feat(CHAIN-4707): add Zeronet SystemConfig ownership transfer task

active/evm/Makefile

@@ -0,0 +1,51 @@
+include ../../Makefile
+include ../../Multisig.mk
+
+TASK_NETWORK ?= zeronet
+TASK_ID ?= 2026-07-10-transfer-systemconfig-ownership
+TASK_DIR = tasks/$(TASK_ID)
+
+include $(REPO_ROOT)/config/$(TASK_NETWORK).env
+include $(TASK_DIR)/config/$(TASK_NETWORK)/.env
+
+export BASE_CONTRACTS_COMMIT
+export PROXY_ADMIN_OWNER
+export INCIDENT_MULTISIG
+export SYSTEM_CONFIG
+export RECORD_STATE_DIFF
+export FOUNDRY_BROADCAST = $(TASK_DIR)
+
+SIGNER_TOOL_PATH = ../../signer-tool
+VALIDATIONS_DIR = $(CURDIR)/$(TASK_DIR)/config/$(TASK_NETWORK)/validations
+# Task-origin signatures are stored OUTSIDE the config directory, at
+# tasks/<task-id>/signatures/<network>/. The signer tool signs over the
+# config/<network> tarball (TASK_ORIGIN_DIR); keeping signatures out of that
+# directory ensures generating them does not change the signed payload.
+TASK_ORIGIN_DIR = $(CURDIR)/$(TASK_DIR)/config/$(TASK_NETWORK)
+SIGNATURE_DIR = $(CURDIR)/$(TASK_DIR)/signatures/$(TASK_NETWORK)
+RPC_URL = $(L1_RPC_URL)
+
+SCRIPT_NAME = script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership
+CB_SENDER = $(shell $(MISE_EXEC) cast call $(CB_MULTISIG) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+SC_SENDER = $(shell $(MISE_EXEC) cast call $(BASE_SECURITY_COUNCIL) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+TRANSFER_OWNERSHIP_ENV = PROXY_ADMIN_OWNER=$(PROXY_ADMIN_OWNER) INCIDENT_MULTISIG=$(INCIDENT_MULTISIG) SYSTEM_CONFIG=$(SYSTEM_CONFIG) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+
+.PHONY: gen-validation-cb
+gen-validation-cb: deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),$(CB_MULTISIG),$(CB_SENDER),base-signer.json,$(TRANSFER_OWNERSHIP_ENV))
+
+.PHONY: gen-validation-sc
+gen-validation-sc: deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),$(BASE_SECURITY_COUNCIL),$(SC_SENDER),security-council-signer.json,$(TRANSFER_OWNERSHIP_ENV))
+
+.PHONY: approve-cb
+approve-cb:
+	$(call MULTISIG_APPROVE,$(CB_MULTISIG),$(SIGNATURES))
+
+.PHONY: approve-sc
+approve-sc:
+	$(call MULTISIG_APPROVE,$(BASE_SECURITY_COUNCIL),$(SIGNATURES))
+
+.PHONY: execute
+execute:
+	$(call MULTISIG_EXECUTE,0x)

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/FACILITATOR.md

@@ -0,0 +1,59 @@
+# Facilitator Guide
+
+Guide for facilitators managing the Zeronet `SystemConfig` owner transfer.
+
+## 1. Generate validation files
+
+Run this after any change to the task config or script:
+
+```bash
+cd contract-deployments/active/evm
+make deps
+make gen-validation-cb
+make gen-validation-sc
+```
+
+This produces:
+
+- `tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/base-signer.json`
+- `tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/security-council-signer.json`
+
+The `--sender` in each `cmd` is derived from the first owner of the respective
+Safe (`CB_MULTISIG` for Coinbase, `BASE_SECURITY_COUNCIL` for Security Council).
+
+Because this is a Zeronet task, keep this field at the JSON root in both
+validation files (it is committed with the generated files):
+
+```json
+"skipTaskOriginValidation": true
+```
+
+## 2. Collect signatures
+
+Ask signers to run `make sign-task` from the repository root and select
+**Transfer SystemConfig Ownership** on the `zeronet` network.
+
+## 3. Approve and execute
+
+From `active/evm`, execute the Coinbase and Security Council approvals:
+
+```bash
+SIGNATURES=AAABBBCCC make approve-cb
+SIGNATURES=AAABBBCCC make approve-sc
+make execute
+```
+
+## 4. Verify onchain
+
+```bash
+cast call 0x0a111C7980152bDe41D71f48e2E1d8184f5f6187 "owner()(address)" \
+  --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net
+```
+
+Expected result:
+
+```text
+0x856611ed7e07d83243b15e93f6321f2df6865852
+```
+
+Then update the task status to `EXECUTED` with the transaction link and commit the execution records.

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/.env

@@ -0,0 +1,4 @@
+# https://github.com/base/contracts/tree/v8.2.1
+BASE_CONTRACTS_COMMIT=f3a33c8577c8ca1e037b45e822bfcb75f099270b
+
+RECORD_STATE_DIFF=true

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/README.md

@@ -0,0 +1,25 @@
+# Transfer Zeronet `SystemConfig` Owner
+
+Status: READY TO SIGN
+
+## Description
+
+Transfer the Zeronet `SystemConfig` owner from the proxy admin owner Safe to the incident multisig.
+
+## Addresses
+
+| Role | Address |
+| -- | -- |
+| `SystemConfig` | `0x0a111C7980152bDe41D71f48e2E1d8184f5f6187` |
+| Current owner | `0x3d59999977e0896ee1f8783bB8251DF16fb483E9` |
+| New owner | `0x856611ed7e07d83243b15e93f6321f2df6865852` |
+
+## Sign
+
+From the repository root:
+
+```bash
+make sign-task
+```
+
+Open [http://localhost:3000](http://localhost:3000), select this Zeronet task, sign, and send the signature to the facilitator.

