feat: permissionless fault games at initial deploy

op-chain-ops/interopgen/deploy.go

@@ -244,6 +244,7 @@ func DeployL2ToL1(l1Host *script.Host, superCfg *SuperchainConfig, superDeployme
 		GasLimit:                     cfg.GasLimit,
 		DisputeGameType:              cfg.DisputeGameType,
 		DisputeAbsolutePrestate:      cfg.DisputeAbsolutePrestate,
+		StartingAnchorRoot:           opcm.DefaultStartingAnchorRoot.Root,
 		DisputeMaxGameDepth:          new(big.Int).SetUint64(cfg.DisputeMaxGameDepth),
 		DisputeSplitDepth:            new(big.Int).SetUint64(cfg.DisputeSplitDepth),
 		DisputeClockExtension:        cfg.DisputeClockExtension,

op-deployer/pkg/deployer/opcm/opchain.go

@@ -36,6 +36,7 @@ type DeployOPChainInput struct {
 
 	DisputeGameType              uint32
 	DisputeAbsolutePrestate      common.Hash
+	StartingAnchorRoot           common.Hash
 	DisputeMaxGameDepth          *big.Int
 	DisputeSplitDepth            *big.Int
 	DisputeClockExtension        uint64

op-deployer/pkg/deployer/pipeline/opchain.go

@@ -134,6 +134,7 @@ func makeDCI(intent *state.Intent, thisIntent *state.ChainIntent, chainID common
 		return opcm.DeployOPChainInput{}, fmt.Errorf("OPCM implementation is not deployed")
 	}
 
+	// TODO(#20912): Populate StartingAnchorRoot and DisputeAbsolutePrestate from pipeline state for permissionless deploys.
 	return opcm.DeployOPChainInput{
 		OpChainProxyAdminOwner:       thisIntent.Roles.L1ProxyAdminOwner,
 		SystemConfigOwner:            thisIntent.Roles.SystemConfigOwner,
@@ -149,6 +150,7 @@ func makeDCI(intent *state.Intent, thisIntent *state.ChainIntent, chainID common
 		GasLimit:                     thisIntent.GasLimit,
 		DisputeGameType:              proofParams.DisputeGameType,
 		DisputeAbsolutePrestate:      proofParams.DisputeAbsolutePrestate,
+		StartingAnchorRoot:           opcm.DefaultStartingAnchorRoot.Root,
 		DisputeMaxGameDepth:          new(big.Int).SetUint64(proofParams.DisputeMaxGameDepth),
 		DisputeSplitDepth:            new(big.Int).SetUint64(proofParams.DisputeSplitDepth),
 		DisputeClockExtension:        proofParams.DisputeClockExtension,   // 3 hours (input in seconds)

packages/contracts-bedrock/scripts/checks/test-validation/exclusions.toml

@@ -25,6 +25,7 @@ src_validation = [
     "test/dispute/lib/LibGameId.t.sol",                       # Tests library utilities
     "test/libraries/DeployUtils.t.sol",                       # Tests library utilities - no direct src counterpart
     "test/setup/DeployVariations.t.sol",                      # Tests deployment variations
+    "test/setup/DisputeGames.t.sol",                          # Tests a test-only library (test/setup/DisputeGames.sol)
     "test/setup/PastNUTBundles.t.sol",                        # Tests a test-only library (test/setup/PastNUTBundles.sol)
     "test/universal/BenchmarkTest.t.sol",                     # Performance benchmarking tests
     "test/universal/ExtendedPause.t.sol",                     # Tests extended functionality

packages/contracts-bedrock/scripts/deploy/ChainAssertions.sol

@@ -14,8 +14,7 @@ import { DeployUtils } from "scripts/libraries/DeployUtils.sol";
 import { Constants } from "src/libraries/Constants.sol";
 import { Types } from "scripts/libraries/Types.sol";
 import { Blueprint } from "src/libraries/Blueprint.sol";
-import { GameType, GameTypes } from "src/dispute/lib/Types.sol";
-import { Hash } from "src/dispute/lib/Types.sol";
+import { GameType, Hash, Proposal } from "src/dispute/lib/Types.sol";
 // Interfaces
 import { IOPContractsManagerV2 } from "interfaces/L1/opcm/IOPContractsManagerV2.sol";
 import { IOPContractsManagerContainer } from "interfaces/L1/opcm/IOPContractsManagerContainer.sol";
@@ -402,7 +401,14 @@ library ChainAssertions {
         );
     }
 
