Maintenance Upgrade Proposal: Unichain Mainnet Proposer Rotation and L1 Cost Fee Routing

Proposals 📃
1

I’m Andrea Federici, Senior Solutions Engineer at OP Labs. This proposal covers three administrative updates to Unichain Mainnet (chain ID 130) that require execution by the L1 ProxyAdmin owner, a 2-of-2 Safe governed jointly by the Optimism Foundation and the Security Council. This proposal has been reviewed by Matthew Cruz and Matt Solomon from the OP Labs team.

Proposal Type

Maintenance Upgrade

Voting Cycle Type

Off-cycle. Per the OPerating Manual, Maintenance Upgrade Proposals proceed directly to on-chain voting under optimistic approval, with a one-week veto period and a 20% veto threshold.

Executive Summary

Unichain Mainnet is migrating its sequencer operations from Uniswap Labs to the Optimism Foundation as chain servicer via OP Enterprise, with cutover targeted for 2026-10-29. Most of the migration does not require governance action:

  • Unichain’s L1 ProxyAdmin owner is already the standard Optimism governance 2-of-2 (Foundation Upgrade Safe + Security Council), following the ProxyAdmin owner transition executed on 2026-09-14.
  • The SystemConfig ownership moves from Uniswap’s SystemConfig owner Safe to the Foundation Upgrade Safe, executed by Uniswap from its own Safe, and the batcher and unsafe block signer are then rotated by the SystemConfig owner. These use the SystemConfig owner role, not the ProxyAdmin owner role.
  • The respected dispute game is the permissionless SUPER_CANNON_KONA (game type 9), which has no on-chain proposer, so the new operator can propose outputs without any configuration change.

Three items do exercise the ProxyAdmin owner role, and are therefore submitted here for approval:

  1. Proposer rotation. Rotate the proposer of Unichain’s SUPER_PERMISSIONED dispute game (game type 5) from the outgoing Uniswap key 0xD5F0E2912C70771C589CD8bB087EDE0Dab4AFA9A to the OP Enterprise proposer 0x86b392cA30aD7453c8d88B56EB5A04fD0E2175b7. Since Upgrade 20 this is the permissioned fallback game; it has a proposer and no challenger role.
  2. L1Splitter ownership and recipient. Unichain’s fee vaults do not pay a single recipient: the SequencerFeeVault, BaseFeeVault and L1FeeVault all pay into Uniswap’s FeeSplitter, which splits proceeds into three legs. The L1-fee leg, the L1Splitter at 0x4300c0d3c0d3c0D3c0d3C0D3c0d3C0D3C0D30003, receives the share that covers L1 data costs. This proposal has the L1 ProxyAdmin owner accept ownership of that contract (Uniswap initiates the handover) and redirect its withdrawals from Uniswap’s address 0x7078c4537C04c2b2E52ddBa06074dBdACF23cA15 to the OP Enterprise L1 cost recipient for Unichain 0x7d324ADedacddc6A284245279C6856eFAcEAA915, which funds the operator’s L1 batcher and proposer costs, lowering its minimum withdrawal from 10 ETH to 0.15 ETH.
  3. OperatorFeeVault config update. Point the OperatorFeeVault, which sits outside the FeeSplitter and currently forwards to the BaseFeeVault on L2, at the same OP Enterprise L1 cost recipient, withdrawing to L1 with a 0.15 ETH minimum.

None of these changes affects protocol behavior, dispute game mechanics, bridge safety, or end users. The FeeSplitter’s other two legs (the Optimism share at …0002 and Uniswap’s net revenue at …0004) and the three fee vaults that feed it are not touched, so the revenue split agreed between Unichain and the Collective is unchanged. Impacted stakeholders are limited to the chain operator (OP Enterprise assumes the proposer role on the fallback game and receives the L1-cost share) and Uniswap Labs (which stops receiving the L1-cost share, as it stops paying L1 costs).

Motivation

Unichain’s operator migration consolidates the chain’s operations under OP Enterprise. Three pieces of chain configuration still reference the outgoing operator:

  • The SUPER_PERMISSIONED game proposer is still Uniswap’s key. The game is a fallback, but leaving a departed operator’s key authorized on it is incorrect state, and would matter if the Guardian ever made the permissioned game respected again.
  • The L1-fee leg of the FeeSplitter pays Uniswap’s L1 address. After the migration the operator, not Uniswap, pays Unichain’s L1 data costs, so this leg must follow the costs. The contract is Ownable2Step and owned by the L2 alias of Uniswap’s SystemConfig owner Safe; once the migration completes Uniswap no longer operates that key for the chain, so ownership moves to the same governance owner that already controls Unichain’s fee vaults.
  • The OperatorFeeVault is a cleanup item. Operator fees are configured to zero on Unichain today, but the vault should route to the operator’s cost recipient like on other OP Enterprise chains.

