@aztec/ethereum 0.0.1-commit.3100065 → 0.0.1-commit.330febf

package/src/contracts/governance.ts

@@ -37,7 +37,7 @@ export type L1GovernanceContractAddresses = Pick<
   'governanceAddress' | 'rollupAddress' | 'registryAddress' | 'governanceProposerAddress'
 >;
 
-// NOTE: Must be kept in sync with DataStructures.ProposalState in l1-contracts
+// NOTE: Must be kept in sync with IGovernance.ProposalState in l1-contracts
 export enum ProposalState {
   Pending,
   Active,
@@ -45,10 +45,21 @@ export enum ProposalState {
   Executable,
   Rejected,
   Executed,
+  Droppable,
   Dropped,
   Expired,
 }
 
+/**
+ * Outcome of {@link ReadOnlyGovernanceContract.getPayloadProposalStatus} for a queried payload.
+ * - `'live'`: a proposal referencing the payload is still progressing (Pending/Active/Queued/
+ *   Executable) or is `Droppable`, so signalling for it again is redundant or premature.
+ * - `'executed'`: no live proposal references the payload, but one was already executed within the
+ *   bounded lookback (or a prior sweep observed the execution and memoized it).
+ * - `'none'`: no live or executed proposal references the payload within the bounded lookback.
+ */
+export type PayloadProposalStatus = 'live' | 'executed' | 'none';
+
 /** Vote tallies on a single proposal. Both fields are mutated by `Governance.vote`. */
 export interface Ballot {
   yea: bigint;
@@ -119,6 +130,17 @@ const TERMINAL_PROPOSAL_STATES: ReadonlySet<ProposalState> = new Set([
   ProposalState.Expired,
 ]);
 
+// Set of `ProposalState` values in which a proposal is still progressing towards execution.
+// `Droppable` is deliberately excluded: it is neither live (it cannot progress on its own) nor
+// terminal (it can resume its lifecycle if the governanceProposer is restored), so it is handled
+// separately and is never memoized as immutable.
+const LIVE_PROPOSAL_STATES: ReadonlySet<ProposalState> = new Set([
+  ProposalState.Pending,
+  ProposalState.Active,
+  ProposalState.Queued,
+  ProposalState.Executable,
+]);
+
 // Hard upper bound on the wall-clock lifetime of any Governance proposal, in seconds.
 // Each proposal stores its own snapshot of `ProposalConfiguration` at creation time and progresses
 // through Pending -> Active -> Queued -> Executable using those frozen durations
@@ -173,6 +195,14 @@ export class ReadOnlyGovernanceContract {
    */
   private readonly originalPayloadCache: Map<Hex, Hex | undefined> = new Map();
 
+  /**
+   * Payloads (lowercased hex) observed as the subject of an `Executed` Governance proposal. Execution
+   * is immutable on-chain, so this verdict never expires within a process. It restores the
+   * `'executed'` classification for payloads whose executed proposal has since aged past the bounded
+   * lookback below. Lost on restart, at which point the bounded-lookback limitation applies again.
+   */
+  private readonly executedPayloads: Set<string> = new Set();
+
   constructor(
     address: Hex,
     public readonly client: ViemClient,
@@ -263,30 +293,38 @@ export class ReadOnlyGovernanceContract {
   }
 