-    function checkAnchorStateRegistryProxy(IAnchorStateRegistry _anchorStateRegistryProxy, bool _isProxy) internal {
+    function checkAnchorStateRegistryProxy(
+        IAnchorStateRegistry _anchorStateRegistryProxy,
+        bool _isProxy,
+        GameType _expectedRespectedGameType,
+        Hash _expectedRoot
+    )
+        internal
+    {
         DeployUtils.assertValidContractAddress(address(_anchorStateRegistryProxy));
         if (_isProxy) {
             DeployUtils.assertERC1967ImplementationSet(address(_anchorStateRegistryProxy));
@@ -416,15 +422,11 @@ library ChainAssertions {
         });
 
         // The below check cannot be done in the standard validator because the assertion only applies at deploy time.
-        (Hash actualRoot,) = _anchorStateRegistryProxy.anchors(GameTypes.PERMISSIONED_CANNON);
-        if (_isProxy) {
-            require(
-                Hash.unwrap(actualRoot) == 0xdead000000000000000000000000000000000000000000000000000000000000,
-                "ANCHORP-40"
-            );
-        } else {
-            require(Hash.unwrap(actualRoot) == bytes32(0), "ANCHORP-40");
-        }
+        Proposal memory actualRoot = _anchorStateRegistryProxy.getStartingAnchorRoot();
+
+        require(_anchorStateRegistryProxy.respectedGameType().raw() == _expectedRespectedGameType.raw(), "ANCHORP-30");
+        require(actualRoot.root.raw() == _expectedRoot.raw(), "ANCHORP-40");
+        require(actualRoot.l2SequenceNumber == 0, "ANCHORP-50");
     }
 
     /// @notice Asserts that the ZKDisputeGame implementation is setup correctly.

packages/contracts-bedrock/scripts/deploy/Deploy.s.sol

@@ -315,7 +315,9 @@ contract Deploy is Deployer {
             _mips: IMIPS64(address(dio.mipsSingleton))
         });
         ChainAssertions.checkSystemConfigImpls(impls);
-        ChainAssertions.checkAnchorStateRegistryProxy(IAnchorStateRegistry(impls.AnchorStateRegistry), false);
+        ChainAssertions.checkAnchorStateRegistryProxy(
+            IAnchorStateRegistry(impls.AnchorStateRegistry), false, GameType.wrap(0), Hash.wrap(bytes32(0))
+        );
     }
 
     /// @notice Deploy all of the OP Chain specific contracts

packages/contracts-bedrock/scripts/deploy/DeployImplementations.s.sol

@@ -19,7 +19,7 @@ import { ISuperFaultDisputeGame } from "interfaces/dispute/ISuperFaultDisputeGam
 import { ISuperPermissionedDisputeGame } from "interfaces/dispute/ISuperPermissionedDisputeGame.sol";
 import { IPermissionedDisputeGame } from "interfaces/dispute/IPermissionedDisputeGame.sol";
 import { IZKDisputeGame } from "interfaces/dispute/zk/IZKDisputeGame.sol";
-import { Duration, GameType, GameTypes } from "src/dispute/lib/Types.sol";
+import { Duration, GameType, GameTypes, Hash } from "src/dispute/lib/Types.sol";
 import { IOPContractsManagerV2 } from "interfaces/L1/opcm/IOPContractsManagerV2.sol";
 import { IOPContractsManagerContainer } from "interfaces/L1/opcm/IOPContractsManagerContainer.sol";
 import { IOPContractsManagerUtils } from "interfaces/L1/opcm/IOPContractsManagerUtils.sol";
@@ -804,6 +804,8 @@ contract DeployImplementations is Script {
         });
         ChainAssertions.checkETHLockboxImpl(_output.ethLockboxImpl, _output.optimismPortalImpl);
         ChainAssertions.checkSystemConfigImpls(impls);
-        ChainAssertions.checkAnchorStateRegistryProxy(IAnchorStateRegistry(impls.AnchorStateRegistry), false);
+        ChainAssertions.checkAnchorStateRegistryProxy(
+            IAnchorStateRegistry(impls.AnchorStateRegistry), false, GameType.wrap(0), Hash.wrap(bytes32(0))
+        );
     }
 }

packages/contracts-bedrock/scripts/deploy/DeployOPChain.s.sol

@@ -11,6 +11,7 @@ import { Constants as ScriptConstants } from "scripts/libraries/Constants.sol";
 import { Types } from "scripts/libraries/Types.sol";
 
