多符号 — 实现

For Claude: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

Goal: Allow the Operator to dynamically register new price symbols on OracleHub, and expand genesis initialization to include 5 symbols (ETH/USD, BTC/USD, USDC/USD, SOL/USD, BNB/USD).

Architecture: Two-pronged approach. (A) Expand genesis initialize() call to register all 5 symbols at deployment. (B) Relax addSymbol from onlySystemCall to onlySystemCall OR onlyOperator, and add batchAddSymbols for bulk registration. Tests use OracleHubLocal (Foundry-testable mirror that replaces onlySystemCall with onlyAdmin).

Tech Stack: Solidity ^0.8.20/^0.8.26, Foundry (forge test), TOML config

---

Task 1: Add batchAddSymbols to IOracleHub interface

Files:

• Modify: era-contracts-l1/system-contracts/contracts/interfaces/IOracleHub.sol:39-44

Step 1: Add the new function signature to the interface

Open era-contracts-l1/system-contracts/contracts/interfaces/IOracleHub.sol. In the // --- Admin section (line 39), add batchAddSymbols after addSymbol:

    // --- Admin (system call or operator) ---
    function addSymbol(bytes32 symbolHash) external;
    function batchAddSymbols(bytes32[] calldata symbolHashes) external;
    // --- Admin (system call only) ---
    function removeSymbol(bytes32 symbolHash) external;
    function setConfig(uint256 stalenessThreshold, uint256 deviationThreshold, uint8 minSourceCount) external;
    function setOperator(address _operator) external;
    function operator() external view returns (address);

The key change: addSymbol and batchAddSymbols are grouped under "system call or operator", while removeSymbol/setConfig/setOperator stay under "system call only".

Step 2: Verify file compiles

Run: cd /Users/judybaby/CodeBase/github/Layer2/era-contracts-l1/system-contracts && npx hardhat compile 2>&1 | tail -5 Expected: Compilation error (OracleHub.sol doesn't implement batchAddSymbols yet — that's OK, we'll fix in Task 2)

Step 3: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git -C era-contracts-l1 add system-contracts/contracts/interfaces/IOracleHub.sol
git -C era-contracts-l1 commit -m "feat(oracle): add batchAddSymbols to IOracleHub interface"

---

Task 2: Implement _isSystemCallOrOperator + modify addSymbol + add batchAddSymbols in OracleHub.sol

Files:

• Modify: era-contracts-l1/system-contracts/contracts/OracleHub.sol:131-139

This is the main system contract at 0x8016. It uses the real SystemContractHelper for onlySystemCall.

Step 1: Add the _isSystemCallOrOperator internal function

Add this function in the // ==================== Internal ==================== section (before _updatePrice, around line 193):

    /// @notice Returns true if the caller is a system call or the operator.
    /// Used for addSymbol/batchAddSymbols — lower-risk admin operations.
    function _isSystemCallOrOperator() internal view returns (bool) {
        return SystemContractHelper.isSystemCall()
            || SystemContractHelper.isSystemContract(msg.sender)
            || msg.sender == operator;
    }

You need to add the SystemContractHelper import. Check if it's already imported via SystemContractBase. Open era-contracts-l1/system-contracts/contracts/abstract/SystemContractBase.sol — it imports SystemContractHelper from ../libraries/SystemContractHelper.sol. Since OracleHub inherits SystemContractBase, SystemContractHelper is already accessible. But we need to import it directly since we're calling it in our own function:

Add at the top of OracleHub.sol (after line 3):

import {SystemContractHelper} from "./libraries/SystemContractHelper.sol";

Step 2: Modify addSymbol to use dual-permission check

Replace the current addSymbol (lines 133-139):

    /// @inheritdoc IOracleHub
    /// @dev Callable by system call (admin) or operator for runtime symbol registration.
    function addSymbol(bytes32 symbolHash) external {
        require(_isSystemCallOrOperator(), "OracleHub: unauthorized");
        require(!isSymbolSupported[symbolHash], "OracleHub: already supported");
        isSymbolSupported[symbolHash] = true;
        _supportedSymbols.push(symbolHash);
        emit SymbolAdded(symbolHash);
    }