   /**
-   * Checks whether the given original payload is currently the subject of a live (non-terminal)
-   * Governance proposal. Returns true only if a proposal references this payload and is still in
-   * Pending, Active, Queued, or Executable state. Terminal proposals (Executed, Rejected, Dropped,
-   * Expired) are ignored, because once a proposal reaches a terminal state the same original
-   * payload may legitimately be re-signaled and re-submitted via the GovernanceProposer (each round
-   * is independent and there is no payload-level uniqueness check on-chain).
+   * Classifies the given original payload against the Governance proposal history. Distinguishes a
+   * payload that is still the subject of a live proposal (`'live'`) from one whose proposal was
+   * already executed (`'executed'`) from one that has no relevant proposal (`'none'`), so callers can
+   * stop re-signalling an executed payload while still re-signalling one whose proposal was merely
+   * rejected/dropped/expired (each GovernanceProposer round is independent and there is no
+   * payload-level uniqueness check on-chain).
+   *
+   * A proposal matches the payload either directly (its stored `payload` equals the target, as for
+   * `proposeWithLock` proposals) or via its `GSEPayload` wrapper unwrapping to the target. `'live'`
+   * (including `Droppable`) takes precedence over `'executed'`, so a payload re-submitted while a
+   * prior execution is still in the lookback window reads as `'live'`.
    *
    * Implemented as a bounded view-call sweep over `Governance.proposals` rather than an event scan,
    * because `eth_getLogs` over the full deployment history of a long-lived rollup exceeds typical
    * RPC block-range caps. The number of proposals (`proposalCount`) is small in practice, and we
-   * walk newest -> oldest with a hard early-stop on the protocol-wide proposal lifetime cap.
+   * walk newest -> oldest with a hard early-stop on the protocol-wide proposal lifetime cap. This
+   * makes the `'executed'` verdict a *bounded lookback* rather than permanent suppression: a proposal
+   * executed longer ago than the lifetime cap is only reported once it has been observed and
+   * memoized in-process (memo is lost on restart).
    */
-  public async hasActiveProposalWithPayload(payload: Hex): Promise<boolean> {
+  public async getPayloadProposalStatus(payload: Hex): Promise<PayloadProposalStatus> {
+    const target = payload.toLowerCase() as Hex;
+
     const proposalCount = await this.getProposalCount();
     if (proposalCount === 0n) {
-      return false;
+      return this.executedPayloads.has(target) ? 'executed' : 'none';
     }
 
     // Anything created before this cutoff is guaranteed terminal regardless of its frozen config.
     const block = await this.client.getBlock();
     const hardCutoff = block.timestamp - MAX_PROPOSAL_LIFETIME_SECONDS;
 
-    const target = payload.toLowerCase() as Hex;
-
     // Proposals are append-only with monotonically non-decreasing creation timestamps, so iterating
     // from newest -> oldest lets us early-stop as soon as we cross the lifetime cutoff.
     for (let id = proposalCount - 1n; id >= 0n; id--) {
@@ -294,24 +332,29 @@ export class ReadOnlyGovernanceContract {
 
       // Hard early-stop: every older proposal is also older than the cutoff and therefore terminal.
       if (proposal.creation < hardCutoff) {
-        return false;
+        break;
       }
 
+      const proposalPayload = proposal.payload.toString().toLowerCase();
       const original = await this.getOriginalPayload(proposal.payload);
-      if (original === undefined || original.toLowerCase() !== target) {
+      const matches = proposalPayload === target || (original !== undefined && original.toLowerCase() === target);
+      if (!matches) {
         continue;
       }
 
-      // The wrapper unwraps to our payload. Only treat this as "already proposed" if the proposal
-      // is still live -- terminal states allow re-proposing the same payload in a later round.
-      if (TERMINAL_PROPOSAL_STATES.has(proposal.state)) {
-        continue;
+      // A live or Droppable proposal blocks re-signalling and wins over any executed one.
+      if (LIVE_PROPOSAL_STATES.has(proposal.state) || proposal.state === ProposalState.Droppable) {
+        return 'live';
+      }
+
+      if (proposal.state === ProposalState.Executed) {
+        this.executedPayloads.add(target);
       }
 
-      return true;
+      // Rejected/Dropped/Expired proposals allow re-proposing the same payload; keep scanning.
     }
 
-    return false;
+    return this.executedPayloads.has(target) ? 'executed' : 'none';
   }
 
