Espresso 3a: Fallback batcher (re-hosted)

op-batcher/batcher/driver.go

@@ -51,6 +51,18 @@ type txRef struct {
 	size     int
 }
 
+// newTxRef builds the txRef that identifies a batch submission across the txmgr
+// queue and receipt handling.
+func newTxRef(txdata txData, isCancel bool) txRef {
+	return txRef{
+		id:       txdata.ID(),
+		isCancel: isCancel,
+		isBlob:   txdata.daType == DaTypeBlob,
+		daType:   txdata.daType,
+		size:     txdata.Len(),
+	}
+}
+
 func (r txRef) String() string {
 	return r.string(func(id txID) string { return id.String() })
 }
@@ -124,6 +136,15 @@ type BatchSubmitter struct {
 	throttleController *throttler.ThrottleController
 
 	publishSignal chan pubInfo
+
+	// authGroup tracks the fallback batcher's receipt-watcher goroutines (one
+	// per auth+batch pair) so the publishing loop can drain them via
+	// waitForAuthGroup before closing receiptsCh. New watchers are back-pressured
+	// (not hard-bounded) by the txmgr Queue: queue.Send blocks at
+	// MaxPendingTransactions, so watchers are created no faster than txs drain,
+	// though a slow receipts loop can briefly leave more than that parked on their
+	// final receiptsCh send.
+	authGroup sync.WaitGroup
 }
 
 // NewBatchSubmitter initializes the BatchSubmitter driver from a preconfigured DriverSetup
@@ -516,6 +537,12 @@ func (l *BatchSubmitter) publishingLoop(ctx context.Context, wg *sync.WaitGroup,
 		}
 	}
 
+	// Wait for all in-flight fallback-auth submissions to complete to prevent
+	// new transactions being queued. No-op when the rollup is not configured
+	// with a BatchAuthenticator or when the EspressoTime hardfork has not
+	// activated.
+	l.waitForAuthGroup()
+
 	// We _must_ wait for all senders on receiptsCh to finish before we can close it.
 	if err := txQueue.Wait(); err != nil {
 		if !errors.Is(err, context.Canceled) {
@@ -1022,6 +1049,9 @@ func (l *BatchSubmitter) sendTransaction(txdata txData, queue *txmgr.Queue[txRef
 
 type TxSender[T any] interface {
 	Send(id T, candidate txmgr.TxCandidate, receiptCh chan txmgr.TxReceipt[T])
+	// SendPair submits an ordered pair of transactions holding a single
+	// max-pending slot; see txmgr.Queue.SendPair.
+	SendPair(firstID T, first txmgr.TxCandidate, firstCh chan txmgr.TxReceipt[T], secondID T, second txmgr.TxCandidate, secondCh chan txmgr.TxReceipt[T])
 }
 
 // sendTx uses the txmgr queue to send the given transaction candidate after setting its
@@ -1035,7 +1065,14 @@ func (l *BatchSubmitter) sendTx(txdata txData, isCancel bool, candidate *txmgr.T
 		candidate.GasLimit = floorDataGas
 	}
 
-	queue.Send(txRef{id: txdata.ID(), isCancel: isCancel, isBlob: txdata.daType == DaTypeBlob, daType: txdata.daType, size: txdata.Len()}, *candidate, receiptsCh)
+	// Route through the fallback-auth path when a BatchAuthenticator is
+	// configured and the EspressoTime hardfork is active. Falls through to
+	// the upstream queue.Send path otherwise.
+	if l.dispatchAuthenticatedSendTx(txdata, isCancel, candidate, queue, receiptsCh) {
+		return
+	}
+
+	queue.Send(newTxRef(txdata, isCancel), *candidate, receiptsCh)
 }
 
 func (l *BatchSubmitter) blobTxCandidate(data txData) (*txmgr.TxCandidate, error) {

op-batcher/batcher/driver_test.go

@@ -158,6 +158,11 @@ func (q *MockTxQueue) Send(ref txRef, candidate txmgr.TxCandidate, receiptCh cha
 	q.m.Store(ref.id.String(), candidate)
 }
 
