with the L1 reorg detector",
 		EnvVar: prefixEnvVar("DERIVATION_CONFIRMATIONS"),
 	}
 

ops/l2-genesis/morph-chain-ops/genesis/devnet_tokens.go

@@ -0,0 +1,209 @@
+package genesis
+
+import (
+	"fmt"
+	"math/big"
+
+	"github.com/morph-l2/go-ethereum/common"
+	"github.com/morph-l2/go-ethereum/core/vm"
+	"github.com/morph-l2/go-ethereum/crypto"
+	"github.com/morph-l2/go-ethereum/log"
+
+	"morph-l2/bindings/predeploys"
+)
+
+// DevnetTestToken defines a test token to be pre-registered in TokenRegistry for devnet.
+type DevnetTestToken struct {
+	TokenID      uint16
+	TokenAddress common.Address
+	BalanceSlot  common.Hash
+	// NeedBalanceSlot mirrors the flag L2TokenRegistry.registerToken takes. It is
+	// required because a zero BalanceSlot is ambiguous on its own: slot 0 is where
+	// OpenZeppelin ERC-20 puts _balances, so it cannot double as "no slot".
+	NeedBalanceSlot bool
+	Decimals        uint8
+	// Scale must be 10^Decimals, matching how L2TokenRegistry's own tests register
+	// USDC (1e6) and DAI (1e18). Scale cancels out of calculateTokenAmount, so its
+	// only job is to keep priceRatio from losing significant digits: the oracle
+	// computes scale * (tokenPrice/ethPrice) * 10^(18-decimals) and truncates to an
+	// integer, and 10^Decimals is what makes that product settle at 10^18 *
+	// tokenPrice/ethPrice, i.e. the wei value of one whole token. Scale is *not* the
+	// decimals adjustment; the oracle already applies 10^(18-decimals) separately.
+	Scale *big.Int
+}
+
+// GetDevnetTestTokens returns the list of test tokens to pre-register in devnet.
+// Token 1: BTC - for testing high-value asset price queries (all data sources support)
+// Token 2: ETH - for testing gas token benchmark and relative price calculation
+// Token 3: BGB - for testing platform token and CEX-specific data sources
+func GetDevnetTestTokens() []DevnetTestToken {
+	return []DevnetTestToken{
+		{
+			TokenID: 1,
+			// Placeholder address for a token with no deployed contract. It must stay
+			// clear of the 0x01-0x0a precompile range, where balanceOf and transfer
+			// would dispatch to ecRecover and friends instead of failing.
+			TokenAddress:    common.HexToAddress("0x1111111111111111111111111111111111111111"), // Mock BTC address
+			NeedBalanceSlot: false,
+			Decimals:        8,
+			Scale:           big.NewInt(1e8),
+		},
+		{
+			TokenID:      2,
+			TokenAddress: common.HexToAddress("0x5300000000000000000000000000000000000011"), // L2WETH predeploy address
+			// WrappedEther keeps _balances at slot 0; slot 3 is _name.
+			BalanceSlot:     common.Hash{},
+			NeedBalanceSlot: true,
+			Decimals:        18,
+			Scale:           big.NewInt(1e18),
+		},
+		{
+			TokenID:         3,
+			TokenAddress:    common.HexToAddress("0x3333333333333333333333333333333333333333"), // Mock BGB address
+			NeedBalanceSlot: false,
+			Decimals:        18,
+			Scale:           big.NewInt(1e18),
+		},
+	}
+}
+
+// SetDevnetTestTokens pre-registers inactive test tokens in TokenRegistry storage for devnet.
+// The contract owner must activate the tokens and allow the oracle signer before price updates.