   /**

package/src/contracts/governance_proposer.ts

@@ -15,7 +15,7 @@ import {
 import type { L1TxRequest, L1TxUtils } from '../l1_tx_utils/index.js';
 import type { ViemClient } from '../types.js';
 import { type IEmpireBase, encodeSignal, encodeSignalWithSignature, signSignalWithSig } from './empire_base.js';
-import { ReadOnlyGovernanceContract, extractProposalIdFromLogs } from './governance.js';
+import { type PayloadProposalStatus, ReadOnlyGovernanceContract, extractProposalIdFromLogs } from './governance.js';
 
 export class GovernanceProposerContract implements IEmpireBase {
   private readonly proposer: GetContractReturnType<typeof GovernanceProposerAbi, ViemClient>;
@@ -38,16 +38,16 @@ export class GovernanceProposerContract implements IEmpireBase {
     this.proposer = getContract({ address, abi: GovernanceProposerAbi, client });
   }
 
-  public get address() {
+  public get address(): EthAddress {
     return EthAddress.fromString(this.proposer.address);
   }
 
-  public async getRollupAddress() {
+  public async getRollupAddress(): Promise<EthAddress> {
     return EthAddress.fromString(await this.proposer.read.getInstance());
   }
 
   @memoize
-  public async getRegistryAddress() {
+  public async getRegistryAddress(): Promise<EthAddress> {
     return EthAddress.fromString(await this.proposer.read.REGISTRY());
   }
 
@@ -59,10 +59,6 @@ export class GovernanceProposerContract implements IEmpireBase {
     return this.proposer.read.ROUND_SIZE();
   }
 
-  public getInstance() {
-    return this.proposer.read.getInstance();
-  }
-
   public computeRound(slot: SlotNumber): Promise<bigint> {
     return this.proposer.read.computeRound([BigInt(slot)]);
   }
@@ -107,7 +103,7 @@ export class GovernanceProposerContract implements IEmpireBase {
       signer,
       payload,
       slot,
-      await this.getInstance(),
+      (await this.getRollupAddress()).toString(),
       this.address.toString(),
       chainId,
     );
@@ -130,15 +126,15 @@ export class GovernanceProposerContract implements IEmpireBase {
   }
 
   /**
-   * Returns true iff the given original payload is currently the subject of a live (non-terminal)
-   * Governance proposal. Delegates to `ReadOnlyGovernanceContract.hasActiveProposalWithPayload`, which
-   * implements the actual sweep against the Governance contract -- this method exists only as a
-   * convenience wrapper so callers that already hold a GovernanceProposer reference don't have to
+   * Classifies the given original payload against the Governance proposal history (`'live'` /
+   * `'executed'` / `'none'`). Delegates to `ReadOnlyGovernanceContract.getPayloadProposalStatus`,
+   * which implements the actual sweep against the Governance contract -- this method exists only as
+   * a convenience wrapper so callers that already hold a GovernanceProposer reference don't have to
    * resolve the Governance address themselves.
    */
-  public async hasActiveProposalWithPayload(payload: Hex): Promise<boolean> {
+  public async getPayloadProposalStatus(payload: Hex): Promise<PayloadProposalStatus> {
     const governance = await this.getGovernance();
-    return governance.hasActiveProposalWithPayload(payload);
+    return governance.getPayloadProposalStatus(payload);
   }
 
   /**

package/src/contracts/gse.ts

@@ -59,6 +59,18 @@ export class GSEContract {
     return this.gse.read.getAttestersFromIndicesAtTime([instance, ts, indices], options);
   }
 
+  /** Number of attesters registered to `instance` as of the given L1 timestamp. */
+  public async getAttesterCountAtTime(
+    instance: Hex | EthAddress,
+    ts: bigint,
+    options?: { blockNumber?: bigint },
+  ): Promise<number> {
+    if (instance instanceof EthAddress) {
+      instance = instance.toString();
+    }
+    return Number(await this.gse.read.getAttesterCountAtTime([instance, ts], options));
+  }
+
   public async getRegistrationDigest(publicKey: ProjPointType<bigint>): Promise<ProjPointType<bigint>> {
     const affinePublicKey = publicKey.toAffine();
     const g1PointDigest = await this.gse.read.getRegistrationDigest([{ x: affinePublicKey.x, y: affinePublicKey.y }]);

package/src/contracts/multicall.ts

@@ -14,7 +14,7 @@ import {
   multicall3Abi,
 } from 'viem';
 