 import { IProxyAdmin } from "interfaces/universal/IProxyAdmin.sol";
+import { IOPContractsManagerContainer } from "interfaces/L1/opcm/IOPContractsManagerContainer.sol";
 import { IOPContractsManagerV2 } from "interfaces/L1/opcm/IOPContractsManagerV2.sol";
 import { IOPContractsManagerUtils } from "interfaces/L1/opcm/IOPContractsManagerUtils.sol";
 import { IResourceMetering } from "interfaces/L1/IResourceMetering.sol";
@@ -27,7 +28,7 @@ import { IL1ERC721Bridge } from "interfaces/L1/IL1ERC721Bridge.sol";
 import { IL1StandardBridge } from "interfaces/L1/IL1StandardBridge.sol";
 import { IOptimismMintableERC20Factory } from "interfaces/universal/IOptimismMintableERC20Factory.sol";
 import { IETHLockbox } from "interfaces/L1/IETHLockbox.sol";
-import { GameType, GameTypes } from "src/dispute/lib/Types.sol";
+import { GameType, GameTypes, Proposal } from "src/dispute/lib/Types.sol";
 import { DevFeatures } from "src/libraries/DevFeatures.sol";
 
 contract DeployOPChain is Script {
@@ -76,7 +77,7 @@ contract DeployOPChain is Script {
         require(address(_input.opcm).code.length > 0, "DeployOPChain: OPCM address has no code");
 
         IOPContractsManagerV2 opcmV2 = IOPContractsManagerV2(_input.opcm);
-        isSuperRoot = DevFeatures.isDevFeatureEnabled(opcmV2.devFeatureBitmap(), DevFeatures.SUPER_ROOT_GAMES_MIGRATION);
+        isSuperRoot = _isSuperRootEnabled(opcmV2);
         IOPContractsManagerV2.FullConfig memory config = _toOPCMV2DeployInput(_input);
 
         vm.broadcast(msg.sender);
@@ -112,11 +113,12 @@ contract DeployOPChain is Script {
         view
         returns (IOPContractsManagerV2.FullConfig memory config_)
     {
-        // Only PERMISSIONED_CANNON is allowed for initial deployment since no prestate exists for permissionless games.
-        require(
-            _input.disputeGameType.raw() == GameTypes.PERMISSIONED_CANNON.raw(),
-            "DeployOPChain: only PERMISSIONED_CANNON game type is supported for initial deployment"
-        );
+        (bool permissionless, GameType respectedGameType) =
+            _initialDeployGameSelection(_input.disputeGameType, isSuperRoot);
+        bool enableCannonKona = permissionless && _input.disputeGameType.raw() == GameTypes.CANNON_KONA.raw();
+        // Non-super-root deploys always register PERMISSIONED_CANNON. In CANNON_KONA mode,
+        // the ASR respects CANNON_KONA first but the guardian can switch to PERMISSIONED_CANNON.
+        bool enablePermissionedCannon = !isSuperRoot;
 
         // Shared permissioned game config for legacy permissioned games.
         IOPContractsManagerUtils.PermissionedDisputeGameConfig memory pdgConfig = IOPContractsManagerUtils
@@ -133,36 +135,26 @@ contract DeployOPChain is Script {
         IOPContractsManagerUtils.DisputeGameConfig[] memory disputeGameConfigs =
             new IOPContractsManagerUtils.DisputeGameConfig[](6);
 
-        // Config 0: CANNON (disabled for initial deployment — no prestate exists)
+        // Config 0: legacy CANNON slot, disabled after U19 and kept to satisfy OPCMV2's 6-config shape.
         disputeGameConfigs[0] = IOPContractsManagerUtils.DisputeGameConfig({
             enabled: false,
             initBond: 0,
             gameType: GameTypes.CANNON,
             gameArgs: bytes("")
         });
 
-        // Config 1: PERMISSIONED_CANNON — enabled only in non-super-root mode.
-        disputeGameConfigs[1] = isSuperRoot
-            ? IOPContractsManagerUtils.DisputeGameConfig({
-                enabled: false,
-                initBond: 0,
-                gameType: GameTypes.PERMISSIONED_CANNON,
-                gameArgs: bytes("")
-            })
-            : IOPContractsManagerUtils.DisputeGameConfig({
-                enabled: true,
-                initBond: DEFAULT_INIT_BOND,
-                gameType: GameTypes.PERMISSIONED_CANNON,
-                gameArgs: abi.encode(pdgConfig)
-            });
-
-        // Config 2: CANNON_KONA (disabled for initial deployment — no prestate exists)
-        disputeGameConfigs[2] = IOPContractsManagerUtils.DisputeGameConfig({
-            enabled: false,
-            initBond: 0,
-            gameType: GameTypes.CANNON_KONA,
-            gameArgs: bytes("")
-        });
+        // Config 1: PERMISSIONED_CANNON
+        disputeGameConfigs[1] =
+            _createGameConfig(enablePermissionedCannon, GameTypes.PERMISSIONED_CANNON, abi.encode(pdgConfig));
+
+        // Config 2: CANNON_KONA
+        disputeGameConfigs[2] = _createGameConfig(
+            enableCannonKona,
+            GameTypes.CANNON_KONA,
+            abi.encode(
+                IOPContractsManagerUtils.FaultDisputeGameConfig({ absolutePrestate: _input.disputeAbsolutePrestate })
+            )
+        );
 
