feat(CHAIN-4707): add Zeronet SystemConfig ownership transfer task

Makefile

@@ -109,7 +109,7 @@ forge-deps:
 ##
 # Task Signer Tool
 ##
-SIGNER_TOOL_COMMIT=566102238bc78fb023f495372d6f80282efa05dd
+SIGNER_TOOL_COMMIT=1fc76441a1cde3581c224023adfa79b8cfdb2fa4
 SIGNER_TOOL_PATH=signer-tool
 
 .PHONY: checkout-signer-tool

Multisig.mk

@@ -27,15 +27,15 @@ require_vars = $(foreach _var,$(2),$(if $(strip $($(_var))),,$(error $(1): requi
 # MULTISIG_APPROVE: $(1)=address list (space-separated), $(2)=signatures (e.g., 0x or $(SIGNATURES))
 define MULTISIG_APPROVE
 $(call require_vars,MULTISIG_APPROVE,LEDGER_ACCOUNT RPC_URL SCRIPT_NAME) \
-	$(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) \
+	cd $(PROJECT_DIR) && $(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) \
 	--sig "approve(address[],bytes)" "[$(call comma_join,$(1))]" $(2) \
 	--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv
 endef
 
 # MULTISIG_EXECUTE: $(1)=signatures for run(bytes) (e.g., 0x or $(SIGNATURES))
 define MULTISIG_EXECUTE
 $(call require_vars,MULTISIG_EXECUTE,LEDGER_ACCOUNT RPC_URL SCRIPT_NAME) \
-	$(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) \
+	cd $(PROJECT_DIR) && $(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) \
 	--sig "run(bytes)" $(1) \
 	--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv
 endef
@@ -62,7 +62,7 @@ $(call require_vars,GEN_VALIDATION,RPC_URL LEDGER_ACCOUNT) \
 	cd $(SIGNER_TOOL_PATH) && \
 		$(MISE_EXEC) npx tsx scripts/genValidationFile.ts \
 			--rpc-url $(RPC_URL) \
-			--workdir $(CURDIR) \
+			--workdir $(PROJECT_DIR) \
 			--forge-cmd '$(if $(5),$(5) )mise exec -- forge script --rpc-url $(RPC_URL) $(1) --sig "sign(address[])" "[$(2)]" --sender $(3)' \
 			--ledger-id $(LEDGER_ACCOUNT) \
 			--out $(VALIDATIONS_DIR)/$(4)

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/FACILITATOR.md

@@ -0,0 +1,59 @@
+# Facilitator Guide
+
+Guide for facilitators managing the Zeronet `SystemConfig` owner transfer.
+
+## 1. Generate validation files
+
+Run this after any change to the task config or script:
+
+```bash
+cd contract-deployments/active/evm/tasks/2026-07-10-transfer-systemconfig-ownership
+make deps
+make gen-validation-cb
+make gen-validation-sc
+```
+
+This produces:
+
+- `config/zeronet/validations/base-signer.json`
+- `config/zeronet/validations/security-council-signer.json`
+
+The `--sender` in each `cmd` is derived from the first owner of the respective
+Safe (`CB_MULTISIG` for Coinbase, `BASE_SECURITY_COUNCIL` for Security Council).
+
+Because this is a Zeronet task, remove the generated `taskOriginConfig` and add
+this field at the JSON root in both validation files:
+
+```json
+"skipTaskOriginValidation": true
+```
+
+## 2. Collect signatures
+
+Ask signers to run `make sign-task` from the repository root and select
+**Transfer SystemConfig Ownership** on the `zeronet` network.
+
+## 3. Approve and execute
+
+From the task directory, execute the Coinbase and Security Council approvals:
+
+```bash
+SIGNATURES=AAABBBCCC make approve-cb
+SIGNATURES=AAABBBCCC make approve-sc
+make execute
+```
+
+## 4. Verify onchain
+
+```bash
+mise exec -- cast call 0x0a111C7980152bDe41D71f48e2E1d8184f5f6187 "owner()(address)" \
+  --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net
+```
+
+Expected result:
+
+```text
+0x856611ed7e07d83243b15e93f6321f2df6865852
+```
+
+Then set `Status: [EXECUTED](<transaction-url>)` in the signer README and commit the execution records.