-import type { L1BlobInputs, L1TxConfig, L1TxRequest, L1TxUtils } from '../l1_tx_utils/index.js';
+import type { L1BlobInputs, L1TxConfig, L1TxRequest, L1TxState, L1TxUtils } from '../l1_tx_utils/index.js';
 import type { ExtendedViemWalletClient } from '../types.js';
 import { tryDecodeRevertReason } from '../utils.js';
 
@@ -26,7 +26,10 @@ export const MULTI_CALL_3_ADDRESS = '0xcA11bde05977b3631167028862bE2a173976CA11'
  * treat it as a fatal on-chain failure rather than retrying on a different publisher.
  */
 export class MulticallForwarderRevertedError extends Error {
-  constructor(public readonly receipt: TransactionReceipt) {
+  constructor(
+    public readonly receipt: TransactionReceipt,
+    public readonly txState?: L1TxState,
+  ) {
     super(`Multicall3 forwarder tx reverted: ${receipt.transactionHash}`);
     this.name = 'MulticallForwarderRevertedError';
   }
@@ -209,7 +212,7 @@ export class Multicall3 {
       args: [args],
     });
 
-    const { receipt } = await l1TxUtils.sendAndMonitorTransaction(
+    const { receipt, state } = await l1TxUtils.sendAndMonitorTransaction(
       {
         to: MULTI_CALL_3_ADDRESS,
         data: encodedForwarderData,
@@ -223,11 +226,11 @@ export class Multicall3 {
     // allowFailure to true for all calls, so a reverted status here would indicate a problem with
     // the Multicall3 contract itself or the forwarder transaction (such as an out-of-gas).
     if (receipt.status !== 'success') {
-      throw new MulticallForwarderRevertedError(receipt);
+      throw new MulticallForwarderRevertedError(receipt, state);
     }
 
     const stats = await l1TxUtils.getTransactionStats(receipt.transactionHash);
-    return { receipt, stats, multicallData: encodedForwarderData };
+    return { receipt, stats, multicallData: encodedForwarderData, state };
   }
 
   /** Batch multiple value transfers into a single aggregate3Value call on Multicall3. */

package/src/contracts/rollup.ts

@@ -560,6 +560,16 @@ export class RollupContract {
     return Number(await this.rollup.read.getActiveAttesterCount(options));
   }
 
+  /**
+   * Number of attesters that were staked at the given (historical) L1 timestamp. This is the count that
+   * validator-set sampling uses to decide whether an epoch gets a committee, and the historical counterpart
+   * of {@link getActiveAttesterCount} (which reads at the latest L1 block).
+   */
+  async getAttesterCountAtTime(timestamp: bigint, options?: { blockNumber?: bigint }): Promise<number> {
+    const gse = new GSEContract(this.client, await this.getGSE());
+    return gse.getAttesterCountAtTime(this.address, timestamp, options);
+  }
+
   public async getSlashingProposerAddress() {
     const slasher = await this.getSlasherContract();
     if (!slasher) {

package/src/contracts/slashing_proposer.ts

@@ -3,6 +3,7 @@ import type { ViemClient } from '@aztec/ethereum/types';
 import { mergeAbis, tryExtractEvent } from '@aztec/ethereum/utils';
 import { SlotNumber } from '@aztec/foundation/branded-types';
 import { Buffer32 } from '@aztec/foundation/buffer';
+import { memoize } from '@aztec/foundation/decorators';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
 import { hexToBuffer } from '@aztec/foundation/string';
@@ -25,6 +26,14 @@ import {
 export class SlashingProposerContract {
   private readonly contract: GetContractReturnType<typeof SlashingProposerAbi, ViemClient>;
 