+func (q *MockTxQueue) SendPair(firstRef txRef, first txmgr.TxCandidate, firstCh chan txmgr.TxReceipt[txRef], secondRef txRef, second txmgr.TxCandidate, secondCh chan txmgr.TxReceipt[txRef]) {
+	q.m.Store(firstRef.id.String(), first)
+	q.m.Store(secondRef.id.String(), second)
+}
+
 func (q *MockTxQueue) Load(id string) txmgr.TxCandidate {
 	c, _ := q.m.Load(id)
 	return c.(txmgr.TxCandidate)
@@ -480,8 +485,7 @@ func TestBatchSubmitter_CriticalError(t *testing.T) {
 // ======= ALTDA TESTS =======
 
 // fakeL1Client is just a dummy struct. All fault injection is done via the fakeTxMgr (which doesn't interact with this fakeL1Client).
-type fakeL1Client struct {
-}
+type fakeL1Client struct{}
 
 func (f *fakeL1Client) HeaderByNumber(ctx context.Context, number *big.Int) (*types.Header, error) {
 	if number == nil {

op-batcher/batcher/espresso_fallback_gate.go

@@ -0,0 +1,69 @@
+package batcher
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/ethereum/go-ethereum/common"
+
+	"github.com/ethereum-optimism/optimism/op-service/txmgr"
+)
+
+// dispatchAuthenticatedSendTx routes sendTx through the fallback-batcher
+// post-fork auth path, returning true when the tx has been handed off to
+// authGroup. Returns false to mean "fall through to the upstream queue.Send
+// path" — pre-fork operation and any cancel tx.
+//
+// The fallback batcher consults isFallbackAuthRequired to gate authentication
+// behind the EspressoTime hardfork: pre-fork the verifier accepts plain
+// sender-authenticated batches, and the BatchAuthenticator contract is
+// irrelevant.
+func (l *BatchSubmitter) dispatchAuthenticatedSendTx(txdata txData, isCancel bool, candidate *txmgr.TxCandidate, queue TxSender[txRef], receiptsCh chan txmgr.TxReceipt[txRef]) bool {
+	if isCancel {
+		return false
+	}
+	fallbackAuthRequired, err := l.isFallbackAuthRequired(l.killCtx)
+	if err != nil {
+		receiptsCh <- txmgr.TxReceipt[txRef]{
+			ID:  newTxRef(txdata, isCancel),
+			Err: fmt.Errorf("failed to evaluate fallback-auth gate: %w", err),
+		}
+		return true
+	}
+	if !fallbackAuthRequired {
+		return false
+	}
+	l.sendTxWithFallbackAuth(txdata, isCancel, candidate, queue, receiptsCh)
+	return true
+}
+
+// isFallbackAuthRequired reports whether the fallback (non-TEE) batcher must
+// route its batch txs through BatchAuthenticator.authenticateBatchInfo before
+// posting to the BatchInbox. It returns false if the rollup config has a
+// zero BatchAuthenticatorAddress, indicating that the BatchAuthenticator-based
+// authentication path is not in use.
+//
+// The gate switches at plain Espresso activation (tip.Time >= EspressoTime), a full grace
+// period before the verifier enforces event-based authentication. See
+// derive.BatchAuthEnforcementDelaySecs for the full grace-period mechanism and why the
+// batcher and verifier gates are offset.
+func (l *BatchSubmitter) isFallbackAuthRequired(ctx context.Context) (bool, error) {
+	if l.RollupConfig.BatchAuthenticatorAddress == (common.Address{}) {
+		return false, nil
+	}
+	tip, err := l.l1Tip(ctx)
+	if err != nil {
+		return false, fmt.Errorf("failed to fetch L1 tip for fallback-auth gate: %w", err)
+	}
+	return l.RollupConfig.IsEspresso(tip.Time), nil
+}
+
+// waitForAuthGroup blocks until all in-flight fallback-auth watcher goroutines
+// have finished. publishingLoop calls it before closing receiptsCh: each watcher
+// is a sender on receiptsCh, so the receipts loop must still be draining
+// receiptsCh at this point or a watcher's final send would block forever. Each
+// watcher always terminates because the txmgr Queue emits exactly one receipt per
+// Send, even on context cancellation.
+func (l *BatchSubmitter) waitForAuthGroup() {
+	l.authGroup.Wait()
+}