+func SetDevnetTestTokens(db vm.StateDB) error {
+	contractAddr := predeploys.L2TokenRegistryAddr
+	tokens := GetDevnetTestTokens()
+
+	// Storage layout reference (from L2TokenRegistry.sol):
+	// slot 151: mapping(uint16 => TokenInfo) tokenRegistry
+	// slot 152: mapping(address => uint16) tokenRegistration
+	// slot 153: mapping(uint16 => uint256) priceRatio
+	// slot 156: EnumerableSet.UintSet supportedTokenSet
+
+	tokenRegistrySlot := big.NewInt(151)
+	tokenRegistrationSlot := big.NewInt(152)
+	supportedTokenSetSlot := big.NewInt(156)
+
+	log.Info("Pre-registering devnet test tokens in TokenRegistry", "count", len(tokens))
+
+	for _, token := range tokens {
+		// Set tokenRegistry[tokenID] = TokenInfo{...}
+		// Storage location: keccak256(abi.encode(tokenID, 151))
+		if err := setTokenInfo(db, contractAddr, tokenRegistrySlot, token); err != nil {
+			return fmt.Errorf("failed to set tokenRegistry[%d]: %w", token.TokenID, err)
+		}
+
+		// Set tokenRegistration[tokenAddress] = tokenID
+		// Storage location: keccak256(abi.encode(tokenAddress, 152))
+		if err := setTokenRegistration(db, contractAddr, tokenRegistrationSlot, token.TokenAddress, token.TokenID); err != nil {
+			return fmt.Errorf("failed to set tokenRegistration[%s]: %w", token.TokenAddress.Hex(), err)
+		}
+
+		log.Info("Pre-registered devnet token",
+			"tokenID", token.TokenID,
+			"address", token.TokenAddress.Hex(),
+			"decimals", token.Decimals,
+			"scale", token.Scale.String())
+	}
+
+	// Set supportedTokenSet (EnumerableSet.UintSet)
+	if err := setSupportedTokenSet(db, contractAddr, supportedTokenSetSlot, tokens); err != nil {
+		return fmt.Errorf("failed to set supportedTokenSet: %w", err)
+	}
+
+	log.Info("Devnet test tokens pre-registered successfully", "tokenIDs", []uint16{1, 2, 3})
+	return nil
+}
+
+// setTokenInfo sets a TokenInfo struct in the tokenRegistry mapping.
+func setTokenInfo(db vm.StateDB, contractAddr common.Address, registrySlot *big.Int, token DevnetTestToken) error {
+	// Calculate base slot: keccak256(abi.encode(tokenID, registrySlot))
+	tokenIDBytes := common.LeftPadBytes(big.NewInt(int64(token.TokenID)).Bytes(), 32)
+	slotBytes := common.LeftPadBytes(registrySlot.Bytes(), 32)
+	baseSlot := crypto.Keccak256Hash(append(tokenIDBytes, slotBytes...))
+
+	// TokenInfo struct layout:
+	// slot+0: tokenAddress (address, 20 bytes)
+	// slot+1: stored balanceSlot (actual slot + 1 when non-zero)
+	// slot+2: isActive (bool, 1 byte) + decimals (uint8, 1 byte) in lowest 2 bytes
+	// slot+3: scale (uint256, 32 bytes)
+
+	// Slot+0: pack tokenAddress (20 bytes) into lowest bytes
+	slot0Value := new(big.Int).SetBytes(token.TokenAddress.Bytes())
+	db.SetState(contractAddr, baseSlot, common.BigToHash(slot0Value))
+
+	// Slot+1: mirror L2TokenRegistry._toStoredBalanceSlot, which stores the actual
+	// slot plus one when a slot is needed and zero when it is not.