+  /**
+   * Slash target validators of the last round asked for. Safe to cache because a round's targets are the committees
+   * of epochs that had already ended when the round opened (see SLASH_OFFSET_IN_ROUNDS), and those committees are
+   * sampled from validator set and randao snapshots taken before the epoch started, so they cannot change while the
+   * round is live. The promise is cached rather than the result, so concurrent callers share one in-flight read.
+   */
+  private slashTargetValidators: { round: bigint; validators: Promise<EthAddress[]> } | undefined;
+
   constructor(
     public readonly client: ViemClient,
     address: Hex | EthAddress,
@@ -64,6 +73,8 @@ export class SlashingProposerContract {
     return this.contract.read.EXECUTION_DELAY_IN_ROUNDS();
   }
 
+  /** Returns the slash amounts for the three slash unit levels. Immutable on the contract, so memoized. */
+  @memoize
   public getSlashingAmounts(): Promise<[bigint, bigint, bigint]> {
     return Promise.all([
       this.contract.read.SLASH_AMOUNT_SMALL(),
@@ -234,35 +245,70 @@ export class SlashingProposerContract {
     };
   }
 
+  /**
+   * Returns the validators eligible to be voted against in a round, in the order votes encode them. Cached for the
+   * last round asked for: reading them runs a committee sampling simulation on L1, and every vote of a round decodes
+   * against the same list, so a caller walking a round's votes would otherwise repeat that call per vote. Only the
+   * last round is kept since callers move forward round by round.
+   */
+  public getSlashTargetValidators(round: bigint): Promise<EthAddress[]> {
+    const cached = this.slashTargetValidators;
+    if (cached?.round === round) {
+      return cached.validators;
+    }
+
+    const entry = { round, validators: this.fetchSlashTargetValidators(round) };
+    this.slashTargetValidators = entry;
+    // A failed read must not stay cached, or every later vote of the round would replay the same rejection
+    entry.validators.catch(() => {
+      if (this.slashTargetValidators === entry) {
+        this.slashTargetValidators = undefined;
+      }
+    });
+    return entry.validators;
+  }
+
+  private async fetchSlashTargetValidators(round: bigint): Promise<EthAddress[]> {
+    const { result } = await this.contract.simulate.getSlashTargetCommittees([round]);
+    return result.flat().map(validator => EthAddress.fromString(validator));
+  }
+
+  /**
+   * Returns the slash amount voted for each target validator by a single vote of a round.
+   * @param index - Position of the vote within the round, from 0 (inclusive) to the round's vote count (exclusive)
+   */
+  public async getVoteAt(round: bigint, index: bigint): Promise<SlashVoteTarget[]> {
+    const [validators, vote, slashAmounts] = await Promise.all([
+      this.getSlashTargetValidators(round),
+      this.contract.read.getVotes([round, index]),
+      this.getSlashingAmounts(),
+    ]);
+    return decodeVote(vote, validators, slashAmounts);
+  }
+
   /** Returns the last vote emitted for a given round  */
   public async getLastVote(round: bigint) {
     const { voteCount } = await this.getRound(round);
-    const validators = (await this.contract.simulate.getSlashTargetCommittees([round])).result.flat();
-    const vote = await this.contract.read.getVotes([round, voteCount - 1n]);
-    const decoded = decodeSlashConsensusVotes(hexToBuffer(vote));
-    const slashAmounts = await this.getSlashingAmounts();
-    return decoded
-      .map((units, i) => ({
-        validator: EthAddress.fromString(validators[i]),
-        slashAmount: slashAmounts[units - 1] ?? 0n,
-      }))
-      .filter(v => v.slashAmount > 0n);
+    return await this.getVoteAt(round, voteCount - 1n);
   }
 
