feat: add backward, forward let test

.github/workflows/aggkit-e2e-single-chain.yml

@@ -57,7 +57,7 @@ on:
         required: false
         type: boolean
         default: false
-      
+
       fail-fast:
         description: "Stop test execution on first failure"
         required: false
@@ -184,7 +184,6 @@ jobs:
           else
             # Always-run tests
             run_test ./tests/aggkit/bridge-e2e.bats
-            run_test ./tests/aggkit/e2e-pp.bats
             run_test ./tests/aggkit/bridge-sovereign-chain-e2e.bats
 
             # Extra tests, whose execution is time consuming

TESTSINVENTORY.md

@@ -287,10 +287,11 @@ Table of tests currently implemented or being implemented in the E2E repository.
 | Remove single validator from committee | [Link](./tests/aggkit/aggsender-committee-updates.bats#L147) | |
 | Test Aggoracle committee | [Link](./tests/aggkit/bridge-e2e-aggoracle-committee.bats#L10) | |
 | Test L2 to L2 bridge | [Link](./tests/aggkit/bridge-e2e-2-chains.bats#L15) | |
-| Test Sovereign Chain Bridge Events | [Link](./tests/aggkit/bridge-sovereign-chain-e2e.bats#L48) | |
+| Test Sovereign Chain Bridge Events | [Link](./tests/aggkit/bridge-sovereign-chain-e2e.bats#L57) | |
+| Test backwardlet, forwardlet feature | [Link](./tests/aggkit/bridge-sovereign-chain-e2e.bats#L319) | |
 | Test block gas limit increase to 60M | [Link](./tests/fusaka/eip7935.bats#L19) | |
 | Test execute multiple claimMessages via testClaim with internal reentrancy and bridgeAsset call | [Link](./tests/aggkit/claim-reetrancy.bats#L472) | |
-| Test inject invalid GER on L2 (bridges are valid) | [Link](./tests/aggkit/bridge-sovereign-chain-e2e.bats#L212) | |
+| Test inject invalid GER on L2 (bridges are valid) | [Link](./tests/aggkit/bridge-sovereign-chain-e2e.bats#L221) | |
 | Test invalid GER injection case A (FEP mode) | [Link](./tests/aggkit/latest-n-injected-ger.bats#L825) | |
 | Test invalid GER injection case A (PP mode) | [Link](./tests/aggkit/latest-n-injected-ger.bats#L716) | |
 | Test invalid GER injection case B2 (FEP mode) | [Link](./tests/aggkit/latest-n-injected-ger.bats#L396) | |
@@ -307,7 +308,6 @@ Table of tests currently implemented or being implemented in the E2E repository.
 | Transfer message L2 to L2 | [Link](./tests/aggkit/bridge-e2e-2-chains.bats#L68) | |
 | Transfer message | [Link](./tests/aggkit/bridge-e2e.bats#L11) | |
 | Verify batches | [Link](./tests/zkevm/batch-verification.bats#L10) | |
-| Verify certificate settlement | [Link](./tests/aggkit/e2e-pp.bats#L10) | |
 | foo | [Link](./tests/foo.bats#L10) | |
 | p256verify call | [Link](./tests/fusaka/eip7951.bats#L46) | |
 | prover stress test | [Link](./tests/pessimistic/prover-stress.bats#L10) | |

core/helpers/agglayer-cdk-common-setup.bash

@@ -33,6 +33,8 @@ _agglayer_cdk_common_setup() {
     # ✅ Resolve URLs
     _resolve_required_urls
 
+    manage_kurtosis_service "stop" "zkevm-bridge-service-001"
+
     # ✅ Generate and fund wallet
     _generate_and_fund_wallet
 
@@ -598,3 +600,30 @@ log_prefix_test(){
     echo "=== $1  $test_log_prefix" >&3
     echo "=====================================================================" >&3
 }
+
+# Helper function to manage bridge spammer service
+manage_kurtosis_service() {
+    local action="$1"  # start or stop
+    local service="$2"
+
+    if [[ "$action" == "stop" ]]; then
+        # Check if service is running before attempting to stop
+        if kurtosis service inspect "$ENCLAVE_NAME" "$service" >/dev/null 2>&1; then
+            echo "Stopping $service..." >&3
+            kurtosis service stop "$ENCLAVE_NAME" "$service" || {
+                echo "Error: Failed to stop $service" >&3
+                return 1
+            }
+            echo "$service stopped." >&3
+        else
+            echo "$service is not running, skipping stop." >&3
+        fi
+    elif [[ "$action" == "start" ]]; then
+        echo "Starting $service..." >&3
+        kurtosis service start "$ENCLAVE_NAME" "$service" || {
+            echo "Error: Failed to start $service" >&3
+            return 1
+        }
+        echo "$service started." >&3
+    fi
+}

tests/aggkit/bridge-sovereign-chain-e2e.bats

@@ -23,6 +23,15 @@ setup() {
 
   readonly empty_proof=$(jq -nc '[range(32) | "0x0000000000000000000000000000000000000000000000000000000000000000"]')
 