         // Config 3: SUPER_PERMISSIONED — enabled only in super-root mode.
         disputeGameConfigs[3] = isSuperRoot
@@ -202,8 +194,8 @@ contract DeployOPChain is Script {
             systemConfigOwner: _input.systemConfigOwner,
             unsafeBlockSigner: _input.unsafeBlockSigner,
             batcher: _input.batcher,
-            startingAnchorRoot: ScriptConstants.DEFAULT_OUTPUT_ROOT(),
-            startingRespectedGameType: isSuperRoot ? GameTypes.SUPER_PERMISSIONED : GameTypes.PERMISSIONED_CANNON,
+            startingAnchorRoot: Proposal({ root: _input.startingAnchorRoot, l2SequenceNumber: 0 }),
+            startingRespectedGameType: respectedGameType,
             basefeeScalar: _input.basefeeScalar,
             blobBasefeeScalar: _input.blobBaseFeeScalar,
             gasLimit: _input.gasLimit,
@@ -281,6 +273,64 @@ contract DeployOPChain is Script {
         require(cfg_.maxResourceLimit > 0, "DeployOPChain: gasLimit too small for any deposit budget");
     }
 
+    /// @notice Returns the permissionless mode and respected game type for an initial deployment.
+    /// @dev Permissionless deploys respect the requested game type before the permissioned/super-root default.
+    function _initialDeployGameSelection(
+        GameType _disputeGameType,
+        bool _isSuperRoot
+    )
+        internal
+        pure
+        returns (bool permissionless_, GameType respectedGameType_)
+    {
+        permissionless_ = _disputeGameType.raw() == GameTypes.CANNON_KONA.raw();
+
+        // PERMISSIONED_CANNON is the only **permissioned** type supported for an initial deploy.
+        require(
+            permissionless_ || _disputeGameType.raw() == GameTypes.PERMISSIONED_CANNON.raw(),
+            "DeployOPChain: unsupported dispute game type"
+        );
+
+        // Super roots don't support permissionless games and they deploy with SUPER_PERMISSIONED instead.
+        require(
+            !(_isSuperRoot && permissionless_), "DeployOPChain: permissionless game type not supported with super roots"
+        );
+
+        respectedGameType_ = permissionless_
+            ? _disputeGameType
+            : (_isSuperRoot ? GameTypes.SUPER_PERMISSIONED : GameTypes.PERMISSIONED_CANNON);
+    }
+
+    /// @notice Returns whether the given OPCM has the SUPER_ROOT_GAMES_MIGRATION dev feature enabled.
+    /// @param _opcm The OPCM to check.
+    /// @return Whether SUPER_ROOT_GAMES_MIGRATION is enabled.
+    function _isSuperRootEnabled(IOPContractsManagerV2 _opcm) internal view returns (bool) {
+        return DevFeatures.isDevFeatureEnabled(_opcm.devFeatureBitmap(), DevFeatures.SUPER_ROOT_GAMES_MIGRATION);
+    }
+
+    /// @notice Returns a DisputeGameConfig with the appropriate values based on the parameters passed in.
+    ///         If the game is enabled the configuration is filled with the default init bond and the game
+    ///         arguments passed as parameter otherwise 0 is used for the bond and empty bytes for the arguments.
+    /// @param _enabled Whether the dispute game is enabled or not
+    /// @param _gameType The type of this dispute game
+    /// @param _enabledArgs The arguments for the dispute game config
+    function _createGameConfig(
+        bool _enabled,
+        GameType _gameType,
+        bytes memory _enabledArgs
+    )
+        internal
+        pure
+        returns (IOPContractsManagerUtils.DisputeGameConfig memory)
+    {
+        return IOPContractsManagerUtils.DisputeGameConfig({
+            enabled: _enabled,
+            initBond: _enabled ? DEFAULT_INIT_BOND : 0,
+            gameType: _gameType,
+            gameArgs: _enabled ? _enabledArgs : bytes("")
+        });
+    }
+
     // -------- Validations --------
 