   /**
    * Listen for VoteCast events
-   * @param callback - Callback function to handle vote cast events
+   * @param callback - Callback receiving the round, the vote's index within the round as accepted by `getVoteAt`,
+   * and the proposer that cast it
    * @returns Unwatch function
    */
-  public listenToVoteCast(callback: (args: { round: bigint; proposer: string }) => void): () => void {
+  public listenToVoteCast(
+    callback: (args: { round: bigint; voteIndex: bigint; proposer: string }) => void,
+  ): () => void {
     return this.contract.watchEvent.VoteCast(
       {},
       {
         onLogs: logs => {
           for (const log of logs) {
-            const { round, proposer } = log.args;
-            if (round !== undefined && proposer) {
-              callback({ round, proposer });
+            const { round, voteIndex, proposer } = log.args;
+            if (round !== undefined && voteIndex !== undefined && proposer) {
+              callback({ round, voteIndex, proposer });
             }
           }
         },
@@ -294,6 +340,23 @@ export class SlashingProposerContract {
   }
 }
 
+/**
+ * A validator targeted by a slashing vote, with the amount voted. The position is the validator's index in the
+ * round's flattened slash target committees — the unit the contract tallies quorum by. A validator sitting in
+ * several of the round's committees holds several positions, each with its own tally.
+ */
+export type SlashVoteTarget = { validator: EthAddress; slashAmount: bigint; position: number };
+
+function decodeVote(vote: Hex, validators: EthAddress[], slashAmounts: [bigint, bigint, bigint]): SlashVoteTarget[] {
+  return decodeSlashConsensusVotes(hexToBuffer(vote))
+    .map((units, position) => ({
+      validator: validators[position],
+      slashAmount: slashAmounts[units - 1] ?? 0n,
+      position,
+    }))
+    .filter(v => v.slashAmount > 0n);
+}
+
 /**
  * Decodes a Buffer containing slash votes back into an array of numbers.
  * Each vote is represented as a 2-bit value (0, 1, 2, or 3) representing slashing units.

package/src/deploy_aztec_l1_contracts.ts

@@ -5,12 +5,12 @@ import { jsonStringify } from '@aztec/foundation/json-rpc';
 import { createLogger } from '@aztec/foundation/log';
 import { promiseWithResolvers } from '@aztec/foundation/promise';
 import type { Fr } from '@aztec/foundation/schemas';
-import { fileURLToPath } from '@aztec/foundation/url';
 
 import { bn254 } from '@noble/curves/bn254';
 import type { Abi, Narrow } from 'abitype';
 import { spawn } from 'child_process';
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'os';
 import { dirname, join, resolve } from 'path';
 import readline from 'readline';
@@ -22,11 +22,14 @@ import { createExtendedL1Client } from './client.js';
 import { type L1ContractsConfig, assertValidSlotDurations } from './config.js';
 import { deployMulticall3 } from './contracts/multicall.js';
 import { RollupContract } from './contracts/rollup.js';
+import { resolveFoundryBinary } from './foundry_binary.js';
 import type { L1ContractAddresses } from './l1_contract_addresses.js';
 import type { ExtendedViemWalletClient } from './types.js';
 
 const logger = createLogger('ethereum:deploy_aztec_l1_contracts');
 
+const require = createRequire(import.meta.url);
+
 const JSON_DEPLOY_RESULT_PREFIX = 'JSON DEPLOY RESULT:';
 
 /**
@@ -93,11 +96,16 @@ function runProcess<T>(
 
 // Covers an edge where where we may have a cached BlobLib that is not meant for production.
 // Despite the profile apparently sometimes cached code remains (so says Lasse after his ignition-monorepo arc).
-async function maybeForgeForceProductionBuild(l1ContractsPath: string, script: string, chainId: number) {
+async function maybeForgeForceProductionBuild(
+  forgeBin: string,
+  l1ContractsPath: string,
+  script: string,
+  chainId: number,
+) {
   if (chainId === mainnet.id) {
     logger.info(`Recompiling ${script} with production profile for mainnet deployment`);
     logger.info('This may take a minute but ensures production BlobLib is used.');
-    await runProcess('forge', ['build', script, '--force'], { FOUNDRY_PROFILE: 'production' }, l1ContractsPath);
+    await runProcess(forgeBin, ['build', script, '--force'], { FOUNDRY_PROFILE: 'production' }, l1ContractsPath);
   }
 }
 
