feat(deploy): deterministic-clone toolchain + deterministic V4 authoriser deploy capability (#292 step 1)

foundry.toml

@@ -54,13 +54,13 @@ forge-std = "1.16.1"
 "@openzeppelin-contracts-upgradeable" = "5.6.1"
 "rain-deploy" = "0.1.4"
 "rain-extrospection" = "0.1.1"
-"rain-factory" = "0.1.1"
+"rain-factory" = "0.1.5"
 "rain-math-fixedpoint" = "0.2.0"
 "rain-math-float" = "0.1.1"
 "rain-sol-codegen" = "0.1.0"
 "rain-solmem" = "0.1.3"
 "rain-tofu-erc20-decimals" = "0.1.1"
-"rain-vats" = "0.1.6"
+"rain-vats" = "0.1.7"
 "rain-verify-interface" = "0.1.0"
 
 [soldeer]

remappings.txt

@@ -3,11 +3,11 @@
 forge-std-1.16.1/=dependencies/forge-std-1.16.1/
 rain-deploy-0.1.4/=dependencies/rain-deploy-0.1.4/
 rain-extrospection-0.1.1/=dependencies/rain-extrospection-0.1.1/
-rain-factory-0.1.1/=dependencies/rain-factory-0.1.1/
+rain-factory-0.1.5/=dependencies/rain-factory-0.1.5/
 rain-math-fixedpoint-0.2.0/=dependencies/rain-math-fixedpoint-0.2.0/
 rain-math-float-0.1.1/=dependencies/rain-math-float-0.1.1/
 rain-sol-codegen-0.1.0/=dependencies/rain-sol-codegen-0.1.0/
 rain-solmem-0.1.3/=dependencies/rain-solmem-0.1.3/
 rain-tofu-erc20-decimals-0.1.1/=dependencies/rain-tofu-erc20-decimals-0.1.1/
-rain-vats-0.1.6/=dependencies/rain-vats-0.1.6/
+rain-vats-0.1.7/=dependencies/rain-vats-0.1.7/
 rain-verify-interface-0.1.0/=dependencies/rain-verify-interface-0.1.0/

script/20260619-deploy-v4-authoriser-clone.s.sol

@@ -6,11 +6,11 @@ import {Script} from "forge-std-1.16.1/src/Script.sol";
 import {console2} from "forge-std-1.16.1/src/console2.sol";
 import {IAccessControl} from "@openzeppelin-contracts-5.6.1/access/IAccessControl.sol";
 import {ERC1167_PREFIX, ERC1167_SUFFIX} from "rain-extrospection-0.1.1/src/lib/LibExtrospectERC1167Proxy.sol";
-import {ICloneableFactoryV2} from "rain-factory-0.1.1/src/interface/ICloneableFactoryV2.sol";
-import {LibCloneFactoryDeploy} from "rain-factory-0.1.1/src/lib/LibCloneFactoryDeploy.sol";
+import {ICloneableFactoryV2} from "rain-factory-0.1.5/src/interface/ICloneableFactoryV2.sol";
+import {LibNonceCloneFactory} from "../src/lib/LibNonceCloneFactory.sol";
 import {
     OffchainAssetReceiptVaultAuthorizerV1Config
-} from "rain-vats-0.1.6/src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
+} from "rain-vats-0.1.7/src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
 
 import {IGnosisSafe} from "../src/interface/IGnosisSafe.sol";
 import {LibAuthoriserInvariants, RoleGrant} from "../src/lib/LibAuthoriserInvariants.sol";
@@ -28,7 +28,7 @@ error V4ImplNotDeployed(address impl);
 /// value in `LibProdDeployV4`. Impl has been replaced with different code.
 error V4ImplCodehashMismatch(address impl, bytes32 expected, bytes32 actual);
 
-/// @notice The canonical `CloneFactory` from `rain-factory-0.1.1` is not
+/// @notice The nonce-based `CloneFactory` pinned in `LibNonceCloneFactory` is not
 /// deployed at its pinned address. Zoltu deploy is missing on this network.
 error CloneFactoryNotDeployed(address factory);
 
@@ -186,7 +186,7 @@ contract DeployV4AuthoriserClone is Script {
         // Pre-flight: the canonical `CloneFactory` is deployed with the
         // pinned codehash. A missing/replaced factory would either
         // revert or hand back a clone under attacker-supplied bytecode.
-        address factoryAddr = LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_ADDRESS;
+        address factoryAddr = LibNonceCloneFactory.CLONE_FACTORY_DEPLOYED_ADDRESS;
         assertCloneFactoryDeployed(factoryAddr);
 