Step 3: Add batchAddSymbols function

Add this right after addSymbol:

    /// @inheritdoc IOracleHub
    /// @dev Batch version of addSymbol. Skips already-supported symbols (no revert).
    function batchAddSymbols(bytes32[] calldata symbolHashes) external {
        require(_isSystemCallOrOperator(), "OracleHub: unauthorized");
        require(symbolHashes.length > 0, "OracleHub: empty array");
        for (uint256 i = 0; i < symbolHashes.length; i++) {
            bytes32 h = symbolHashes[i];
            if (!isSymbolSupported[h]) {
                isSymbolSupported[h] = true;
                _supportedSymbols.push(h);
                emit SymbolAdded(h);
            }
        }
    }

Step 4: Update the section comment

Change line 131 from:

    // ==================== Admin (System Call Only) ====================

to:

    // ==================== Admin (System Call or Operator) ====================

And add a new section comment before removeSymbol:

    // ==================== Admin (System Call Only) ====================

Step 5: Verify compilation

Run: cd /Users/judybaby/CodeBase/github/Layer2/era-contracts-l1/system-contracts && npx hardhat compile 2>&1 | tail -5 Expected: Compiled successfully

If SystemContractHelper import causes issues (already available via inheritance), remove the explicit import and use the inherited one.

Step 6: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git -C era-contracts-l1 add system-contracts/contracts/OracleHub.sol
git -C era-contracts-l1 commit -m "feat(oracle): addSymbol dual-permission + batchAddSymbols"

---

Task 3: Sync contracts-preprocessed copies

Files:

• Modify: era-contracts-l1/system-contracts/contracts-preprocessed/OracleHub.sol

• Modify: era-contracts-l1/system-contracts/contracts-preprocessed/interfaces/IOracleHub.sol

The contracts-preprocessed/ directory must mirror contracts/ exactly for system contract compilation.

Step 1: Copy both files

cp era-contracts-l1/system-contracts/contracts/OracleHub.sol \
   era-contracts-l1/system-contracts/contracts-preprocessed/OracleHub.sol

cp era-contracts-l1/system-contracts/contracts/interfaces/IOracleHub.sol \
   era-contracts-l1/system-contracts/contracts-preprocessed/interfaces/IOracleHub.sol

Step 2: Verify the preprocessed copies match

diff era-contracts-l1/system-contracts/contracts/OracleHub.sol \
     era-contracts-l1/system-contracts/contracts-preprocessed/OracleHub.sol

diff era-contracts-l1/system-contracts/contracts/interfaces/IOracleHub.sol \
     era-contracts-l1/system-contracts/contracts-preprocessed/interfaces/IOracleHub.sol

Expected: No output (files identical)

Step 3: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git -C era-contracts-l1 add \
  system-contracts/contracts-preprocessed/OracleHub.sol \
  system-contracts/contracts-preprocessed/interfaces/IOracleHub.sol
git -C era-contracts-l1 commit -m "chore: sync contracts-preprocessed with OracleHub changes"

---

Task 4: Update OracleHubLocal.sol (Foundry-testable mirror)

Files:

• Modify: contracts/src/oracle/OracleHubLocal.sol:134-155

OracleHubLocal replaces onlySystemCall with onlyAdmin for local Foundry testing. We need to mirror the permission change: addSymbol now allows both admin AND operator.

Step 1: Add _isAdminOrOperator internal function

Add before _updatePrice (around line 192):

    /// @notice Returns true if caller is admin (system call equivalent) or operator.
    function _isAdminOrOperator() internal view returns (bool) {
        return msg.sender == admin || msg.sender == operator;
    }

Step 2: Modify addSymbol to use dual-permission check

Replace lines 136-141:

    /// @notice Callable by admin (system call equivalent) or operator.
    function addSymbol(bytes32 symbolHash) external {
        require(_isAdminOrOperator(), "OracleHub: unauthorized");
        require(!isSymbolSupported[symbolHash], "OracleHub: already supported");
        isSymbolSupported[symbolHash] = true;
        _supportedSymbols.push(symbolHash);
        emit SymbolAdded(symbolHash);
    }