@@ -123,15 +131,13 @@ export interface ValidatorJson {
 }
 
 /**
- * Gets the path to the l1-contracts foundry artifacts directory.
- * These are copied from l1-contracts to yarn-project/l1-artifacts/l1-contracts
- * during build to make yarn-project self-contained.
+ * Gets the path to the l1-contracts foundry artifacts directory bundled inside @aztec/l1-artifacts.
+ * Resolved through the package (its "." export -> dest/index.js) so it works whether the package is
+ * linked via portal (monorepo) or installed under node_modules (published npm) — resolution follows
+ * the symlink in the portal case. The bundled foundry subtree sits alongside dest/, at <pkg>/l1-contracts.
  */
 export function getL1ContractsPath(): string {
-  const currentDir = dirname(fileURLToPath(import.meta.url));
-  // Go up from yarn-project/ethereum/dest to yarn-project, then to l1-artifacts/l1-contracts
-  const l1ContractsPath = resolve(currentDir, '..', '..', 'l1-artifacts', 'l1-contracts');
-  return l1ContractsPath;
+  return resolve(dirname(require.resolve('@aztec/l1-artifacts')), '..', 'l1-contracts');
 }
 
 // Cached deployment directory
@@ -320,8 +326,9 @@ export async function deployAztecL1Contracts(
   // Use foundry-artifacts from l1-artifacts package
   const l1ContractsPath = prepareL1ContractsForDeployment();
 
+  const forgeBin = resolveFoundryBinary('forge');
   const FORGE_SCRIPT = 'script/deploy/DeployAztecL1Contracts.s.sol';
-  await maybeForgeForceProductionBuild(l1ContractsPath, FORGE_SCRIPT, chainId);
+  await maybeForgeForceProductionBuild(forgeBin, l1ContractsPath, FORGE_SCRIPT, chainId);
 
   // Verify contracts on Etherscan when on mainnet/sepolia and ETHERSCAN_API_KEY is available.
   const isVerifiableChain = chainId === mainnet.id || chainId === sepolia.id;
@@ -346,6 +353,8 @@ export async function deployAztecL1Contracts(
     ...(shouldVerify ? ['--verify'] : []),
   ];
   const forgeEnv = {
+    // Resolved forge binary picked up by forge_broadcast.js, so it works without forge on PATH.
+    FORGE_BIN: forgeBin,
     // Env vars required by l1-contracts/script/deploy/DeploymentConfiguration.sol.
     NETWORK: getActiveNetworkName(),
     FOUNDRY_PROFILE: chainId === mainnet.id ? 'production' : undefined,
@@ -590,6 +599,11 @@ export function getDeployRollupForUpgradeEnvVars(
     AZTEC_SLASH_AMOUNT_SMALL: args.slashAmountSmall.toString(),
     AZTEC_SLASH_AMOUNT_MEDIUM: args.slashAmountMedium.toString(),
     AZTEC_SLASH_AMOUNT_LARGE: args.slashAmountLarge.toString(),
+    AZTEC_ENTRY_QUEUE_BOOTSTRAP_VALIDATOR_SET_SIZE: args.entryQueueBootstrapValidatorSetSize.toString(),
+    AZTEC_ENTRY_QUEUE_BOOTSTRAP_FLUSH_SIZE: args.entryQueueBootstrapFlushSize.toString(),
+    AZTEC_ENTRY_QUEUE_FLUSH_SIZE_MIN: args.entryQueueFlushSizeMin.toString(),
+    AZTEC_ENTRY_QUEUE_FLUSH_SIZE_QUOTIENT: args.entryQueueFlushSizeQuotient.toString(),
+    AZTEC_ENTRY_QUEUE_MAX_FLUSH_SIZE: args.entryQueueMaxFlushSize.toString(),
   } as const;
 }
 