+	storedBalanceSlot := common.Hash{}
+	if token.NeedBalanceSlot {
+		if token.BalanceSlot == common.HexToHash("0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff") {
+			return fmt.Errorf("balance slot cannot be max uint256")
+		}
+		storedBalanceSlot = common.BigToHash(new(big.Int).Add(token.BalanceSlot.Big(), common.Big1))
+	}
+	slot1Key := common.BigToHash(new(big.Int).Add(baseSlot.Big(), big.NewInt(1)))
+	db.SetState(contractAddr, slot1Key, storedBalanceSlot)
+
+	// Slot+2: isActive=false (0x00) + decimals (1 byte)
+	// Pack as: [31 zeros][decimals][isActive=0]
+	slot2Key := common.BigToHash(new(big.Int).Add(baseSlot.Big(), big.NewInt(2)))
+	slot2Value := new(big.Int).SetUint64(uint64(token.Decimals) << 8) // decimals in second byte
+	db.SetState(contractAddr, slot2Key, common.BigToHash(slot2Value))
+
+	// Slot+3: scale (uint256)
+	slot3Key := common.BigToHash(new(big.Int).Add(baseSlot.Big(), big.NewInt(3)))
+	db.SetState(contractAddr, slot3Key, common.BigToHash(token.Scale))
+
+	return nil
+}
+
+// setTokenRegistration sets the reverse mapping tokenRegistration[address] = tokenID.
+func setTokenRegistration(db vm.StateDB, contractAddr common.Address, registrationSlot *big.Int, tokenAddress common.Address, tokenID uint16) error {
+	// Calculate storage location: keccak256(abi.encode(tokenAddress, registrationSlot))
+	addrBytes := common.LeftPadBytes(tokenAddress.Bytes(), 32)
+	slotBytes := common.LeftPadBytes(registrationSlot.Bytes(), 32)
+	storageKey := crypto.Keccak256Hash(append(addrBytes, slotBytes...))
+
+	// Set tokenID as uint16 (2 bytes) in storage
+	tokenIDValue := new(big.Int).SetUint64(uint64(tokenID))
+	db.SetState(contractAddr, storageKey, common.BigToHash(tokenIDValue))
+
+	return nil
+}
+
+// setSupportedTokenSet sets EnumerableSet.UintSet for supported token IDs.
+func setSupportedTokenSet(db vm.StateDB, contractAddr common.Address, setBaseSlot *big.Int, tokens []DevnetTestToken) error {
+	// EnumerableSet.UintSet layout:
+	// struct UintSet {
+	//     Set _inner; // slot 156
+	// }
+	// struct Set {
+	//     bytes32[] _values;  // slot 156+0: array length at base slot, elements at keccak256(baseSlot)
+	//     mapping(bytes32 => uint256) _indexes; // slot 156+1: mapping base
+	// }
+
+	// Set _values array length (number of tokens)
+	lengthSlot := common.BigToHash(setBaseSlot)
+	db.SetState(contractAddr, lengthSlot, common.BigToHash(big.NewInt(int64(len(tokens)))))
+
+	// Calculate _values array storage location: keccak256(baseSlot)
+	valuesBaseSlot := crypto.Keccak256Hash(lengthSlot.Bytes())
+
+	// Set each token ID in _values array and _indexes mapping
+	for i, token := range tokens {
+		// Set _values[i] = tokenID (stored as bytes32/uint256)
+		elemSlot := common.BigToHash(new(big.Int).Add(valuesBaseSlot.Big(), big.NewInt(int64(i))))
+		tokenIDValue := new(big.Int).SetUint64(uint64(token.TokenID))
+		db.SetState(contractAddr, elemSlot, common.BigToHash(tokenIDValue))
+
+		// Set _indexes[tokenID] = i+1 (1-based index, 0 means not in set)
+		// Storage location: keccak256(abi.encode(tokenID, setBaseSlot+1))
+		indexesBaseSlot := new(big.Int).Add(setBaseSlot, big.NewInt(1))
+		tokenIDBytes := common.LeftPadBytes(big.NewInt(int64(token.TokenID)).Bytes(), 32)
+		indexSlotBytes := common.LeftPadBytes(indexesBaseSlot.Bytes(), 32)
+		indexKey := crypto.Keccak256Hash(append(tokenIDBytes, indexSlotBytes...))
