Maintenance Upgrade Proposal: Ink Mainnet Fee Vault Config Update and Proposer Rotation

Proposals 📃
1

Proposal Type: Maintenance Upgrade
Voting Cycle Type: Off-cycle. Per the OPerating Manual, Maintenance Upgrade Proposals proceed directly to on-chain voting under optimistic approval, with a one-week veto period and a 20% veto quorum.

Executive Summary

Ink Mainnet is migrating its sequencer operations from Gelato to the Optimism Foundation as chain servicer via OP Enterprise, with cutover targeted for 2026-07-28. The migration itself does not require governance action: the chain’s L1 ProxyAdmin owner is already the standard Optimism governance 2-of-2 (Foundation Upgrade Safe + Security Council), and the operational cutover (sequencer, batcher, op-node) is handled by keys outside that role.

Two follow-up items do exercise the ProxyAdmin owner role, and are therefore submitted here for approval. Neither is on the migration’s critical path; both are maintenance actions executed as fast-follows to the cutover:

  1. Fee vault config update. Update two of the four recipients configured on Ink’s L2 fee vault predeploys (L1FeeVault and OperatorFeeVault) so that chain fees accumulate to the new L1 Cost Recipient (0x1eB630b2e7409597D462dd5f3D21E305FC56B8C9) established under the account-funding workstream, replacing the current recipient 0xa6f0F94C13C4255231958079E7331694205F6c93 (verified on-chain 2026-07-20). The OperatorFeeVault, which currently forwards to the BaseFeeVault on L2, also switches its withdrawal network to L1, and the minimum withdrawal threshold on both cost vaults is set to 0.15 ETH (L1FeeVault 2 ETH → 0.15; OperatorFeeVault 0 → 0.15) — low enough for frequent cost-recipient sweeps, non-zero so zero-value withdrawal messages are not possible. SequencerFeeVault and BaseFeeVault are not touched. The update is performed in place via the vaults’ owner-gated setters. No implementation or proxy is upgraded.
  2. Proposer rotation. Rotate the proposer configured for Ink’s PermissionedDisputeGame (game type 1) from the outgoing Gelato key 0x65436DDcBc026F34118954f229F7f132b696B3b4 to the OP Enterprise proposer 0x3832bfbeF03173E4C49a00ec0DD178817A02D177. The permissioned game is a dormant Guardian fallback on Ink (the active respected game is the permissionless CANNON_KONA, game type 8, which has no on-chain proposer), so this change is made for correctness rather than liveness.

Neither change affects protocol behavior, dispute game mechanics, bridge safety, or end users. Impacted stakeholders are limited to the chain operator (OP Enterprise assumes the proposer role on the fallback game) and the recipient of Ink’s chain fees on L1.

Motivation

Ink’s rollup-operator migration consolidates the chain’s operations under the Optimism Foundation’s chain servicer product: OP Enterprise. Two pieces of chain configuration still reference the pre-migration setup:

  • The fee vault recipient predates the account-funding work that standardizes how OP-operated chains fund their L1 operational costs. Pointing the two cost-covering vaults at the dedicated L1 Cost Recipient completes that consolidation for Ink, while sequencer revenue continues to accrue to the Chain Governor’s recipient unchanged.
  • The PermissionedDisputeGame proposer is still the outgoing Gelato key. Although the game type is dormant, leaving a departed operator’s key authorized as proposer on a fallback dispute game is incorrect state, and would matter if the Guardian ever re-enabled the permissioned game.

Both actions can only be taken by the L1 ProxyAdmin owner, which for Ink is the Optimism governance 2-of-2. Under the OPerating Manual these are maintenance changes: they must not materially change the behavior of the protocol for end users, infra providers, or chain governors, and they do not.

The proposal is submitted by OP Labs, which operates OP Enterprise; this is a conflict of interest in the narrow sense that OP Labs benefits from the migration completing cleanly. Fee flows remain within the arrangements already agreed between Ink and the Collective.

Specifications

Change 1: PermissionedDisputeGame proposer rotation

Executed via superchain-ops task eth/061-ink-proposer-rotation (merged in superchain-ops#1490, status READY TO SIGN), using the SetDisputeGameArgs template:

  • DisputeGameFactoryProxy: 0x10d7B35078d3baabB96Dd45a9143B94be65b12CD
  • The task reads the live gameArgs(1) blob and swaps only the proposer: 0x65436DDcBc026F34118954f229F7f132b696B3b4 (Gelato) → 0x3832bfbeF03173E4C49a00ec0DD178817A02D177 (OP Enterprise, independently verified by 3 OP Labs engineers)
  • Challenger unchanged: 0x9BA6e03D8B90dE867373Db8cF1A58d2F7F006b3A (FoundationOperationsSafe, already OP governance)
  • Prestate, VM, delayedWETH, and the game implementation (0xe1dFFCBE4e22B813F26d2106D943C102e7cAb87e, v2.4.0) are read live and preserved; the init bond is asserted at the current 0.08 ETH
  • Rehearsed on Ink Sepolia as task sep/102, executed 2026-06-22