@@ -613,12 +627,15 @@ export const deployRollupForUpgrade = async (
   // Use foundry-artifacts from l1-artifacts package
   const l1ContractsPath = prepareL1ContractsForDeployment();
 
+  const forgeBin = resolveFoundryBinary('forge');
   const FORGE_SCRIPT = 'script/deploy/DeployRollupForUpgrade.s.sol';
-  await maybeForgeForceProductionBuild(l1ContractsPath, FORGE_SCRIPT, chainId);
+  await maybeForgeForceProductionBuild(forgeBin, l1ContractsPath, FORGE_SCRIPT, chainId);
 
   const scriptPath = join(getL1ContractsPath(), 'scripts', 'forge_broadcast.js');
   const forgeArgs = [FORGE_SCRIPT, '--sig', 'run()', '--private-key', privateKey, '--rpc-url', rpcUrl];
   const forgeEnv = {
+    // Resolved forge binary picked up by forge_broadcast.js, so it works without forge on PATH.
+    FORGE_BIN: forgeBin,
     FOUNDRY_PROFILE: chainId === mainnet.id ? 'production' : undefined,
     // Env vars required by l1-contracts/script/deploy/RollupConfiguration.sol.
     REGISTRY_ADDRESS: registryAddress.toString(),

package/src/foundry_binary.ts

@@ -0,0 +1,57 @@
+import { spawnSync } from 'child_process';
+import { accessSync, constants } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+function isExecutable(path: string): boolean {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Locate a Foundry binary (`anvil`, `forge`, ...) without relying on the caller's PATH. Order:
+ *   1. `$<NAME>_BIN` (e.g. `$ANVIL_BIN`, `$FORGE_BIN`) — explicit override, e.g. for CI with a pinned
+ *      version. Throws if set but not pointing at an executable, instead of silently falling back.
+ *   2. `~/.aztec/current/internal-bin/<name>` — where aztec-up installs it.
+ *   3. `~/.aztec/current/bin/aztec-<name>` — the publicly-exposed symlink.
+ *   4. `~/.foundry/bin/<name>` — standalone foundryup install.
+ *   5. `command -v <name>` — anything else on PATH.
+ *
+ * Throws with a directive message if none work.
+ */
+export function resolveFoundryBinary(name: string): string {
+  const envVar = `${name.toUpperCase()}_BIN`;
+  const envBin = process.env[envVar];
+  if (envBin) {
+    if (!isExecutable(envBin)) {
+      throw new Error(`$${envVar} is set to ${envBin}, which does not exist or is not executable.`);
+    }
+    return envBin;
+  }
+
+  const candidates = [
+    join(homedir(), '.aztec', 'current', 'internal-bin', name),
+    join(homedir(), '.aztec', 'current', 'bin', `aztec-${name}`),
+    join(homedir(), '.foundry', 'bin', name),
+  ];
+  for (const path of candidates) {
+    if (isExecutable(path)) {
+      return path;
+    }
+  }
+
+  const which = spawnSync('sh', ['-c', `command -v ${name}`], { encoding: 'utf8' });
+  if (which.status === 0 && which.stdout.trim()) {
+    return which.stdout.trim();
+  }
+
+  throw new Error(
+    `${name} binary not found. Tried $${envVar}, ~/.aztec/current/internal-bin/${name}, ` +
+      `~/.aztec/current/bin/aztec-${name}, ~/.foundry/bin/${name}, and $PATH. ` +
+      `Install via \`aztec-up\` or set ${envVar} to a working binary.`,
+  );
+}