pin(ethereum): hydrate the V4 authoriser clone address

[hardyjosh]

Hydrates STOX_PROD_AUTHORISER_V4_CLONE_ETHEREUM with the clone the Ethereum
bootstrap deployed: 0x66566cc91dEAf818859bD4b09B7903ac48998157.

Both the generator and its output change, so src/generated still regenerates
byte-for-byte and the copy-artifacts gate stays satisfied.

Verified on Ethereum mainnet

check	result
deployed	92-byte EIP-1167 proxy
embedded implementation	0x2ea0d35d… — the same authoriser impl Base's clone uses
codehash vs STOX_PROD_AUTHORISER_V4_CLONE_CODEHASH	0x2089950d…, matching, and identical to Base's clone
CERTIFY / CONFISCATE_RECEIPT / DEPOSIT / WITHDRAW / SCHEDULE_CORPORATE_ACTION admin	held by the Ethereum Safe 0x3840aeDa…
same roles on the deploy EOA	none — the self-revoke completed

The address is not chain-unique

0x66566cc9… also has code on Base — a different clone, embedding
0x2b4a510c… (the V3-era authoriser implementation). A nonce collision, not a
redeploy.

So a consumer that reads this pin while forked to Base finds live code, passes a
code.length > 0 deployment check, and is pointed at the wrong authoriser.
Only a codehash comparison separates them. That is the concrete reason
activeChainClonePin() reverts for an unpinned chain instead of falling back:
here a fallback resolves to a real contract rather than to nothing.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 60c0cfcd-2f54-459b-8fb4-8a79aca5102b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pin/ethereum-clone-address

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• feat(script): deploy the Ethereum production tokens via the deploy key, matched to Base #231 : 2 dependent PRs (#257 , #259 )
• test(parity): cross-chain deployment parity pin + scheduled CI #230
• pin(ethereum): hydrate the V4 authoriser clone address #258 👈 (View in Graphite)
• feat(deploy): Ethereum V4 authoriser clone — chain-parametric deploy script + per-chain pin selector #229
• feat(tokens): add MU/AMD/AVGO/AMAT/LRCX/TTWO to the Base production token list #265
• fix(test): assert ownership of the IN-USE production beacons per chain #266
• feat(lib): chain-aware token-owner Safe assertion #267
• fix(test): retire executed-migration simulations, repoint authoriser truth #268
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[thedavidmeister]

Reviewed 364b314: approve

Run 29956461864 leaves one test failure — testDeployTag (0_1_8 != 0_1_16) — plus git-clean. Both inherited main-red.

The pin is verified end to end on Ethereum mainnet rather than taken from the deploy log:

check	result
deployed at 0x66566cc91dEAf818859bD4b09B7903ac48998157	92-byte EIP-1167 proxy
embedded implementation	0x2ea0d35d… — the same impl Base's clone uses
codehash vs STOX_PROD_AUTHORISER_V4_CLONE_CODEHASH	0x2089950d…, matching, identical to Base's clone
CERTIFY / CONFISCATE_RECEIPT / DEPOSIT / WITHDRAW / SCHEDULE_CORPORATE_ACTION admin	held by the Ethereum Safe 0x3840aeDa…
the same roles on the deploy EOA	none — the self-revoke completed

That last row is the security contract of the whole bootstrap: the key deploys, grants, and ends up holding nothing.

Both defects found in review are fixed on this head: the body claimed a sentinel address(1) that was never in the diff (rewritten, along with the title, which no longer says DRAFT for a PR that is not one), and the BuildPointers comment still described the address(0) placeholder that this PR replaces.

One fact worth carrying forward: 0x66566cc9… also has code on Base — a different clone, embedding the V3-era authoriser impl 0x2b4a510c…. A nonce collision, not a redeploy. So this pin is not chain-unique, and a consumer that reads it while forked to Base finds live code and passes a code.length > 0 check while pointing at the wrong authoriser. Only the codehash separates them, which is the concrete reason #229's activeChainClonePin() reverts on an unpinned chain instead of falling back — a fallback here resolves to a real contract, not to nothing.