Change 2: Fee vault config update (in-place setters)

Ink’s four fee vault predeploys (live versions verified on-chain 2026-07-20: SequencerFeeVault / BaseFeeVault / L1FeeVault at v1.6.1, OperatorFeeVault at v1.1.1), expose owner-gated setters (setRecipient, setWithdrawalNetwork, setMinWithdrawalAmount) authorized against the L2 ProxyAdmin owner:

  • SequencerFeeVault 0x4200000000000000000000000000000000000011
  • BaseFeeVault 0x4200000000000000000000000000000000000019
  • L1FeeVault 0x420000000000000000000000000000000000001A — recipient and minimum withdrawal updated
  • OperatorFeeVault 0x420000000000000000000000000000000000001b — recipient, withdrawal network and minimum withdrawal updated

The update uses the SetFeeVaultConfig superchain-ops template (superchain-ops#1504, currently in review): the L1 ProxyAdmin owner Safe calls OptimismPortal2.depositTransaction() once per changed field, and the deposit’s aliased sender is exactly the L2 ProxyAdmin owner the setters check. Fields already matching the target value are skipped, and the template dry-runs every setter on a fork of the L2 at signing time. No proxy implementation changes; only configuration storage values are written.

Signing

Both tasks are signed by the Ink L1 ProxyAdmin owner Safe 0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A, a nested 2-of-2 of the Foundation Upgrade Safe 0x847B5c174615B1B7fDF770882256e2D3E95b9D92 and the Security Council 0xc2819DC788505Aac350142A7A707BF9D03E3Bd03. Simulation hashes for eth/061 are recorded in the task’s VALIDATION.md; eth/062’s hashes are likewise recorded in its VALIDATION.md, together with an L2 post-execution validation section for verifying the vault state after the deposits relay.

Impact Summary

  • No downtime, no protocol behavior change, no state migration. Each change is a small number of storage writes.
  • Users and infra providers take no action.
  • The fee vault update changes where the cost-covering share of Ink’s chain fees (L1 fee and operator fee) are withdrawn on L1, and sets a 0.15 ETH withdrawal minimum on both cost vaults (L1FeeVault 2 ETH → 0.15, OperatorFeeVault 0 → 0.15) — low enough for frequent sweeps, non-zero to prevent zero-value withdrawal messages; sequencer revenue (SequencerFeeVault, BaseFeeVault) is unchanged, and withdrawal mechanics are otherwise unchanged.
  • The proposer rotation affects only the dormant permissioned fallback game. The active permissionless game (type 8) is untouched.
  • Both changes are reversible by the same ProxyAdmin owner if needed (the outgoing Gelato proposer address is recorded in the task for rollback).

Precommitment Impact Review

No precommitments are modified or removed. The chain remains on its current, governance-approved contract releases; no implementation code changes.

Action Plan

  • Ink Mainnet operator cutover: 2026-07-28 (independent of this proposal; not gated on it)
  • Veto period: one week from on-chain submission [TODO: submission date]
  • Execution: as a fast-follow after the veto period elapses and cutover completes; eth/061 is ready to sign now, eth/062 (in final review) merges once superchain-ops#1504 does
  • Contingency: if either task’s live preconditions drift before signing (signer nonces, gameArgs(1), initBonds(1), live vault config), the task is re-simulated and hashes regenerated per the task documentation.

Security Considerations

Both templates constrain the blast radius by construction. SetDisputeGameArgs diffs a single field against live state and asserts every other field is preserved; SetFeeVaultConfig writes only explicitly listed fields through the vaults’ own access-controlled setters, gated on the vault versions that support them, and fails at setup if the L2 ProxyAdmin owner is not the aliased L1 owner. The proposer rotation was executed on Ink Sepolia without incident. Neither change touches bridge or dispute-resolution logic. The new cost recipient is a freshly created address with no transaction history; eth/062 gates signing on a key-control proof (a dust transaction from the address or a signed message verified against it), since a wrong recipient would only be recoverable via another ProxyAdmin owner ceremony. No dedicated FMA exists for the SetFeeVaultConfig template; the applicable control is the superchain-ops template review process, under which the template’s cross-layer (L1→L2 deposit) operations were flagged for Security-team review.

Conclusion

These two maintenance actions complete Ink’s operator migration cleanup: chain fees flow to the consolidated L1 Cost Recipient, and the dormant permissioned game no longer authorizes a departed operator’s proposer key. This is an optimistic approval: token holders should vote only if they wish to veto. We request the Collective’s approval to proceed.

By submitting a proposal, you represent and warrant to the Optimism Collective that all the information it contains is true and complete to the best of your knowledge.

2 Likes
PGov - Delegate Communication Thread