     /// @notice Checks if the input is valid.
@@ -302,11 +352,21 @@ contract DeployOPChain is Script {
 
         require(_i.opcm != address(0), "DeployOPChainInput: opcm not set");
         DeployUtils.assertValidContractAddress(_i.opcm);
+        bool superRoot = _isSuperRootEnabled(IOPContractsManagerV2(_i.opcm));
+        (bool permissionless,) = _initialDeployGameSelection(_i.disputeGameType, superRoot);
 
         require(_i.disputeMaxGameDepth != 0, "DeployOPChainInput: disputeMaxGameDepth not set");
         require(_i.disputeSplitDepth != 0, "DeployOPChainInput: disputeSplitDepth not set");
         require(_i.disputeMaxClockDuration.raw() != 0, "DeployOPChainInput: disputeMaxClockDuration not set");
         require(_i.disputeAbsolutePrestate.raw() != bytes32(0), "DeployOPChainInput: disputeAbsolutePrestate not set");
+        require(_i.startingAnchorRoot.raw() != bytes32(0), "DeployOPChainInput: startingAnchorRoot not set");
+
+        if (permissionless) {
+            require(
+                _i.startingAnchorRoot.raw() != ScriptConstants.DEFAULT_OUTPUT_ROOT().root.raw(),
+                "DeployOPChainInput: permissionless startingAnchorRoot cannot be placeholder"
+            );
+        }
     }
 
     /// @notice Checks if the output is valid.
@@ -358,15 +418,18 @@ contract DeployOPChain is Script {
 
         // Check dispute games and get superchain config
         IOPContractsManagerV2 opcmV2 = IOPContractsManagerV2(_i.opcm);
-        address expectedPDGImpl = isSuperRoot
-            ? opcmV2.implementations().superPermissionedDisputeGameImpl
-            : opcmV2.implementations().permissionedDisputeGameImpl;
+        IOPContractsManagerContainer.Implementations memory implementations = opcmV2.implementations();
 
-        GameType permGameType = isSuperRoot ? GameTypes.SUPER_PERMISSIONED : GameTypes.PERMISSIONED_CANNON;
+        (bool permissionless, GameType respectedGameType) = _initialDeployGameSelection(_i.disputeGameType, isSuperRoot);
+        address expectedDGImpl = permissionless
+            ? implementations.faultDisputeGameImpl
+            : (isSuperRoot ? implementations.superPermissionedDisputeGameImpl : implementations.permissionedDisputeGameImpl);
         ChainAssertions.checkDisputeGameFactory(
-            _o.disputeGameFactoryProxy, _i.opChainProxyAdminOwner, expectedPDGImpl, true, permGameType
+            _o.disputeGameFactoryProxy, _i.opChainProxyAdminOwner, expectedDGImpl, true, respectedGameType
+        );
+        ChainAssertions.checkAnchorStateRegistryProxy(
+            _o.anchorStateRegistryProxy, true, respectedGameType, _i.startingAnchorRoot
         );
-        ChainAssertions.checkAnchorStateRegistryProxy(_o.anchorStateRegistryProxy, true);
         ChainAssertions.checkL1CrossDomainMessenger(_o.l1CrossDomainMessengerProxy, vm, true);
         ChainAssertions.checkOptimismPortal2({
             _contracts: proxies,
@@ -469,20 +532,4 @@ contract DeployOPChain is Script {
             "OPCPA-120"
         );
     }
-
-    /// @notice Returns the starting anchor root for the permissioned game.
-    function startingAnchorRoot() public pure returns (bytes memory) {
-        // WARNING: For now always hardcode the starting permissioned game anchor root to 0xdead,
-        // and we do not set anything for the permissioned game. This is because we currently only
-        // support deploying straight to permissioned games, and the starting root does not
-        // matter for that, as long as it is non-zero, since no games will be played. We do not
-        // deploy the permissionless game (and therefore do not set a starting root for it here)
-        // because updating to the permissionless game will require updating its starting
-        // anchor root and deploy a new permissioned dispute game contract anyway.
-        //
-        // You can `console.logBytes(abi.encode(ScriptConstants.DEFAULT_OUTPUT_ROOT()))` to get the bytes that
-        // are hardcoded into `op-chain-ops/deployer/opcm/opchain.go`
-
-        return abi.encode(ScriptConstants.DEFAULT_OUTPUT_ROOT());
-    }
 }