All three actions can only be taken by the L1 ProxyAdmin owner (for the L1Splitter, once Uniswap has initiated the transfer to its alias). Under the OPerating Manual these are maintenance changes: they do not materially change the behavior of the protocol for end users, infra providers, or chain governors.

The proposal is submitted by OP Labs, which operates OP Enterprise; this is a conflict of interest in the narrow sense that OP Labs benefits from the migration completing cleanly and the L1-cost share is redirected to the operator’s cost recipient. Fee flows remain within the arrangements agreed between Unichain and the Collective.

Specifications

Change 1: SUPER_PERMISSIONED proposer rotation

Executed via superchain-ops task eth/078-unichain-proposer-rotation, using the SetDisputeGameArgs template (extended for game type 5 in superchain-ops#1562):

  • DisputeGameFactoryProxy: 0x2F12d621a16e2d3285929C9996f478508951dFe4
  • One call: setImplementation(5, impl, gameArgs), where the type-5 gameArgs are anchorStateRegistry | proposer. The task reads the live value and swaps only the proposer: 0xD5F0E2912C70771C589CD8bB087EDE0Dab4AFA9A (Uniswap) → 0x86b392cA30aD7453c8d88B56EB5A04fD0E2175b7 (independently verified by 3 OP Labs engineers before signing)
  • The implementation (0x5C3eb47cB0174aea522a2a9Ae79487139A53D691, SuperPermissionedDisputeGame v1.1.0), the AnchorStateRegistry (0x27Cf508E4E3Aa8d30b3226aC3b5Ea0e8bcaCAFF9) and the zero init bond are preserved
  • There is no challenger to rotate: Upgrade 20 removed the challenger role from the permissioned game, and the respected game (type 9) is permissionless
  • Rehearsed on Unichain Sepolia as task sep/111-unichain-sepolia-proposer-rotation

Change 2: L1Splitter ownership and recipient

The L1Splitter (0x4300c0d3c0d3c0D3c0d3C0D3c0d3C0D3C0D30003, Uniswap unichain-contracts src/FeeSplitter/L1Splitter.sol) is an Ownable2Step contract whose owner can set its L1 recipient, minimum withdrawal and disbursement interval; withdraw() is permissionless and bridges the balance to the L1 recipient. Live state (verified 2026-10-15): owner 0xa356d5D10aA8A842B31530dE71EA86c0760CB2C2 (alias of Uniswap’s SystemConfig owner Safe 0x9245d5D10AA8a842B31530De71EA86c0760Ca1b1), L1 recipient 0x7078c4537C04c2b2E52ddBa06074dBdACF23cA15, minimum withdrawal 10 ETH, interval 24h.

The handover takes two upgrade tasks, each a portal deposit (OptimismPortal2 0x0bd48f6B86a26D3a217d0Fa6FfE2B491B956A7a2) executed on L2 by the sender’s alias, using the new SetL1SplitterConfig template:

  • eth/076, signed by Uniswap’s Safe (not part of this approval): transferOwnership(0x6B1BAE59D09fCcbdDB6C6cceb07B7279367C4E3b), the alias of the L1 ProxyAdmin owner.
  • eth/079, signed by the L1 ProxyAdmin owner (this approval): three deposits, acceptOwnership(), updateL1Recipient(0x7d324ADedacddc6A284245279C6856eFAcEAA915) and updateMinWithdrawalAmount(0.15 ETH). The disbursement interval is unchanged.

The template dry-runs every call against a fork of Unichain at signing time and asserts the resulting owner, pending owner, recipient and minimum. Until eth/076 has been relayed on L2, the simulation sets the pending owner on the fork; before eth/079 is executed, the facilitator confirms on-chain that the L1Splitter’s pendingOwner() is the alias of the L1 ProxyAdmin owner. Tasks: eth/076-unichain-l1splitter-transfer-ownership and eth/079-unichain-l1splitter-accept-and-configure.

Change 3: OperatorFeeVault config update (in-place setters)

Executed via task eth/080-unichain-operator-fee-vault with the SetFeeVaultConfig template, as for Ink. The OperatorFeeVault (0x420000000000000000000000000000000000001b, v1.1.1) is updated through its owner-gated setters, authorized against the L2 ProxyAdmin owner (the aliased L1 ProxyAdmin owner, verified on-chain): recipient 0x4200000000000000000000000000000000000019 (BaseFeeVault) → 0x7d324ADedacddc6A284245279C6856eFAcEAA915 withdrawalNetwork L2 → L1, minWithdrawalAmount 0 → 0.15 ETH, exactly three deposits. No implementation or proxy is upgraded. The SequencerFeeVault, BaseFeeVault and L1FeeVault are not touched.

Signing

eth/078, eth/079 and eth/080 are signed by the Unichain L1 ProxyAdmin owner Safe 0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A, a nested 2-of-2 of the Foundation Upgrade Safe 0x847B5c174615B1B7fDF770882256e2D3E95b9D92 and the Security Council 0xc2819DC788505Aac350142A7A707BF9D03E3Bd03. Domain and message hashes, the byte-level calldata breakdown and post-execution checks are recorded in each task’s VALIDATION.md.