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/Makefile

@@ -0,0 +1,42 @@
+include ../../../../Makefile
+include $(REPO_ROOT)/Multisig.mk
+
+TASK_NETWORK ?= zeronet
+PROJECT_DIR := $(abspath ../..)
+
+include $(REPO_ROOT)/config/$(TASK_NETWORK).env
+include config/$(TASK_NETWORK)/.env
+
+export PROXY_ADMIN_OWNER
+export INCIDENT_MULTISIG
+export SYSTEM_CONFIG
+export FOUNDRY_BROADCAST := $(CURDIR)
+
+SIGNER_TOOL_PATH := $(REPO_ROOT)/signer-tool
+VALIDATIONS_DIR := $(CURDIR)/config/$(TASK_NETWORK)/validations
+RPC_URL := $(L1_RPC_URL)
+
+SCRIPT_NAME := script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership
+CB_SENDER = $(shell $(MISE_EXEC) cast call $(CB_MULTISIG) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+SC_SENDER = $(shell $(MISE_EXEC) cast call $(BASE_SECURITY_COUNCIL) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+TRANSFER_OWNERSHIP_ENV = PROXY_ADMIN_OWNER=$(PROXY_ADMIN_OWNER) INCIDENT_MULTISIG=$(INCIDENT_MULTISIG) SYSTEM_CONFIG=$(SYSTEM_CONFIG)
+
+.PHONY: gen-validation-cb
+gen-validation-cb: deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),$(CB_MULTISIG),$(CB_SENDER),base-signer.json,$(TRANSFER_OWNERSHIP_ENV))
+
+.PHONY: gen-validation-sc
+gen-validation-sc: deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),$(BASE_SECURITY_COUNCIL),$(SC_SENDER),security-council-signer.json,$(TRANSFER_OWNERSHIP_ENV))
+
+.PHONY: approve-cb
+approve-cb:
+	$(call MULTISIG_APPROVE,$(CB_MULTISIG),$(SIGNATURES))
+
+.PHONY: approve-sc
+approve-sc:
+	$(call MULTISIG_APPROVE,$(BASE_SECURITY_COUNCIL),$(SIGNATURES))
+
+.PHONY: execute
+execute:
+	$(call MULTISIG_EXECUTE,0x)

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/.env

@@ -0,0 +1,2 @@
+# https://github.com/base/contracts/tree/v8.2.1
+BASE_CONTRACTS_COMMIT=f3a33c8577c8ca1e037b45e822bfcb75f099270b

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/README.md

@@ -0,0 +1,25 @@
+# Transfer SystemConfig Ownership
+
+Status: READY TO SIGN
+
+## Description
+
+Transfer the Zeronet `SystemConfig` owner from the proxy admin owner Safe to the incident multisig.
+
+## Addresses
+
+| Role | Address |
+| -- | -- |
+| `SystemConfig` | `0x0a111C7980152bDe41D71f48e2E1d8184f5f6187` |
+| Current owner | `0x3d59999977e0896ee1f8783bB8251DF16fb483E9` |
+| New owner | `0x856611ed7e07d83243b15e93f6321f2df6865852` |
+
+## Sign
+
+From the repository root:
+
+```bash
+make sign-task
+```
+
+Open [http://localhost:3000](http://localhost:3000), select this Zeronet task, sign, and send the signature to the facilitator.

