Should the Lido DAO recognize the wstETH Bridge Endpoints on zkSync Era as canonical?

Introduction

The proposal is to recognize the wstETH token bridging endpoints on zkSync Era by the Lido DAO. If Snapshot passes, the Lido DAO will control the endpoints of wstETH token contract (including the token contract on zkSync Era itself) as a proxy admin. Lido DAO will only have the upgrade authority of the wstETH proxy contract, and will not be able to manage the native bridge itself.

Matter Labs proposed the deployment of wstETH (Wrapped staked ETH) to zkSync Era, with the ultimate goal of recognizing the wstETH token bridging endpoints by the Lido DAO.

Namely:

1. Upgrade authority set to the Lido DAO Aragon Agent contract on L1 and L2
2. Pausability by Emergency Brakes multisig.

This initiative has been undertaken by the Matter Labs & TxFusion team who deployed the wstETH components for the zkSync’s native bridge to zkSync, inspired by the same open-source solution previously applied in the Optimism deployment.

The proposed components utilize zkSync’s native bridge instance for the message transfer. The token’s upgradeability is possible, due to the token proxy admin being set to Lido DAO and separate from the bridge admin (zkSync Era) instance. This approach aligns with the unofficial guidelines presented by NEW (Network Expansion Workgroup) and is future-ready for wstETH. As such, neither the bridge or Lido DAO take any additional fees from users. The regular gas fees required for transaction execution will still be charged to the user. In case of an emergency, Lido Emergency Breaks multisig will be used to pause the deposits and withdrawals only for the wstETH transfers. In order to resume the bridging activity for wstETH, there will be a need for a Lido DAO on chain vote on Ethereum mainnet.

Motivation

zkSync Era Mainnet was launched on March 24, 2023. zkSync currently crossed over $440M TVL (grown +50% in the last four months), and unique wallets have crossed 3.7M. Transaction volume has averaged +15% week-over-week growth the last four months with a few times surpassing Ethereum itself on daily transactions.

This marks just the beginning with key network infrastructure upgrades coming within the next few months which will catalyze growth of TVL, users and transaction growth, as many protocols will now be able to launch.

Lido wstETH has the overwhelming market share of staked ETH and can be used interoperably in DeFi. Therefore, major ecosystems such as zkSync have significant demand for wstETH as it opens up opportunities for users to utilize stETH holdings in various DeFi protocols. Some examples include using wstETH as collateral, lending, indexing, minting, vaults, stables, etc.

Taking a page from the Optimism playbook, we're leveraging an open-source solution (check out GitHub) to make this happen.

We're proposing that the Lido DAO formally recognizes these bridging endpoints as canonical. Canonical means native/default. In the bridging context, a canonical token is the one that is minted by the native bridge such as zkSync’s native bridge in this case.

Audits

To better form an opinion you may consider reading through the following audit reports.

Cantina audit report

Reference to the levers and ACL setup

Mainnet Contracts

Previously existing Lido contracts on Ethereum:

• DAO Agent on L1: 0x3e40D73EB977Dc6a537aF587D48316feE66E9C8c
• Emergency Brakes 3/5 Multisig on L1: 0x73b047fe6337183A454c5217241D780a932777bD
• wstETH on L1: 0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0

Newly deployed contracts on Ethereum:

• L1ERC20Bridge: 0x41527B2d03844dB6b0945f25702cB958b6d55989
• L1Executor: 0xFf7F4d05e3247374e86A3f7231A2Ed1CA63647F2

Newly deployed contracts on zkSync Era:

• Emergency Brakes 3/5 Multisig on L2: 0x0D7F0A811978B3B62CbfF4EF6149B5909EAcfE94
• wstETH on L2: 0x703b52F2b28fEbcB60E1372858AF5b18849FE867
• L2ERC20Bridge: 0xE1D6A50E7101c8f8db77352897Ee3f1AC53f782B
• ZkSyncBridgeExecutor: 0x139EE25DCad405d2a038E7A67f9ffdbf0f573f3c

Deployment artefacts and levers setup:

• for L1Executor
  • Proxy admin is the Lido DAO Agent
  • owner is the Lido DAO Agent
• for ZkSyncBridgeExecutor
  • Proxy admin is aliased (L1Executor) via ProxyAdmin
  • getEthereumGovernanceExecutor is aliased (L1Executor) (admin)
• A bridge admin and role holder on L1 is the Lido DAO Agent
  • Proxy admin for L1ERC20Bridge
  • DEFAULT_ADMIN_ROLE for L1ERC20Bridge
  • WITHDRAWALS_DISABLER_ROLE for L1ERC20Bridge
  • WITHDRAWALS_ENABLER_ROLE for L1ERC20Bridge
  • DEPOSITS_DISABLER_ROLE for L1ERC20Bridge
  • DEPOSITS_ENABLER_ROLE for L1ERC20Bridge
• A bridge admin and role holder on L2 is the ZkSyncBridgeExecutor
  • Proxy admin for L2ERC20Bridge
  • DEFAULT_ADMIN_ROLE for L2ERC20Bridge
  • WITHDRAWALS_DISABLER_ROLE for L2ERC20Bridge
  • WITHDRAWALS_ENABLER_ROLE for L2ERC20Bridge
  • DEPOSITS_DISABLER_ROLE for L2ERC20Bridge
  • DEPOSITS_ENABLER_ROLE for L2ERC20Bridge
• for ERC20BridgedUpgradeable (wstETH on L1)
  • Proxy admin is aliased (L1Executor) via ProxyAdmin
• Emergency breaks msig on L1 is 0x73b047fe6337183A454c5217241D780a932777bD , 3/5 threshold:
  • WITHDRAWALS_DISABLER_ROLE for L1ERC20Bridge
  • DEPOSITS_DISABLER_ROLE for L1ERC20Bridge
• Emergency breaks msig on L2 is a new one 0x0D7F0A811978B3B62CbfF4EF6149B5909EAcfE94 inheriting the same EOAs as for L1, 3/5 threshold:
  • WITHDRAWALS_DISABLER_ROLE for L2ERC20Bridge
  • DEPOSITS_DISABLER_ROLE for L2ERC20Bridge