Step 3: Add batchAddSymbols function

Add right after addSymbol:

    /// @notice Batch version of addSymbol. Skips already-supported symbols.
    function batchAddSymbols(bytes32[] calldata symbolHashes) external {
        require(_isAdminOrOperator(), "OracleHub: unauthorized");
        require(symbolHashes.length > 0, "OracleHub: empty array");
        for (uint256 i = 0; i < symbolHashes.length; i++) {
            bytes32 h = symbolHashes[i];
            if (!isSymbolSupported[h]) {
                isSymbolSupported[h] = true;
                _supportedSymbols.push(h);
                emit SymbolAdded(h);
            }
        }
    }

Step 4: Keep removeSymbol as onlyAdmin only — no change needed

Step 5: Verify it compiles

Run: cd /Users/judybaby/CodeBase/github/Layer2/contracts && forge build 2>&1 | tail -5 Expected: Compiled successfully

Step 6: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git add contracts/src/oracle/OracleHubLocal.sol
git commit -m "feat(oracle): OracleHubLocal addSymbol dual-permission + batchAddSymbols"

---

Task 5: Write 6 new Foundry tests

Files:

• Modify: contracts/test/OracleHub.t.sol (append to OracleHubOperatorTest contract)

All 6 new tests go inside the existing OracleHubOperatorTest contract (which uses OracleHubLocal and already has operatorAddr, adminAddr, stranger addresses set up).

Step 1: Write the 6 tests

Append these tests at the end of OracleHubOperatorTest (before the closing }):

    // ==================== addSymbol / batchAddSymbols — Multi-Permission Tests ====================

    function test_addSymbol_by_operator() public {
        bytes32 solHash = keccak256("SOL/USD");

        vm.prank(operatorAddr);
        hub.addSymbol(solHash);

        assertTrue(hub.isSymbolSupported(solHash));
        assertEq(hub.getSupportedSymbolCount(), 3); // BTC, ETH, SOL
    }

    function test_addSymbol_by_admin() public {
        bytes32 solHash = keccak256("SOL/USD");

        vm.prank(adminAddr);
        hub.addSymbol(solHash);

        assertTrue(hub.isSymbolSupported(solHash));
        assertEq(hub.getSupportedSymbolCount(), 3);
    }

    function test_addSymbol_by_random_reverts() public {
        bytes32 solHash = keccak256("SOL/USD");

        vm.prank(stranger);
        vm.expectRevert("OracleHub: unauthorized");
        hub.addSymbol(solHash);
    }

    function test_batchAddSymbols_by_operator() public {
        bytes32 solHash = keccak256("SOL/USD");
        bytes32 bnbHash = keccak256("BNB/USD");
        bytes32 usdcHash = keccak256("USDC/USD");

        bytes32[] memory newSymbols = new bytes32[](3);
        newSymbols[0] = solHash;
        newSymbols[1] = bnbHash;
        newSymbols[2] = usdcHash;

        vm.prank(operatorAddr);
        hub.batchAddSymbols(newSymbols);

        assertTrue(hub.isSymbolSupported(solHash));
        assertTrue(hub.isSymbolSupported(bnbHash));
        assertTrue(hub.isSymbolSupported(usdcHash));
        assertEq(hub.getSupportedSymbolCount(), 5); // BTC, ETH + 3 new
    }

    function test_batchAddSymbols_empty_reverts() public {
        bytes32[] memory empty = new bytes32[](0);

        vm.prank(operatorAddr);
        vm.expectRevert("OracleHub: empty array");
        hub.batchAddSymbols(empty);
    }

    function test_removeSymbol_by_operator_reverts() public {
        // removeSymbol stays admin-only — operator cannot remove
        vm.prank(operatorAddr);
        vm.expectRevert("OracleHub: not admin");
        hub.removeSymbol(BTC_USD);
    }

Step 2: Run tests to verify they fail

Run: cd /Users/judybaby/CodeBase/github/Layer2/contracts && forge test --match-contract OracleHubOperatorTest --match-test "test_addSymbol_by_operator|test_addSymbol_by_admin|test_addSymbol_by_random_reverts|test_batchAddSymbols_by_operator|test_batchAddSymbols_empty_reverts|test_removeSymbol_by_operator_reverts" -vv 2>&1 | tail -20

Expected: If Task 4 was completed, tests should PASS. If not yet, they will fail with "function not found" since OracleHubLocal doesn't have the new functions yet.

