chore(core): sync Sepolia canonical addresses to v5.3.2 (2026-05-10 DeployLive)#19
Conversation
Caused by SuperPaymaster P0-13 (nonce triple-key fix) and P0-10 (updatePriceDVT break-glass state machine) contract changes. - x402NonceKey: keccak256(abi.encode(asset, from, nonce)) mirrors SuperPaymaster.x402NonceKey post-P0-13 (was raw nonce slot) - x402IsNonceUsed: queries the triple-key slot via x402SettlementNonces - SuperPaymaster.json ABI: add x402NonceKey, settleX402Payment, settleX402PaymentDirect, x402SettlementNonces entries - update-price-dvt.ts: add chainlinkRecovered=0 as 4th arg (P0-10 ABI break: old 3-arg signature rejected by updated contract)
…eployLive)
Sepolia v5.3.2 SuperPaymaster (`SuperPaymaster-5.3.2`) is live since the
2026-05-11 UUPS upgrade, sitting on top of a fresh 2026-05-10 DeployLive
that rebuilt the entire infra at new addresses. The SDK's CANONICAL_ADDRESSES
table for chainId 11155111 was still pointing at the March-29 stack — every
consumer (including `pnpm keeper:sepolia`) was loading orphaned proxies.
Source of truth: SuperPaymaster repo `deployments/config.sepolia.json`.
What changed
============
registry 0x7Ba70C5b... → 0xa62EFc8a... (Registry-5.3.3)
gToken 0x9ceDeC08... → 0x4e6A1125...
staking 0x1118eAf2... → 0x197D243E... (Staking-4.2.0)
sbt 0x677423f5... → 0xA74820A2... (MySBT-3.2.0)
reputationSystem 0x4b256541... → 0xE25E29e3...
superPaymaster 0x829C3178... → 0x33404ccD... (SuperPaymaster-5.3.2)
impl 0x6B84C7A4...
paymasterFactory 0x48c88B63... → 0x9c80Fe26...
paymasterV4 0xD0c82dc1... → 0x1f0D4eF1... (Anni's V4 proxy)
paymasterV4Impl 0x55a58F98... → 0xC2a08d1d...
xPNTsFactory 0x6EafdA34... → 0x0195f1f3...
blsAggregator 0xe380d443... → 0x01E18f64...
dvtValidator 0xcB42417C... → 0x70a06AC9...
aPNTs 0xDf669834... → 0x4C4EC2e8...
simpleAccountFactory unchanged (0x91E60e06...)
microPaymentChannel unchanged (0x5753e967...)
agentIdentityRegistry, agentReputationRegistry, priceFeed, entryPoint: unchanged
blsValidator: kept at 0x0A71C5a3... (deprecated since P0-1 — aggregator
verifies BLS inline; address kept only for legacy tooling)
+ pnts (NEW): 0x83ca2b02... — Mycelium community PNTs token, Anni's
SP-configured xPNTsToken. Needed by scripts that want to
hit the SP-PNTs gasless path (test-case-3 style).
Verification
============
All 19 addresses verified live on Sepolia via `cast call`. Each contract's
`version()` matches the comment annotations.
Why this matters for keeper
============================
`scripts/keeper.ts` reads `CANONICAL_ADDRESSES[chain.id].superPaymaster` and
`paymasterV4` as defaults. Before this fix, `pnpm keeper:sepolia` was
polling cachedPrice on a SuperPaymaster proxy nobody is using anymore —
silently doing nothing useful. After this fix the default invocation
targets the live 5.3.2 SP and Anni's current V4 paymaster, which is the
configuration prepare-test/regression actually sets up.
Out of scope
=============
- Optimism (chain 10) addresses unchanged.
- `pnts` field added only to Sepolia entry; Optimism block doesn't need it
(Mycelium community is Sepolia-only testbed). Keeper casts the lookup
to `Record<number, any>` so the per-chain shape difference is fine.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9199b30ddb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| abi: parseAbi(['function updatePriceDVT(int256 price, uint256 updatedAt, bytes calldata proof, uint8 chainlinkRecovered) external']), | ||
| functionName: 'updatePriceDVT', | ||
| args: [price, BigInt(now), proof] | ||
| args: [price, BigInt(now), proof, 0] |
There was a problem hiding this comment.
update-price-dvt.ts now calls updatePriceDVT(int256,uint256,bytes,uint8), but the repository’s canonical SuperPaymaster ABI still defines updatePriceDVT with only three inputs (price, updatedAt, proof) in packages/core/src/abis/SuperPaymaster.json (see the updatePriceDVT entry around lines 1445-1460), and superPaymasterActions.updatePriceDVT also sends 3 args. This mismatch changes the function selector, so this script will fail against contracts that match the shipped ABI.
Useful? React with 👍 / 👎.