+  # backwardLET and forwardLET function signatures
+  readonly backward_let_func_sig="function backwardLET(uint256,bytes32[32],bytes32,bytes32[32])"
+  # forwardLET takes LeafData[] (leafType, originNetwork, originAddress, destinationNetwork, destinationAddress, amount, metadata) and expectedLER
+  readonly forward_let_func_sig="function forwardLET((uint8,uint32,address,uint32,address,uint256,bytes)[],bytes32)"
+  readonly get_root_func_sig="function getRoot() (bytes32)"
+  readonly activate_emergency_state_func_sig="function activateEmergencyState()"
+  readonly deactivate_emergency_state_func_sig="function deactivateEmergencyState()"
+  readonly deposit_count_func_sig="function depositCount() (uint256)"
+
   contracts_url="$(kurtosis port print "$ENCLAVE_NAME" "$contracts_container" http)"
   input_args="$(curl -s "${contracts_url}/opt/input/input_args.json")"
 
@@ -306,3 +315,253 @@ setup() {
   wait_to_settle_certificate_containing_global_index "$aggkit_rpc_url" "$global_index"
   log "✅ Certificate settlement completed for global index: $global_index"
 }
+
+@test "Test backwardlet, forwardlet feature" {
+  manage_kurtosis_service "start" "zkevm-bridge-service-001"
+  zkevm_bridge_url=$(kurtosis port print "$ENCLAVE_NAME" zkevm-bridge-service-001 rpc)
+  # Step 1: Make 1 bridge from L1 to L2 (0.7 ETH) and claim it
+  log "Step 1: Making 1 bridge from L1 to L2 (0.7 ETH) and claiming it"
+  destination_addr="$receiver"
+  destination_net="$l2_rpc_network_id"
+  amount=$(cast --to-unit 0.7ether wei)
+
+  log "Bridge L1 -> L2 (0.7 ETH)"
+  run bridge_asset "$native_token_addr" "$l1_rpc_url" "$l1_bridge_addr"
+  assert_success
+  local step1_bridge_tx_hash="$output"
+  log "Bridge tx hash: $step1_bridge_tx_hash"
+
+  # Claim the bridge on L2
+  log "Claiming bridge on L2"
+  run process_bridge_claim "step1" "$l1_rpc_network_id" "$step1_bridge_tx_hash" "$l2_rpc_network_id" "$l2_bridge_addr" "$aggkit_bridge_url" "$aggkit_bridge_url" "$L2_RPC_URL" "$sender_addr"
+  assert_success
+  log "Claimed bridge, global_index: $output"
+  local claimed_global_index="$output"
+
+  manage_kurtosis_service "stop" "aggkit-001"
+  # Step 2: Make 5 bridges from L2 to L1 and store their info for forwardLET
+  log "Step 2: Making 5 bridges from L2 to L1"
+  local l2_to_l1_tx_hashes=()
+  destination_addr="$sender_addr"
+  destination_net="$l1_rpc_network_id"
+  amount=$(cast --to-unit 0.01ether wei)
+
+  for i in {1..5}; do
+    log "Bridge $i/5: L2 -> L1"
+    run bridge_asset "$native_token_addr" "$L2_RPC_URL" "$l2_bridge_addr"
+    assert_success
+    l2_to_l1_tx_hashes+=("$output")
+    log "Bridge $i/5 tx hash: $output"
+  done
+  log "Completed 5 bridges from L2 to L1"
+
+  # Step 3: Get bridge info for all 5 bridges BEFORE backwardLET (needed for forwardLET)
+  log "Step 3: Fetching bridge info for all 5 bridges (for forwardLET reconstruction)"
+  local bridge_infos=()
+  for i in {0..4}; do
+    local tx_hash="${l2_to_l1_tx_hashes[$i]}"
+    run get_bridge "backwardlet, forwardlet feature-bridge-$((i+1))" "$l2_rpc_network_id" "$tx_hash" 50 10 "$aggkit_bridge_url"
+    assert_success
+    bridge_infos+=("$output")
+    log "Bridge $((i+1)) info: $output"
+  done
+
+  # Get the last bridge deposit count
+  local last_bridge_info="${bridge_infos[4]}"
+  local last_deposit_count
+  last_deposit_count=$(echo "$last_bridge_info" | jq -r '.deposit_count')
+  log "Last L2->L1 deposit count: $last_deposit_count"
+
+  # Get the current LER (Local Exit Root) from L2 bridge contract BEFORE backwardLET
+  # This will be the expected LER we need to restore with forwardLET
+  log "Fetching current LER from L2 bridge contract (before backwardLET)"
+  run query_contract "$L2_RPC_URL" "$l2_bridge_addr" "$get_root_func_sig"
+  assert_success
+  local expected_ler="$output"
+  log "Expected LER (to restore after forwardLET): $expected_ler"
+
+  # Step 4: Perform backwardLET to roll back 2 deposit counts