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/base-signer.json

@@ -0,0 +1,97 @@
+{
+  "cmd": "PROXY_ADMIN_OWNER=0x3d59999977e0896ee1f8783bb8251df16fb483e9 INCIDENT_MULTISIG=0x856611ed7e07d83243b15e93f6321f2df6865852 SYSTEM_CONFIG=0x0a111c7980152bde41d71f48e2e1d8184f5f6187 RECORD_STATE_DIFF=true mise exec -- forge script --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership --sig sign(address[]) [0x856611ed7e07d83243b15e93f6321f2df6865852] --sender 0x2c1475476B586d66a85bC65A5aB396BBbAa4f3aD",
+  "ledgerId": 1,
+  "rpcUrl": "https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net",
+  "expectedDomainAndMessageHashes": {
+    "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+    "domainHash": "0xc88eae2baaa4c8513a3d87913666de9463f106158aaf8be5cd31588215ccd5c4",
+    "messageHash": "0xbfa4bac86f8b9687cf69f94cb1777c94b5cd0d47299ce2c2faf712e710a20430"
+  },
+  "stateOverrides": [
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "CB Signer Safe - Zeronet",
+      "address": "0x856611eD7E07D83243b15E93f6321f2df6865852",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        },
+        {
+          "key": "0x959d565b3f930eb27afc5160e96a82f7b009868594760118dfcd5423c8223a5c",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Simulates an approval from msg.sender in order for the task simulation to succeed.",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "stateChanges": [
+    {
+      "name": "SystemConfig - Zeronet",
+      "address": "0x0a111C7980152bDe41D71f48e2E1d8184f5f6187",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000033",
+          "before": "0x0000000000000000000000003d59999977e0896ee1f8783bb8251df16fb483e9",
+          "after": "0x000000000000000000000000856611ed7e07d83243b15e93f6321f2df6865852",
+          "description": "Transfers ownership to the incident multisig",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000014",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000015",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        },
+        {
+          "key": "0x997c3974baa1d5a4276493e3da30992ec4683d57101ee29ac1c5a410892aa5f3",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Records the nested Safe approval",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "CB Signer Safe - Zeronet",
+      "address": "0x856611eD7E07D83243b15E93f6321f2df6865852",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x000000000000000000000000000000000000000000000000000000000000001a",
+          "after": "0x000000000000000000000000000000000000000000000000000000000000001b",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "balanceChanges": [],
+  "taskOriginConfig": {
+    "taskCreator": {
+      "commonName": "thanh.trinh@coinbase.com"
+    }
+  },
+  "skipTaskOriginValidation": true
+}

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/security-council-signer.json

@@ -0,0 +1,91 @@
+{
+  "cmd": "PROXY_ADMIN_OWNER=0x3d59999977e0896ee1f8783bb8251df16fb483e9 INCIDENT_MULTISIG=0x856611ed7e07d83243b15e93f6321f2df6865852 SYSTEM_CONFIG=0x0a111c7980152bde41d71f48e2e1d8184f5f6187 RECORD_STATE_DIFF=true mise exec -- forge script --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership --sig sign(address[]) [0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA] --sender 0x2c1475476B586d66a85bC65A5aB396BBbAa4f3aD",
+  "ledgerId": 1,
+  "rpcUrl": "https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net",
+  "expectedDomainAndMessageHashes": {
+    "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+    "domainHash": "0x1e2faea9157fbff31d9297595a71e2dedfeb1184207c07bb6bd64f807332a525",
+    "messageHash": "0xae6685da5cc0a954d8dc78cffc524d14a6e664bd5b300ba55287372d80c25fad"
+  },
+  "stateOverrides": [
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Security Council Safe - Zeronet",
+      "address": "0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA",
+      "overrides": [
+        {
+          "key": "0xd83b46009449ab7b1148bc60c09e0301c8656492806daae6ba4b607a0ff82284",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Simulates an approval from msg.sender in order for the task simulation to succeed.",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "stateChanges": [
+    {
+      "name": "SystemConfig - Zeronet",
+      "address": "0x0a111C7980152bDe41D71f48e2E1d8184f5f6187",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000033",
+          "before": "0x0000000000000000000000003d59999977e0896ee1f8783bb8251df16fb483e9",
+          "after": "0x000000000000000000000000856611ed7e07d83243b15e93f6321f2df6865852",
+          "description": "Transfers ownership to the incident multisig",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000014",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000015",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        },
+        {
+          "key": "0x0357b2352703f016eba49e117877cc0170c3c53d22e138fd6501caa01b912570",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Records the nested Safe approval",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Security Council Safe - Zeronet",
+      "address": "0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000017",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000018",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "balanceChanges": [],
+  "taskOriginConfig": {
+    "taskCreator": {
+      "commonName": "thanh.trinh@coinbase.com"
+    }
+  },
+  "skipTaskOriginValidation": true
+}