Companion to the addresses.ts update in this PR. While the keeper
correctly prefers CANONICAL_ADDRESSES, ~10 other scripts under
`scripts/` read the local `config.sepolia.json` directly:
- deploy-sync.ts, test-jack-{registration,superpaymaster-api,gasless}.ts
- l4-paymasterv4-transfer-test.ts, setup-bbq-community.ts
- test-kms-gasless.ts, deploy_jason_pm.ts
- setup-dancing-community.ts, check-roles.ts
These were silently pointing at the orphaned March-29 stack. This
commit aligns them with the live 2026-05-10 DeployLive + v5.3.2 SP
upgrade by copying the canonical file from the SuperPaymaster repo:
- aPNTs, registry, gToken, staking, sbt, reputationSystem,
paymasterFactory, paymasterV4Impl, xPNTsFactory, blsAggregator,
dvtValidator: all updated to the live addresses
- + anniPaymaster (NEW): 0x1f0D4eF1... — Anni's V4 paymaster proxy
- + spImpl (NEW): 0x6B84C7A4... — current SP implementation
- + pnts (NEW): 0x83ca2b02... — Mycelium PNTs token
- srcHash bumped to cba6f5ac... (current contracts/src/)
- updateTime: 2026-05-11 19:47:00 (UUPS upgrade timestamp)
Verified end-to-end: `pnpm exec tsx scripts/keeper.ts --network sepolia
--once --dry-run` now lists 23 contract keys (was 22) and resolves
superPaymaster to 0x33404ccD... as expected.
Out of scope: blsValidator field dropped from the new copy (deprecated
since P0-1; the old SDK config still listed it). If any of those 10
scripts depend on blsValidator they need to migrate to reading from
BLSAggregator instead — tracked separately.
Live keeper verification — passes against Sepolia v5.3.2 ✅After both commits in this PR, ran Init output (addresses resolved correctly)Note Keeper decisions (both correct)
If this were a real (non-dry-run) invocation, the keeper would send exactly one ABI compatibility with 5.3.2 — verified via
|
| Interface | What keeper expects | What 5.3.2 returns | Match |
|---|---|---|---|
SuperPaymaster.cachedPrice() |
(int256 price, uint256 updatedAt, uint80 roundId, uint8 decimals) |
(229253992145, 1778579004, 18446744073709584463, 8) |
✅ |
SuperPaymaster.priceStalenessThreshold() |
uint256 |
4200 |
✅ |
SuperPaymaster.updatePrice() |
callable, no args | tx success | ✅ |
PaymasterV4.cachedPrice() |
(uint208 price, uint48 updatedAt) |
(0, 0) (uninitialised, well-formed shape) |
✅ |
PaymasterV4.priceStalenessThreshold() |
uint256 |
86400 |
✅ |
PaymasterV4.ethUsdPriceFeed() |
address |
0x694AA176… (Sepolia Chainlink) |
✅ |
ABI was stable across 5.2 → 5.3 → 5.3.2 — that's why keeper.ts itself didn't need any modification. The only thing missing was the default address table.
Scope check (Optimism etc. unchanged)
addresses.ts has three network blocks:
// Chain ID: 10 (Optimism) → lines 8-30 — UNCHANGED in this PR
// Chain ID: 11155111 (Sepolia) → lines 37-65 — this PR only touches here
// Chain ID: 11155420 (OP Sepolia) → lines 67+ — UNCHANGED in this PR
git show 9199b30 -- packages/core/src/addresses.ts | grep ^@@ confirms the diff range is @@ -29,28 +29,38 @@ — strictly inside the Sepolia block. No other chain affected.
config.sepolia.json (commit 085ba2f) is the local SDK copy; affects only Sepolia-targeted scripts (none of the op-mainnet / op-sepolia workflow paths touch it).
Telegram alert side-note (informational)
alert kind=chainlink reason=stale ageSec=819 thresholdSec=600
Chainlink ETH/USD feed on Sepolia hasn't pushed in 819 seconds (well over the 600s freshness threshold). This is a known artefact of Sepolia (testnet feeds have sparse update cadence). Keeper sends a Telegram heartbeat about it but does NOT trigger an emergency price action — designed to be informational. Production op-mainnet feeds update every minute or two.
Summary: PR #19 + the live dry-run prove that the keeper code is fully compatible with v5.3.2; the only required fix was bringing the default address table back in sync with the on-chain stack, which is exactly what this PR does.
…s uniform Codex review on PR #19 (LOW): the prior commit added `pnts` only to the Sepolia entry, so the union type `CanonicalAddresses = (typeof CANONICAL_ADDRESSES)[keyof typeof CANONICAL_ADDRESSES]` had `pnts` only in the Sepolia member — meaning chain-id-agnostic consumers couldn't type-safely read `.pnts` (TS narrowed it away unless they switched on chainId first). Fix: add `pnts: ZERO_ADDRESS` to Optimism and OP-Sepolia entries with a comment explaining it's a Sepolia-only testbed. All three chain blocks now share identical key shapes (21 keys each), the inferred union has `pnts` everywhere, and consumers can read `canonical.pnts` without chainId guards. Tradeoff considered: an explicit `interface ChainAddresses { pnts?: Address }` with `as const satisfies Record<number, ChainAddresses>` is the more "correct" TypeScript pattern, but uniform literal entries keep the `as const` literal-narrowing intact and don't require a TS 4.9+ feature. Verified: 3 chains × 21 keys, keeper dry-run still resolves `superPaymaster=0x33404ccD…` correctly.
fanhousanbu
left a comment
fanhousanbu
left a comment
There was a problem hiding this comment.