Task calldata

Each task is a single Multicall3DelegateCall.aggregate3Value call executed by the L1 ProxyAdmin owner 0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A. Decode with cast calldata-decode "aggregate3Value((address,bool,uint256,bytes)[])" <calldata>.

eth/078: SUPER_PERMISSIONED proposer rotation

0x174dea710000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000200000000000000000000000002f12d621a16e2d3285929c9996f478508951dfe400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000c4b107095700000000000000000000000000000000000000000000000000000000000000050000000000000000000000005c3eb47cb0174aea522a2a9ae79487139a53d6910000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000002827cf508e4e3aa8d30b3226ac3b5ea0e8bcacaff986b392ca30ad7453c8d88b56eb5a04fd0e2175b700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

eth/079: L1Splitter accept, recipient and minimum withdrawal

0x174dea71000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000003c00000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000e4e9e05c420000000000000000000000004300c0d3c0d3c0d3c0d3c0d3c0d3c0d3c0d30003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000479ba509700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c420000000000000000000000004300c0d3c0d3c0d3c0d3c0d3c0d3c0d3c0d30003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000024f62b61050000000000000000000000007d324adedacddc6a284245279c6856efaceaa91500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c420000000000000000000000004300c0d3c0d3c0d3c0d3c0d3c0d3c0d3c0d30003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000024c1c4ed2c0000000000000000000000000000000000000000000000000214e8348c4f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

eth/080: OperatorFeeVault recipient, withdrawal network and minimum withdrawal

0x174dea71000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000022000000000000000000000000000000000000000000000000000000000000003e00000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c42000000000000000000000000420000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000243bbed4a00000000000000000000000007d324adedacddc6a284245279c6856efaceaa91500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c42000000000000000000000000420000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000024307f2962000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd48f6b86a26d3a217d0fa6ffe2b491b956a7a20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000104e9e05c42000000000000000000000000420000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000249f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000002485b5b14d0000000000000000000000000000000000000000000000000214e8348c4f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Impact Summary

  • No downtime, no protocol behavior change, no state migration. Each change is a small number of storage writes on L1 (dispute game factory) or L2 (L1Splitter, OperatorFeeVault).
  • Users and infra providers take no action.
  • The L1-cost share of Unichain’s fees is withdrawn to the operator’s L1 Cost Recipient instead of Uniswap’s address. The Optimism share and Uniswap’s net revenue are unchanged.
  • The L1 ProxyAdmin owner takes on ownership of one non-OP-Stack contract (the L1Splitter). Its powers over it are limited to the recipient, minimum withdrawal and disbursement interval, and transferring ownership.
  • The proposer rotation affects only the permissioned fallback game; the respected permissionless game (type 9) is untouched.
  • All changes are reversible by the same owner if needed.

Precommitment Impact Review

No precommitments are modified or removed. The chain remains on its current, governance-approved contract releases; no implementation code changes.

Action Plan

  • Unichain Sepolia rehearsal (sep/111 proposer rotation): 2026-10-13. Unichain Sepolia’s fee vaults are not transferred (its fee splitter has no owner or setters), so the fee steps are exercised on a mainnet fork in the templates’ regression tests instead.
  • Veto period: one week from on-chain submission
  • Unichain Mainnet cutover: 2026-10-29. eth/078 is pre-signed and executed at cutover; eth/079 executes once Uniswap’s eth/076 has been relayed on L2; eth/080 executes after cutover.
  • Contingency: if live preconditions drift before signing (signer nonces, gameArgs(5), L1Splitter or vault state), the tasks are re-simulated and hashes regenerated per the task documentation. If eth/076 has not landed, eth/079 is not executed.

Security Considerations

The templates constrain the blast radius by construction. SetDisputeGameArgs diffs a single field against live state and preserves every other field; for game type 5 it accepts only the 40-byte layout and a zero bond. SetL1SplitterConfig and SetFeeVaultConfig write only listed fields through the contracts’ own access-controlled setters, skip unchanged values, dry-run every call on an L2 fork at setup, and re-derive every deposit byte for byte before signing. Both template changes went through the superchain-ops template review process and were approved by the Security team (superchain-ops#1562, #1567), including the cross-layer (L1→L2 deposit) operations.

Conclusion

These three maintenance actions complete the governance-owned part of Unichain’s operator migration: the fallback game no longer authorizes the departed operator’s proposer, the L1-cost share of fees follows the party that pays L1 costs, and the OperatorFeeVault routes like other OP Enterprise chains. This is an optimistic approval: token holders should vote only if they wish to veto. We request the Collective’s approval to proceed.

By submitting a proposal, you represent and warrant to the Optimism Collective that all the information it contains is true and complete to the best of your knowledge.