+		indexValue := new(big.Int).SetInt64(int64(i + 1)) // 1-based
+		db.SetState(contractAddr, indexKey, common.BigToHash(indexValue))
+	}
+
+	return nil
+}

ops/l2-genesis/morph-chain-ops/genesis/devnet_tokens_test.go

@@ -0,0 +1,116 @@
+package genesis
+
+import (
+	"math/big"
+	"testing"
+
+	"github.com/morph-l2/go-ethereum/common"
+	"github.com/morph-l2/go-ethereum/crypto"
+	"github.com/stretchr/testify/require"
+
+	"morph-l2/bindings/predeploys"
+	"morph-l2/morph-deployer/morph-chain-ops/state"
+)
+
+func TestSetDevnetTestTokensStorageLayout(t *testing.T) {
+	db := state.NewMemoryStateDB(nil)
+	contractAddr := predeploys.L2TokenRegistryAddr
+	db.CreateAccount(contractAddr)
+
+	require.NoError(t, SetDevnetTestTokens(db))
+
+	tokens := GetDevnetTestTokens()
+	registrySlot := big.NewInt(151)
+	registrationSlot := big.NewInt(152)
+	supportedSetSlot := big.NewInt(156)
+
+	require.Equal(t, common.BigToHash(big.NewInt(int64(len(tokens)))), db.GetState(contractAddr, common.BigToHash(supportedSetSlot)))
+
+	valuesBaseSlot := crypto.Keccak256Hash(common.BigToHash(supportedSetSlot).Bytes())
+	for i, token := range tokens {
+		baseSlot := mappingSlot(new(big.Int).SetUint64(uint64(token.TokenID)), registrySlot)
+
+		// These assertions mirror getTokenInfo(), including balance-slot decoding.
+		require.Equal(t, common.BytesToHash(token.TokenAddress.Bytes()), db.GetState(contractAddr, baseSlot))
+		storedBalanceSlot := db.GetState(contractAddr, offsetSlot(baseSlot, 1))
+		hasBalanceSlot := storedBalanceSlot != (common.Hash{})
+		require.Equal(t, token.NeedBalanceSlot, hasBalanceSlot)
+		if hasBalanceSlot {
+			actualBalanceSlot := common.BigToHash(new(big.Int).Sub(storedBalanceSlot.Big(), common.Big1))
+			require.Equal(t, token.BalanceSlot, actualBalanceSlot)
+		}
+
+		statusAndDecimals := db.GetState(contractAddr, offsetSlot(baseSlot, 2)).Big().Uint64()
+		require.Zero(t, statusAndDecimals&0xff, "tokens must start inactive")
+		require.Equal(t, uint64(token.Decimals), statusAndDecimals>>8)
+		require.Equal(t, common.BigToHash(token.Scale), db.GetState(contractAddr, offsetSlot(baseSlot, 3)))
+
+		// This mirrors getTokenIdByAddress().
+		reverseSlot := mappingSlot(new(big.Int).SetBytes(token.TokenAddress.Bytes()), registrationSlot)
+		require.Equal(t, common.BigToHash(new(big.Int).SetUint64(uint64(token.TokenID))), db.GetState(contractAddr, reverseSlot))
+
+		// These assertions mirror getSupportedIDList() and getSupportedTokenList().
+		valueSlot := offsetSlot(valuesBaseSlot, int64(i))
+		require.Equal(t, common.BigToHash(new(big.Int).SetUint64(uint64(token.TokenID))), db.GetState(contractAddr, valueSlot))
+		indexSlot := mappingSlot(new(big.Int).SetUint64(uint64(token.TokenID)), new(big.Int).Add(supportedSetSlot, common.Big1))
+		require.Equal(t, common.BigToHash(new(big.Int).SetInt64(int64(i+1))), db.GetState(contractAddr, indexSlot))
+	}
+}
+
+// TestDevnetTestTokenDefinitions pins the two properties that cannot be derived from
+// the encoding itself: WETH's balance slot is a real slot 0 rather than "no slot", and
+// the placeholder addresses stay out of the precompile range.