         // Pre-flight: the clone pin is not already hydrated. If it is,
@@ -342,7 +342,7 @@ contract DeployV4AuthoriserClone is Script {
     function assertCloneFactoryDeployed(address factory) internal view {
         if (factory.code.length == 0) revert CloneFactoryNotDeployed(factory);
         bytes32 actual = factory.codehash;
-        bytes32 expected = LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_CODEHASH;
+        bytes32 expected = LibNonceCloneFactory.CLONE_FACTORY_DEPLOYED_CODEHASH;
         if (actual != expected) revert CloneFactoryCodehashMismatch(factory, expected, actual);
     }
 

script/20260623-upgrade-receipt-vaults-to-v4.s.sol

@@ -7,8 +7,8 @@ import {console2} from "forge-std-1.16.1/src/console2.sol";
 
 import {IAccessControl} from "@openzeppelin-contracts-5.6.1/access/IAccessControl.sol";
 import {IBeacon} from "@openzeppelin-contracts-5.6.1/proxy/beacon/IBeacon.sol";
-import {IAuthorizableV1} from "rain-vats-0.1.6/src/interface/IAuthorizableV1.sol";
-import {IAuthorizeV1} from "rain-vats-0.1.6/src/interface/IAuthorizeV1.sol";
+import {IAuthorizableV1} from "rain-vats-0.1.7/src/interface/IAuthorizableV1.sol";
+import {IAuthorizeV1} from "rain-vats-0.1.7/src/interface/IAuthorizeV1.sol";
 import {IGnosisSafe} from "../src/interface/IGnosisSafe.sol";
 import {LibAuthoriserInvariants, RoleGrant} from "../src/lib/LibAuthoriserInvariants.sol";
 import {LibProdDeployV1} from "../src/lib/LibProdDeployV1.sol";
@@ -33,9 +33,10 @@ error V4ImplementationNotDeployed(address implementation);
 /// @param actual The codehash observed on-chain.
 error V4CodehashMismatch(address implementation, bytes32 expected, bytes32 actual);
 
-/// @notice The V4 authoriser clone constant in `LibAuthoriserInvariants` is still
-/// the `address(0)` placeholder. The clone must be deployed (and its address
-/// dropped into the lib) before the upgrade can be authored.
+/// @notice The V4 authoriser clone pin
+/// (`LibProdDeployV4.STOX_PROD_AUTHORISER_V4_CLONE`) is `address(0)` — no
+/// deployed clone has been pinned for this chain, so the upgrade cannot be
+/// authored.
 error V4AuthoriserCloneNotPinned();
 
 /// @notice The V4 authoriser clone address is pinned but has no runtime code.
@@ -101,11 +102,10 @@ error VaultAuthoriserMismatchPostUpgrade(address vault, address expected, addres
 ///    - the V4 authoriser clone is pinned (non-zero), deployed, has the pinned
 ///      EIP-1167 codehash, and holds every `LibAuthoriserInvariants.expectedGrants()`
 ///      pair.
-///    The V4 impl at `STOX_RECEIPT_VAULT_0_1_1` is deployed on Base with the
-///    pinned codehash, so the impl-side pre-flight passes; the clone-pin check
-///    fails red today because `STOX_PROD_AUTHORISER_V4_CLONE` is still
-///    `address(0)` — the forcing function blocking the upgrade until the clone
-///    is deployed and pinned.
+///    The impl- and clone-side pre-flights both pass against live Base state:
+///    the V4 impl at `STOX_RECEIPT_VAULT_0_1_1` is deployed with the pinned
+///    codehash, and `STOX_PROD_AUTHORISER_V4_CLONE` names the deployed clone,
+///    which carries the pinned EIP-1167 codehash and the full grant map.
 /// 2. **Build** — a multi-tx bundle: one `upgradeTo(V4 impl)` call per V1
 ///    production beacon (receipt, receipt vault, wrapped token vault), plus
 ///    one `setAuthorizer(V4 clone)` call per production receipt vault
@@ -178,7 +178,7 @@ contract UpgradeReceiptVaultsToV4 is Script {
     }
 
     /// @notice The V4 authoriser clone that every production receipt vault is
-    /// rewired onto. Placeholder until the clone is deployed.
+    /// rewired onto. Pinned in `LibProdDeployV4` from the deployed clone.
     address internal constant V4_AUTHORISER_CLONE = LibProdDeployV4.STOX_PROD_AUTHORISER_V4_CLONE;
 