✅ APPROVED — chore(core): sync Sepolia canonical addresses to v5.3.2 + pnts field uniform
CI: Unit Tests ✅
Commit: feat(x402): triple-key nonce check + keeper 4-arg sync
x402NonceKey:keccak256(abi.encode(asset, from, nonce))与 SP P0-13 合约对齐 ✅update-price-dvt.ts: 4th argchainlinkRecovered=0对应 P0-10 ABI 变更 ✅SuperPaymaster.json: x402NonceKey / settleX402Payment / settleX402PaymentDirect / x402SettlementNonces 四个 ABI entry 已加 ✅
Commit: chore(core): sync Sepolia canonical addresses to v5.3.2 (2026-05-10 DeployLive)
packages/core/src/addresses.ts Sepolia 块（chainId 11155111）:
- 15 个地址全部从 March-29 孤立栈切换到 2026-05-10 DeployLive + v5.3.2 SP upgrade ✅
superPaymaster: "0x33404ccD..."(V5.3.2 Proxy, impl 0x6B84C7A4...) ✅paymasterV4: "0x1f0D4eF1..."(Anni's V4 proxy, 之前这里是空的) ✅pnts: "0x83ca2b02..."(Anni's xPNTsToken，新增) ✅blsValidator保留并加 deprecated 注释 ✅- commit message 附 19 项地址逐条变更说明，可追溯 ✅
keeper dry-run 验证 superPaymaster=0x33404ccD… 已确认 ✅
Commit: chore(deploy): sync SDK config.sepolia.json to 2026-05-10 DeployLive
config.sepolia.json: pretty-printed, 新增 anniPaymaster / spImpl / pnts ✅blsValidator从新 config 中移除（与 SP repo 保持一致）✅- 受影响的 10 个脚本（deploy-sync, test-jack-, l4-, setup-*...）全部切到正确地址 ✅
Commit: chore(core): give all chains pnts field so CanonicalAddresses shape is uniform
（Codex LOW 反馈修复）
- OP Mainnet 和 OP Sepolia 块新增
pnts: ZERO_ADDRESS✅ - 三个链块共 21 key 完全相同，消除 TypeScript union 类型收窄问题 ✅
- 取舍说明合理（uniform literal vs.
interface satisfies方案）✅
LOW (non-blocking): CLAUDE.md 仍有 @/Users/jason/Dev/Brood/... 本地路径（同 MushroomDAO 之前已修复的问题，但 aastar-sdk 这边还没同步）。不影响运行时，可在下一个 chore PR 中修复。
No CRITICAL or HIGH issues.
2 participants
Summary
Updates
packages/core/src/addresses.tsSepolia (chain 11155111) entry to match the live 2026-05-10 DeployLive + 2026-05-11 v5.3.2 UUPS upgrade in the SuperPaymaster repo.The previous addresses pointed at orphaned March-29 proxies. Every SDK consumer (notably
pnpm keeper:sepolia) was therefore silently polling the wrong SuperPaymaster.Source of truth
SuperPaymaster/deployments/config.sepolia.json— every address in this PR was copied verbatim from there and verified live viacast call <addr> "version()(string)".What changed (15 addresses updated, 1 added, 5 unchanged)
Registry-5.3.3Staking-4.2.0MySBT-3.2.0SuperPaymaster-5.3.2, impl0x6B84C7A4…Unchanged:
simpleAccountFactory,microPaymentChannel,agentIdentityRegistry,agentReputationRegistry,priceFeed,entryPoint.blsValidatorkept at0x0A71C5a3…(deprecated since P0-1; aggregator verifies BLS inline now).Why this matters for keeper
scripts/keeper.tsreadsCANONICAL_ADDRESSES[chain.id].superPaymasterandpaymasterV4as defaults. Before this fixpnpm keeper:sepoliawas pollingcachedPriceon a SuperPaymaster proxy nobody is using anymore — silently doing nothing useful while leaving the live 5.3.2 SP un-keepered (and prone to AA32 "paymaster expired" failures on the next gasless test).After this fix the default invocation targets the live 5.3.2 SP and Anni's current V4 paymaster — the same configuration prepare-test/regression sets up.
Out of scope
pntsfield added only to Sepolia. Optimism doesn't need it (Mycelium is a Sepolia-only testbed). Keeper casts the lookup toRecord<number, any>so the per-chain shape difference is fine.Verification
All 19 addresses verified live on Sepolia via
cast call <addr> "version()(string)"(orcodefor tokens). Each contract'sversion()matches the comment annotations.Companion changes in SuperPaymaster repo