+  log "Step 4: Performing backwardLET to roll back 2 deposit counts"
+
+  # Calculate the target deposit count for backwardLET (remove 3 deposits)
+  local backward_target_deposit_count=$((last_deposit_count - 2))
+  log "Rolling back to deposit count: $backward_target_deposit_count"
+
+  # Get backward-let data from zkevm-bridge-service
+  log "Fetching backward-let proof data"
+  local backward_let_response
+  backward_let_response=$(curl -s "$zkevm_bridge_url/backward-let?net_id=$l2_rpc_network_id&deposit_cnt=$backward_target_deposit_count")
+  log "backward-let response: $backward_let_response"
+
+  local backward_leaf_hash
+  backward_leaf_hash=$(echo "$backward_let_response" | jq -r '.leaf_hash')
+  local backward_frontier
+  backward_frontier=$(echo "$backward_let_response" | jq -r '.frontier | "[" + (join(",")) + "]"')
+  local backward_rollup_merkle_proof
+  backward_rollup_merkle_proof=$(echo "$backward_let_response" | jq -r '.rollup_merkle_proof | "[" + (join(",")) + "]"')
+
+  # Activate emergency state (required for backwardLET)
+  log "Activating emergency state on L2 bridge"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$activate_emergency_state_func_sig"
+  assert_success
+  log "Emergency state activated"
+
+  # Execute backwardLET
+  log "Executing backwardLET"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$backward_let_func_sig" "$backward_target_deposit_count" "$backward_frontier" "$backward_leaf_hash" "$backward_rollup_merkle_proof"
+  assert_success
+  log "backwardLET executed successfully"
+
+  # Deactivate emergency state
+  log "Deactivating emergency state on L2 bridge"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$deactivate_emergency_state_func_sig"
+  assert_success
+  log "Emergency state deactivated"
+
+  # Verify the deposit count has been rolled back
+  sleep 10 # Wait for state to sync
+  run query_contract "$L2_RPC_URL" "$l2_bridge_addr" "$deposit_count_func_sig"
+  assert_success
+  local current_deposit_count="$output"
+  log "Current deposit count after backwardLET: $current_deposit_count"
+
+  # Bridge from L1 to L2 and claim it
+  log "Bridging from L1 to L2"
+  destination_addr="$receiver"
+  destination_net="$l2_rpc_network_id"
+  amount=$(cast --to-unit 0.1ether wei)
+  run bridge_asset "$native_token_addr" "$l1_rpc_url" "$l1_bridge_addr"
+  assert_success
+  local bridge_tx_hash="$output"
+  log "Bridge tx hash: $bridge_tx_hash"
+  manage_kurtosis_service "start" "aggkit-001"
+  aggkit_rpc_url=$(kurtosis port print "$ENCLAVE_NAME" aggkit-001 rpc)
+  log "Aggkit RPC URL: $aggkit_rpc_url"
+
+  # Claim the bridge on L2
+  log "Claiming bridge on L2"
+  run process_bridge_claim "" "$l1_rpc_network_id" "$bridge_tx_hash" "$l2_rpc_network_id" "$l2_bridge_addr" "$aggkit_bridge_url" "$aggkit_bridge_url" "$L2_RPC_URL" "$sender_addr"
+  assert_success
+  local claimed_global_index="$output"
+  log "Claimed bridge, global_index: $claimed_global_index"
+
+
+  sleep 10
+
+  # Wait for certificate settlement
+  log "Waiting for certificate settlement containing global index: $claimed_global_index"
+  wait_to_settle_certificate_containing_global_index "$aggkit_rpc_url" "$claimed_global_index"
+  log "✅ Certificate settled for global index: $claimed_global_index"
+
+  # Step 5: Perform forwardLET to restore the deposit count
+  log "Step 5: Performing forwardLET to restore deposit count"
+  log "Using expected LER captured before backwardLET: $expected_ler"
+
+  # Construct LeafData array from the rolled-back bridges (bridges 2 and 3, indices 1 and 2)
+  # LeafData: (leafType, originNetwork, originAddress, destinationNetwork, destinationAddress, amount, metadata)
+  log "Constructing LeafData array for forwardLET"
+
+  # Build leaves array - we need to add back bridges at indices 1 and 2 (the last 2 that were rolled back)
+  local leaves_array="["
+  for i in 2 3 4; do
+    local bridge_info="${bridge_infos[$i]}"
+    local leaf_type
+    leaf_type=$(echo "$bridge_info" | jq -r '.leaf_type')