     /// @notice Human-readable name embedded in the emitted Tx Builder JSON's

script/20260706-deploy-tokens-ethereum.s.sol

@@ -7,10 +7,10 @@ import {console2} from "forge-std-1.16.1/src/console2.sol";
 import {Vm} from "forge-std-1.16.1/src/Vm.sol";
 import {
     OffchainAssetReceiptVaultConfigV2
-} from "rain-vats-0.1.6/src/concrete/deploy/OffchainAssetReceiptVaultBeaconSetDeployer.sol";
-import {ReceiptVaultConfigV2} from "rain-vats-0.1.6/src/abstract/ReceiptVault.sol";
-import {IReceiptVaultV3} from "rain-vats-0.1.6/src/interface/IReceiptVaultV3.sol";
-import {IAuthorizeV1} from "rain-vats-0.1.6/src/interface/IAuthorizeV1.sol";
+} from "rain-vats-0.1.7/src/concrete/deploy/OffchainAssetReceiptVaultBeaconSetDeployer.sol";
+import {ReceiptVaultConfigV2} from "rain-vats-0.1.7/src/abstract/ReceiptVault.sol";
+import {IReceiptVaultV3} from "rain-vats-0.1.7/src/interface/IReceiptVaultV3.sol";
+import {IAuthorizeV1} from "rain-vats-0.1.7/src/interface/IAuthorizeV1.sol";
 import {Ownable} from "@openzeppelin-contracts-5.6.1/access/Ownable.sol";
 
 import {LibBeaconInvariants} from "../src/lib/LibBeaconInvariants.sol";

script/20260722-deploy-missing-tokens-ethereum.s.sol

@@ -7,10 +7,10 @@ import {console2} from "forge-std-1.16.1/src/console2.sol";
 import {Vm} from "forge-std-1.16.1/src/Vm.sol";
 import {
     OffchainAssetReceiptVaultConfigV2
-} from "rain-vats-0.1.6/src/concrete/deploy/OffchainAssetReceiptVaultBeaconSetDeployer.sol";
-import {ReceiptVaultConfigV2} from "rain-vats-0.1.6/src/abstract/ReceiptVault.sol";
-import {IReceiptVaultV3} from "rain-vats-0.1.6/src/interface/IReceiptVaultV3.sol";
-import {IAuthorizeV1} from "rain-vats-0.1.6/src/interface/IAuthorizeV1.sol";
+} from "rain-vats-0.1.7/src/concrete/deploy/OffchainAssetReceiptVaultBeaconSetDeployer.sol";
+import {ReceiptVaultConfigV2} from "rain-vats-0.1.7/src/abstract/ReceiptVault.sol";
+import {IReceiptVaultV3} from "rain-vats-0.1.7/src/interface/IReceiptVaultV3.sol";
+import {IAuthorizeV1} from "rain-vats-0.1.7/src/interface/IAuthorizeV1.sol";
 import {Ownable} from "@openzeppelin-contracts-5.6.1/access/Ownable.sol";
 import {LibBeaconInvariants} from "../src/lib/LibBeaconInvariants.sol";
 import {IStoxUnifiedDeployerV1} from "../src/interface/IStoxUnifiedDeployerV1.sol";

script/20260722-swap-remaining-vault-authorisers.s.sol

@@ -6,8 +6,8 @@ import {Script} from "forge-std-1.16.1/src/Script.sol";
 import {console2} from "forge-std-1.16.1/src/console2.sol";
 
 import {IAccessControl} from "@openzeppelin-contracts-5.6.1/access/IAccessControl.sol";
-import {IAuthorizableV1} from "rain-vats-0.1.6/src/interface/IAuthorizableV1.sol";
-import {IAuthorizeV1} from "rain-vats-0.1.6/src/interface/IAuthorizeV1.sol";
+import {IAuthorizableV1} from "rain-vats-0.1.7/src/interface/IAuthorizableV1.sol";
+import {IAuthorizeV1} from "rain-vats-0.1.7/src/interface/IAuthorizeV1.sol";
 import {IGnosisSafe} from "../src/interface/IGnosisSafe.sol";
 import {LibAuthoriserInvariants, RoleGrant} from "../src/lib/LibAuthoriserInvariants.sol";
 import {LibProdDeployV4} from "../src/generated/LibProdDeployV4.sol";

script/20260722-swap-rklb-authoriser.s.sol

@@ -6,8 +6,8 @@ import {Script} from "forge-std-1.16.1/src/Script.sol";
 import {console2} from "forge-std-1.16.1/src/console2.sol";
 
 import {IAccessControl} from "@openzeppelin-contracts-5.6.1/access/IAccessControl.sol";
-import {IAuthorizableV1} from "rain-vats-0.1.6/src/interface/IAuthorizableV1.sol";
-import {IAuthorizeV1} from "rain-vats-0.1.6/src/interface/IAuthorizeV1.sol";
+import {IAuthorizableV1} from "rain-vats-0.1.7/src/interface/IAuthorizableV1.sol";
+import {IAuthorizeV1} from "rain-vats-0.1.7/src/interface/IAuthorizeV1.sol";
 import {IGnosisSafe} from "../src/interface/IGnosisSafe.sol";
 import {LibAuthoriserInvariants, RoleGrant} from "../src/lib/LibAuthoriserInvariants.sol";
 import {LibProdDeployV4} from "../src/generated/LibProdDeployV4.sol";