feat(node): derive L1 portal addresses from genesis

Justfile

@@ -246,7 +246,6 @@ zone-up name reset="false" profile="dev" args="":
         echo "Error: $GENESIS_JSON not found. Run 'just create-zone {{name}}' first." >&2
         exit 1
     fi
-    PORTAL=$(jq -r '.portal' "$ZONE_JSON")
     ANCHOR_BLOCK=$(jq -r '.tempoAnchorBlock' "$ZONE_JSON")
     ZONE_ID=$(jq -r '.zoneId' "$ZONE_JSON")
     SEQ_KEY_FILE="${SEQUENCER_KEY_FILE:-}"
@@ -271,7 +270,6 @@ zone-up name reset="false" profile="dev" args="":
                       node \
                       --chain "$GENESIS_JSON" \
                       --l1.rpc-url "${L1_RPC_URL:?Set L1_RPC_URL env var (wss://...)}" \
-                      --l1.portal-address "$PORTAL" \
                       --zone.id "$ZONE_ID" \
                       --http \
                       --http.addr 0.0.0.0 \
@@ -959,7 +957,6 @@ deploy-zone name token="" access_enforced="false" gateway_enforced="false":
                       node \
                       --chain "$OUTPUT/genesis.json" \
                       --l1.rpc-url "$L1_RPC" \
-                      --l1.portal-address "$PORTAL" \
                       --zone.id "$ZONE_ID" \
                       --http \
                       --http.addr 0.0.0.0 \

README.md

@@ -76,6 +76,16 @@ The `deploy-zone` command generates admin and sequencer keypairs, funds them on
 just zone-up my-zone
 ```
 
+Nodes derive the L1 portal address locally from the zone ID encoded in the genesis
+chain ID, using Tempo's deterministic `ZoneFactory` address scheme. All node
+services, including the checker, use that derived address; no factory RPC call or
+`L1_PORTAL_ADDRESS` configuration is needed. Re-execution and other CLI commands
+using `L1_HTTP_RPC_URL` also derive the address from their chain specification.
+The node's deprecated `--l1.portal-address` flag and `L1_PORTAL_ADDRESS` environment
+variable remain accepted as consistency checks and must match the derived address
+when supplied. Legacy portals deployed from an EOA are not supported by this node
+startup path.
+
 ### Depositing into a Zone
 
 ```bash

contrib/bench/provision-topology.sh

@@ -976,7 +976,6 @@ provision_up() {
         "$ZONE_BIN" node \
         --chain "$zone_genesis" --datadir "$zone_db" \
         --l1.rpc-url ws://127.0.0.1:8545 \
-        --l1.portal-address "$portal" \
         --http --http.addr 127.0.0.1 --http.port 8546 \
         --http.api all \
         --ws --ws.addr 127.0.0.1 --ws.port 8546 \

crates/evm/src/lib.rs

@@ -288,17 +288,19 @@ impl ZoneEvmConfig {
     /// EVM config but don't have access to an L1 RPC connection. Tempo hardfork conditions come
     /// from `chain_spec` because the parent L1 spec cannot be resolved in this mode.
     pub fn new_without_l1(chain_spec: Arc<ZoneChainSpec>) -> Self {
+        let portal_address = tempo_precompiles::zone_factory::portal_address(chain_spec.zone_id());
         let cache = L1StateCache::default();
         let provider = ProviderBuilder::new_with_network::<TempoNetwork>()
             .connect_http("http://127.0.0.1:1".parse().expect("valid fallback URL"))
             .erased();
         let runtime_handle = tokio::runtime::Handle::current();
         let config = L1StateProviderConfig {
+            portal_address,
             max_sync_attempts: Some(NonZeroU32::MIN),
             ..Default::default()
         };
         let l1_provider = L1StateProvider::new_raw(config, cache, provider, runtime_handle);
-        Self::new(chain_spec, l1_provider, Address::ZERO)
+        Self::new(chain_spec, l1_provider, portal_address)
     }
 }
 
@@ -515,6 +517,19 @@ mod tests {
     use zone_precompiles::{tempo_state::TEMPO_BLOCK_NUMBER_SLOT, test_utils::MockL1Reader};
     use zone_primitives::constants::{TEMPO_STATE_ADDRESS, ZONE_INBOX_ADDRESS, zone_chain_id};
 
+    #[tokio::test]
+    async fn offline_evm_derives_portal_from_genesis() {
+        let mut genesis = MODERATO.genesis().clone();
+        genesis.config.chain_id = zone_chain_id(MODERATO.chain().id(), 7).unwrap();
+        let chain_spec = Arc::new(ZoneChainSpec::from_genesis(genesis).unwrap());
+        let config = ZoneEvmConfig::new_without_l1(chain_spec);
+
+        assert_eq!(
+            config.zone_factory.portal_address,
+            address!("5ad0000000000000000000000000000000000007")
+        );
+    }
+
     #[test]
     fn l1_storage_recorder_deduplicates_successful_reads() {
         let account = Address::repeat_byte(0xaa);