op-batcher/batcher/espresso_fallback_gate_test.go

@@ -0,0 +1,106 @@
+package batcher
+
+import (
+	"context"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/core/types"
+	"github.com/ethereum/go-ethereum/log"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ethereum-optimism/optimism/op-batcher/metrics"
+	"github.com/ethereum-optimism/optimism/op-node/rollup"
+	"github.com/ethereum-optimism/optimism/op-service/testlog"
+)
+
+type mockFixedTimeL1Client struct {
+	time uint64
+}
+
+func (f *mockFixedTimeL1Client) HeaderByNumber(ctx context.Context, number *big.Int) (*types.Header, error) {
+	return &types.Header{Number: big.NewInt(0), Time: f.time}, nil
+}
+
+func (f *mockFixedTimeL1Client) NonceAt(ctx context.Context, account common.Address, blockNumber *big.Int) (uint64, error) {
+	return 0, nil
+}
+
+func u64(v uint64) *uint64 { return &v }
+
+type fallbackAuthGateCase struct {
+	name         string
+	authAddr     common.Address
+	espressoTime *uint64
+	tipTime      uint64
+	want         bool
+}
+
+// TestIsFallbackAuthRequired_ForkBoundary locks the batcher's own side of the
+// Espresso fork boundary: the fallback batcher must begin authenticating exactly
+// at EspressoTime activation and never before, and only when a BatchAuthenticator
+// is configured. This is the counterpart to the derivation-side
+// TestDataAndHashesFromTxsForkBoundary — a silent divergence here would strand
+// batches (auth expected by the verifier but never posted, or posted needlessly).
+func TestIsFallbackAuthRequired_ForkBoundary(t *testing.T) {
+	const espressoTime = 1000
+	authAddr := common.HexToAddress("0x00000000000000000000000000000000000000aa")
+
+	tests := []fallbackAuthGateCase{
+		{
+			name:         "no authenticator configured is never gated",
+			authAddr:     common.Address{},
+			espressoTime: u64(espressoTime),
+			tipTime:      espressoTime, // even at/after activation
+			want:         false,
+		},
+		{
+			name:         "espresso not scheduled is never gated",
+			authAddr:     authAddr,
+			espressoTime: nil,
+			tipTime:      espressoTime,
+			want:         false,
+		},
+		{
+			name:         "one second before activation is not gated",
+			authAddr:     authAddr,
+			espressoTime: u64(espressoTime),
+			tipTime:      espressoTime - 1,
+			want:         false,
+		},
+		{
+			name:         "exactly at activation is gated",
+			authAddr:     authAddr,
+			espressoTime: u64(espressoTime),
+			tipTime:      espressoTime,
+			want:         true,
+		},
+		{
+			name:         "after activation is gated",
+			authAddr:     authAddr,
+			espressoTime: u64(espressoTime),
+			tipTime:      espressoTime + 1,
+			want:         true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			l := &BatchSubmitter{}
+			l.Log = testlog.Logger(t, log.LevelDebug)
+			l.Metr = metrics.NoopMetrics
+			l.RollupConfig = &rollup.Config{
+				BatchAuthenticatorAddress: test.authAddr,
+				EspressoTime:              test.espressoTime,
+			}
+			l.Config.NetworkTimeout = time.Second
+			l.L1Client = &mockFixedTimeL1Client{time: test.tipTime}
+
+			got, err := l.isFallbackAuthRequired(context.Background())
+			require.NoError(t, err)
+			require.Equal(t, test.want, got)
+		})
+	}
+}