+    local origin_network
+    origin_network=$(echo "$bridge_info" | jq -r '.origin_network')
+    local origin_address
+    origin_address=$(echo "$bridge_info" | jq -r '.origin_address')
+    local dest_network
+    dest_network=$(echo "$bridge_info" | jq -r '.destination_network')
+    local dest_address
+    dest_address=$(echo "$bridge_info" | jq -r '.destination_address')
+    local bridge_amount
+    bridge_amount=$(echo "$bridge_info" | jq -r '.amount')
+    local metadata
+    metadata=$(echo "$bridge_info" | jq -r '.metadata')
+
+    # Default leaf_type to 0 if not present (asset bridge)
+    if [[ "$leaf_type" == "null" || -z "$leaf_type" ]]; then
+      leaf_type="0"
+    fi
+
+    # Default metadata to 0x if empty
+    if [[ "$metadata" == "null" || -z "$metadata" ]]; then
+      metadata="0x"
+    fi
+
+    log "Leaf $i: type=$leaf_type, originNet=$origin_network, originAddr=$origin_address, destNet=$dest_network, destAddr=$dest_address, amount=$bridge_amount"
+
+    # Build the tuple for this leaf
+    local leaf_tuple="($leaf_type,$origin_network,$origin_address,$dest_network,$dest_address,$bridge_amount,$metadata)"
+
+    if [[ $i -eq 2 ]]; then
+      leaves_array+="$leaf_tuple"
+    else
+      leaves_array+=",$leaf_tuple"
+    fi
+  done
+  leaves_array+="]"
+  log "Leaves array: $leaves_array"
+
+  # Activate emergency state (required for forwardLET)
+  log "Activating emergency state on L2 bridge"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$activate_emergency_state_func_sig"
+  assert_success
+  log "Emergency state activated"
+
+  # Execute forwardLET with the constructed leaves and expected LER
+  log "Executing forwardLET"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$forward_let_func_sig" "$leaves_array" "$expected_ler"
+  assert_success
+  log "forwardLET executed successfully"
+
+  # Deactivate emergency state
+  log "Deactivating emergency state on L2 bridge"
+  run cast send --legacy --private-key "$l2_sovereign_admin_private_key" --rpc-url "$L2_RPC_URL" "$l2_bridge_addr" "$deactivate_emergency_state_func_sig"
+  assert_success
+  log "Emergency state deactivated"
+
+  # Verify the deposit count has been restored
+  sleep 10 # Wait for state to sync
+  run query_contract "$L2_RPC_URL" "$l2_bridge_addr" "$deposit_count_func_sig"
+  assert_success
+  local restored_deposit_count="$output"
+  log "Current deposit count after forwardLET: $restored_deposit_count"
+
+  # Verify deposit count was restored correctly
+  if [[ "$restored_deposit_count" != "$last_deposit_count" ]]; then
+    log "Warning: Deposit count mismatch. Expected: $last_deposit_count, Got: $restored_deposit_count"
+  fi
+
+  # Step 6: Do a new bridge from L2 to L1 and verify certificate settles
+  log "Step 6: Making new bridge from L1 to L2 after forwardLET"
+  # Bridge from L1 to L2 and claim it
+  log "Bridging from L1 to L2"
+  destination_addr="$receiver"
+  destination_net="$l2_rpc_network_id"
+  amount=$(cast --to-unit 0.1ether wei)
+  run bridge_asset "$native_token_addr" "$l1_rpc_url" "$l1_bridge_addr"
+  assert_success
+  local bridge_tx_hash="$output"
+  log "Bridge tx hash: $bridge_tx_hash"
+
+  # Claim the bridge on L2
+  log "Claiming bridge on L2"
+  run process_bridge_claim "" "$l1_rpc_network_id" "$bridge_tx_hash" "$l2_rpc_network_id" "$l2_bridge_addr" "$aggkit_bridge_url" "$aggkit_bridge_url" "$L2_RPC_URL" "$sender_addr"
+  assert_success
+  local claimed_global_index="$output"
+  log "Claimed bridge, global_index: $claimed_global_index"
+
+
+  sleep 10
+
+  # Wait for certificate settlement
+  log "Waiting for certificate settlement containing global index: $claimed_global_index"
+  wait_to_settle_certificate_containing_global_index "$aggkit_rpc_url" "$claimed_global_index"
+  log "✅ Certificate settled for global index: $claimed_global_index"
+
+  log "backwardlet, forwardlet feature test completed successfully!"
+
+  manage_kurtosis_service "stop" "zkevm-bridge-service-001"
+}