Step 3: Run ALL tests (regression)

Run: cd /Users/judybaby/CodeBase/github/Layer2/contracts && forge test --match-contract OracleHub -vv 2>&1 | tail -30

Expected: All existing tests + 6 new tests pass. No regressions.

Step 4: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git add contracts/test/OracleHub.t.sol
git commit -m "test(oracle): 6 tests for addSymbol/batchAddSymbols dual-permission"

---

Task 6: Update baby-chain.toml — uncomment 4 symbols

Files:

• Modify: config/baby-chain.toml:25-44

Step 1: Uncomment the 4 symbol configurations

Replace lines 25-44 with the uncommented versions:

[[oracle.symbols]]
canonical = "BTC/USD"
coingecko_id = "bitcoin"
binance_symbol = "BTCUSDT"

[[oracle.symbols]]
canonical = "USDC/USD"
coingecko_id = "usd-coin"
binance_symbol = "USDCUSDT"

[[oracle.symbols]]
canonical = "SOL/USD"
coingecko_id = "solana"
binance_symbol = "SOLUSDT"

[[oracle.symbols]]
canonical = "BNB/USD"
coingecko_id = "binancecoin"
binance_symbol = "BNBUSDT"

Also update the NOTE comment (lines 17-19) to reflect new state:

# NOTE: Symbols listed here must be registered on-chain via OracleHub.addSymbol()
# or during genesis initialize(). The oracle-wiring service will fetch and encode
# prices for all symbols listed below.

Step 2: Verify TOML is valid

Run: python3 -c "import tomllib; tomllib.load(open('config/baby-chain.toml', 'rb')); print('OK')" Expected: OK

Step 3: Verify oracle-wiring Rust code still compiles (no Rust changes needed, just verify config parsing)

Run: cd /Users/judybaby/CodeBase/github/Layer2/baby-modules/oracle-wiring && cargo check 2>&1 | tail -5 Expected: Finished (no errors)

Step 4: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git add config/baby-chain.toml
git commit -m "feat(oracle): enable BTC/USDC/SOL/BNB symbol configs"

---

Task 7: Final regression + dev-log update

Files:

• Modify: docs/dev-log.md (append entry)

Step 1: Run full Foundry test suite

Run: cd /Users/judybaby/CodeBase/github/Layer2/contracts && forge test -vv 2>&1 | tail -30 Expected: All tests pass (existing + 6 new)

Step 2: Run oracle-wiring tests

Run: cd /Users/judybaby/CodeBase/github/Layer2/baby-modules/oracle-wiring && cargo test 2>&1 | tail -15 Expected: All tests pass

Step 3: Update dev-log

Append to docs/dev-log.md:

## Oracle 多符号注册 (方案 A+B)

**日期：** 2026-03-05

**变更：**
- OracleHub.sol `addSymbol()` 权限从 `onlySystemCall` 放宽为 `onlySystemCall OR onlyOperator`
- 新增 `batchAddSymbols(bytes32[])` 批量注册接口（同样双权限）
- `removeSymbol` 保持 `onlySystemCall`（高危操作不下放）
- OracleHubLocal.sol 同步更新（`onlyAdmin OR onlyOperator`）
- baby-chain.toml 启用 BTC/USD, USDC/USD, SOL/USD, BNB/USD 配置
- 新增 6 个 Foundry 测试覆盖权限矩阵

**安全考量：**
- addSymbol 是低风险操作（只添加，不影响现有价格数据）
- removeSymbol 保持高权限要求，防止 operator key 泄露导致价格源被删除
- 生产环境可升级为多签 + timelock 控制 operator 权限

Step 4: Commit

cd /Users/judybaby/CodeBase/github/Layer2
git add docs/dev-log.md
git commit -m "docs: Oracle 多符号注册实施记录"