+func TestDevnetTestTokenDefinitions(t *testing.T) {
+	byID := make(map[uint16]DevnetTestToken)
+	for _, token := range GetDevnetTestTokens() {
+		byID[token.TokenID] = token
+	}
+
+	weth := byID[2]
+	require.Equal(t, predeploys.L2WETHAddr, weth.TokenAddress)
+	require.True(t, weth.NeedBalanceSlot, "WrappedEther keeps _balances at slot 0, which still needs to be registered")
+	require.Equal(t, common.Hash{}, weth.BalanceSlot)
+
+	lowestNonPrecompile := big.NewInt(0xff)
+	for _, token := range byID {
+		require.Positive(t, new(big.Int).SetBytes(token.TokenAddress.Bytes()).Cmp(lowestNonPrecompile),
+			"token %d address %s falls in the precompile range", token.TokenID, token.TokenAddress)
+
+		// A scale of 10^(18-decimals) reads plausibly but double-applies the decimals
+		// adjustment the oracle already makes, which collapses to 1 for an 18-decimal
+		// token and truncates every priceRatio below ETH to zero.
+		want := new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(token.Decimals)), nil)
+		require.Zero(t, want.Cmp(token.Scale),
+			"token %d scale must be 10^decimals, got %s", token.TokenID, token.Scale)
+	}
+}
+
+// TestDevnetTestTokenPriceRatioKeepsPrecision walks the oracle's priceRatio formula for
+// the cheapest pre-registered token. The registry stores priceRatio as a uint256, so a
+// scale that leaves the ratio below 1 makes the token permanently unpriceable.
+func TestDevnetTestTokenPriceRatioKeepsPrecision(t *testing.T) {
+	// BGB near its spot price against ETH, the widest token/ETH gap in the set.
+	tokenPriceUSD := big.NewFloat(1.5954)
+	ethPriceUSD := big.NewFloat(1845.55)
+
+	for _, token := range GetDevnetTestTokens() {
+		ratio := new(big.Float).SetInt(token.Scale)
+		ratio.Mul(ratio, tokenPriceUSD)
+		ratio.Mul(ratio, new(big.Float).SetInt(new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(18-token.Decimals)), nil)))
+		ratio.Quo(ratio, ethPriceUSD)
+
+		truncated, _ := ratio.Int(nil)
+		require.Positive(t, truncated.Sign(),
+			"token %d priceRatio truncates to zero with scale %s", token.TokenID, token.Scale)
+	}
+}
+
+func mappingSlot(key, slot *big.Int) common.Hash {
+	keyBytes := common.LeftPadBytes(key.Bytes(), 32)
+	slotBytes := common.LeftPadBytes(slot.Bytes(), 32)
+	return crypto.Keccak256Hash(append(keyBytes, slotBytes...))
+}
+
+func offsetSlot(base common.Hash, offset int64) common.Hash {
+	return common.BigToHash(new(big.Int).Add(base.Big(), big.NewInt(offset)))
+}

ops/l2-genesis/morph-chain-ops/genesis/layer_two.go

@@ -50,6 +50,15 @@ func BuildL2DeveloperGenesis(config *DeployConfig, l1StartBlock *types.Block, cu
 		return nil, common.Hash{}, err
 	}
 
+	// Pre-register test tokens in TokenRegistry for devnet. Gated on the same flag as
+	// the dev accounts: on mainnet and testnet these would occupy token IDs 1-3 and
+	// change the genesis state root.
+	if config.FundDevAccounts {
+		if err := SetDevnetTestTokens(db); err != nil {
+			return nil, common.Hash{}, fmt.Errorf("failed to pre-register devnet test tokens: %w", err)
+		}
+	}
+
 	withdrawRoot := withdrawtrie.ReadWTRSlot(rcfg.L2MessageQueueAddress, db)
 
 	fmt.Println("get withdraw root:", withdrawRoot)