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/base-signer.json

@@ -0,0 +1,92 @@
+{
+  "cmd": "PROXY_ADMIN_OWNER=0x3d59999977e0896ee1f8783bb8251df16fb483e9 INCIDENT_MULTISIG=0x856611ed7e07d83243b15e93f6321f2df6865852 SYSTEM_CONFIG=0x0a111c7980152bde41d71f48e2e1d8184f5f6187 mise exec -- forge script --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership --sig sign(address[]) [0x856611ed7e07d83243b15e93f6321f2df6865852] --sender 0x2c1475476B586d66a85bC65A5aB396BBbAa4f3aD",
+  "ledgerId": 1,
+  "rpcUrl": "https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net",
+  "expectedDomainAndMessageHashes": {
+    "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+    "domainHash": "0xc88eae2baaa4c8513a3d87913666de9463f106158aaf8be5cd31588215ccd5c4",
+    "messageHash": "0xbfa4bac86f8b9687cf69f94cb1777c94b5cd0d47299ce2c2faf712e710a20430"
+  },
+  "stateOverrides": [
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "CB Signer Safe - Zeronet",
+      "address": "0x856611eD7E07D83243b15E93f6321f2df6865852",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        },
+        {
+          "key": "0x959d565b3f930eb27afc5160e96a82f7b009868594760118dfcd5423c8223a5c",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Simulates an approval from msg.sender in order for the task simulation to succeed.",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "stateChanges": [
+    {
+      "name": "SystemConfig - Zeronet",
+      "address": "0x0a111C7980152bDe41D71f48e2E1d8184f5f6187",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000033",
+          "before": "0x0000000000000000000000003d59999977e0896ee1f8783bb8251df16fb483e9",
+          "after": "0x000000000000000000000000856611ed7e07d83243b15e93f6321f2df6865852",
+          "description": "Transfers ownership to the incident multisig",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000014",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000015",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        },
+        {
+          "key": "0x997c3974baa1d5a4276493e3da30992ec4683d57101ee29ac1c5a410892aa5f3",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Records the nested Safe approval",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "CB Signer Safe - Zeronet",
+      "address": "0x856611eD7E07D83243b15E93f6321f2df6865852",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x000000000000000000000000000000000000000000000000000000000000001a",
+          "after": "0x000000000000000000000000000000000000000000000000000000000000001b",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "balanceChanges": [],
+  "skipTaskOriginValidation": true
+}

active/evm/tasks/2026-07-10-transfer-systemconfig-ownership/config/zeronet/validations/security-council-signer.json

@@ -0,0 +1,86 @@
+{
+  "cmd": "PROXY_ADMIN_OWNER=0x3d59999977e0896ee1f8783bb8251df16fb483e9 INCIDENT_MULTISIG=0x856611ed7e07d83243b15e93f6321f2df6865852 SYSTEM_CONFIG=0x0a111c7980152bde41d71f48e2e1d8184f5f6187 mise exec -- forge script --rpc-url https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership --sig sign(address[]) [0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA] --sender 0x2c1475476B586d66a85bC65A5aB396BBbAa4f3aD",
+  "ledgerId": 1,
+  "rpcUrl": "https://c3-chainproxy-eth-hoodi-full-dev.cbhq.net",
+  "expectedDomainAndMessageHashes": {
+    "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+    "domainHash": "0x1e2faea9157fbff31d9297595a71e2dedfeb1184207c07bb6bd64f807332a525",
+    "messageHash": "0xae6685da5cc0a954d8dc78cffc524d14a6e664bd5b300ba55287372d80c25fad"
+  },
+  "stateOverrides": [
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "overrides": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000004",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Override the threshold to 1 so the transaction simulation can occur.",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Security Council Safe - Zeronet",
+      "address": "0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA",
+      "overrides": [
+        {
+          "key": "0xd83b46009449ab7b1148bc60c09e0301c8656492806daae6ba4b607a0ff82284",
+          "value": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Simulates an approval from msg.sender in order for the task simulation to succeed.",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "stateChanges": [
+    {
+      "name": "SystemConfig - Zeronet",
+      "address": "0x0a111C7980152bDe41D71f48e2E1d8184f5f6187",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000033",
+          "before": "0x0000000000000000000000003d59999977e0896ee1f8783bb8251df16fb483e9",
+          "after": "0x000000000000000000000000856611ed7e07d83243b15e93f6321f2df6865852",
+          "description": "Transfers ownership to the incident multisig",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Proxy Admin Owner - Zeronet",
+      "address": "0x3d59999977e0896ee1f8783bB8251DF16fb483E9",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000014",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000015",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        },
+        {
+          "key": "0x0357b2352703f016eba49e117877cc0170c3c53d22e138fd6501caa01b912570",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000001",
+          "description": "Records the nested Safe approval",
+          "allowDifference": false
+        }
+      ]
+    },
+    {
+      "name": "Security Council Safe - Zeronet",
+      "address": "0xC4c0aD998B5DfA4CF4B298970F21b9015a5eE7bA",
+      "changes": [
+        {
+          "key": "0x0000000000000000000000000000000000000000000000000000000000000005",
+          "before": "0x0000000000000000000000000000000000000000000000000000000000000017",
+          "after": "0x0000000000000000000000000000000000000000000000000000000000000018",
+          "description": "Increments the nonce",
+          "allowDifference": false
+        }
+      ]
+    }
+  ],
+  "balanceChanges": [],
+  "skipTaskOriginValidation": true
+}