fix: optionally verify contracts (#19052)

The `deploy-rollup-contracts` terraform module would always try to
verify contracts, even on chains not supported by Etherscan (e.g. when
deploying to a private devnet). This PR makes it opt-in (default false)
and passes through the `VERIFY_CONTRACTS` env var

Author: alexghr

spartan/environments/tps-scenario.env

@@ -12,7 +12,9 @@ LABS_INFRA_MNEMONIC="test test test test test test test test test test test junk
 FUNDING_PRIVATE_KEY="0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
 # CREATE_CHAOS_MESH=true
 
+CREATE_ROLLUP_CONTRACTS=true
 REDEPLOY_ROLLUP_CONTRACTS=true
+VERIFY_CONTRACTS=false
 DESTROY_AZTEC_INFRA=true
 
 AZTEC_LAG_IN_EPOCHS=1

spartan/scripts/deploy_network.sh

@@ -272,6 +272,10 @@ fi
 # Deploy rollup contracts
 # -------------------------------
 
+if [[ "${VERIFY_CONTRACTS:-}" == "true" && "${ETHEREUM_CHAIN_ID}" == "1337" ]]; then
+  die "Cannot verify contracts deployed to eth-devnet"
+fi
+
 if [[ "${VERIFY_CONTRACTS:-}" == "true" && "${CREATE_ROLLUP_CONTRACTS}" == "true" ]]; then
   if [ -z "$ETHERSCAN_API_KEY" ]; then
     echo "Error: ETHERSCAN_API_KEY is not set, but VERIFY_CONTRACTS=true. Cannot verify contracts without Etherscan API key (i.e. we need API access to the verification service)."
@@ -329,6 +333,7 @@ NETWORK = ${NETWORK_TF}
 JOB_NAME = "deploy-rollup-contracts"
 JOB_BACKOFF_LIMIT = 3
 JOB_TTL_SECONDS_AFTER_FINISHED = 3600
+VERIFY_CONTRACTS = ${VERIFY_CONTRACTS:-false}
 EOF
 
 # Check terraform state for existing contract addresses

spartan/terraform/deploy-rollup-contracts/main.tf

@@ -28,7 +28,8 @@ locals {
     ["--json"], # Always output JSON for easier parsing
     var.SPONSORED_FPC ? ["--sponsored-fpc"] : [],
     var.TEST_ACCOUNTS ? ["--test-accounts"] : [],
-    var.REAL_VERIFIER ? ["--real-verifier"] : []
+    var.REAL_VERIFIER ? ["--real-verifier"] : [],
+    var.VERIFY_CONTRACTS ? ["--verify-contracts"] : []
   )
 
 

spartan/terraform/deploy-rollup-contracts/variables.tf

@@ -228,3 +228,8 @@ variable "NETWORK" {
   nullable    = true
 }
 
+variable "VERIFY_CONTRACTS" {
+  description = "Verify contracts on Etherscan"
+  type        = bool
+  default     = false
+}

yarn-project/cli/src/cmds/l1/deploy_l1_contracts_cmd.ts

@@ -25,6 +25,7 @@ export async function deployL1ContractsCmd(
   initialValidators: EthAddress[],
   realVerifier: boolean,
   existingToken: EthAddress | undefined,
+  verifyContracts: boolean | undefined,
   log: LogFn,
   debugLogger: Logger,
 ) {
@@ -59,19 +60,25 @@ export async function deployL1ContractsCmd(
   debugLogger.info('Deploying L1 contracts via Forge...');
 
   // Deploy using l1-contracts Forge scripts
-  const { l1ContractAddresses, rollupVersion } = await deployAztecL1Contracts(rpcUrls[0], deployerPrivateKey, chainId, {
-    // Initial validators to add during deployment
-    initialValidators: initialValidatorOperators,
-    // Genesis config
-    vkTreeRoot,
-    protocolContractsHash,
-    genesisArchiveRoot,
-    // Deployment options
-    realVerifier,
-    ...config,
-    feeJuicePortalInitialBalance: fundingNeeded,
-    existingTokenAddress: existingToken,
-  });
+  const { l1ContractAddresses, rollupVersion } = await deployAztecL1Contracts(
+    rpcUrls[0],
+    deployerPrivateKey,
+    chainId,
+    {
+      // Initial validators to add during deployment
+      initialValidators: initialValidatorOperators,
+      // Genesis config
+      vkTreeRoot,
+      protocolContractsHash,
+      genesisArchiveRoot,
+      // Deployment options
+      realVerifier,
+      ...config,
+      feeJuicePortalInitialBalance: fundingNeeded,
+      existingTokenAddress: existingToken,
+    },
+    verifyContracts,
+  );
 
   debugLogger.info('Forge deployment complete', { rollupVersion });
 

yarn-project/cli/src/cmds/l1/index.ts

@@ -44,6 +44,7 @@ export function injectCommands(program: Command, log: LogFn, debugLogger: Logger
     .option('--sponsored-fpc', 'Populate genesis state with a testing sponsored FPC contract')
     .option('--real-verifier', 'Deploy the real verifier', false)
     .option('--existing-token <address>', 'Use an existing ERC20 for both fee and staking', parseEthereumAddress)
+    .option('--verify-contracts', 'Verify deployed contracts on Etherscan', false)
     .action(async options => {
       const { deployL1ContractsCmd } = await import('./deploy_l1_contracts_cmd.js');
 
@@ -61,6 +62,7 @@ export function injectCommands(program: Command, log: LogFn, debugLogger: Logger
         initialValidators,
         options.realVerifier,
         options.existingToken,
+        options.verifyContracts,
         log,
         debugLogger,
       );

yarn-project/ethereum/src/deploy_aztec_l1_contracts.ts

@@ -203,6 +203,7 @@ export async function deployAztecL1Contracts(
   privateKey: `0x${string}`,
   chainId: number,
   args: DeployAztecL1ContractsArgs,
+  verifyContracts = false,
 ): Promise<DeployAztecL1ContractsReturnType> {
   logger.info(`Deploying L1 contracts with config: ${jsonStringify(args)}`);
   if (args.initialValidators && args.initialValidators.length > 0 && args.existingTokenAddress) {
@@ -260,7 +261,8 @@ export async function deployAztecL1Contracts(
     '--rpc-url',
     rpcUrl,
     '--broadcast',
-    ...(chainId === foundry.id ? ['--batch-size', MAGIC_ANVIL_BATCH_SIZE.toString()] : ['--verify']),
+    ...(chainId === foundry.id ? ['--batch-size', MAGIC_ANVIL_BATCH_SIZE.toString()] : []),
+    ...(verifyContracts ? ['--verify'] : []),
   ];
   const forgeEnv = {
     // Protect against root leaving deployment files in docker that cannot be used later.