feat(sepolia-alpha): add task to transfer SystemConfig ownership to Safe

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/.env

@@ -0,0 +1,12 @@
+OP_COMMIT=2073f4059bd806af3e8b76b820aa3fa0b42016d0
+BASE_CONTRACTS_COMMIT=dcd8c98aa881e0ae4ebf872e0d91692a7bf94000
+
+# SystemConfig contract address (not the ProxyAdmin!)
+# https://sepolia.etherscan.io/address/0x7F67DC4959cb3E532B10A99F41bDD906C46FdFdE
+SYSTEM_CONFIG=0x7F67DC4959cb3E532B10A99F41bDD906C46FdFdE
+
+# New owner (Gnosis Safe)
+NEW_OWNER=0x0fe884546476dDd290eC46318785046ef68a0BA9
+
+# Current SystemConfig owner (transaction sender)
+SENDER=0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/Makefile

@@ -0,0 +1,11 @@
+include ../../Makefile
+include ../.env
+include .env
+
+.PHONY: simulate
+simulate:
+	forge script --rpc-url $(L1_RPC_URL) TransferSystemConfigOwnership --sender $(SENDER)
+
+.PHONY: execute
+execute:
+	forge script --rpc-url $(L1_RPC_URL) TransferSystemConfigOwnership --account sepolia-alpha-admin --broadcast -vvvv

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/README.md

@@ -0,0 +1,65 @@
+# Transfer SystemConfig Ownership to Gnosis Safe
+
+Status: NOT YET EXECUTED
+
+## Description
+
+We wish to update the owner of our [SystemConfig](https://sepolia.etherscan.io/address/0x7F67DC4959cb3E532B10A99F41bDD906C46FdFdE) contract on Sepolia for Sepolia-Alpha to be the Gnosis safe owned by the Base chain engineers.
+
+**Important Context:**
+- The ProxyAdmin owner was previously transferred to the Safe in task `2025-04-08-transfer-proxy-admin-ownership-to-safe`
+- However, that transaction only changed the **ProxyAdmin** owner (which controls proxy upgrades)
+- The **SystemConfig** owner (which controls SystemConfig parameters) is a separate ownership role
+- This task correctly transfers the SystemConfig ownership to match the ProxyAdmin ownership
+
+The current owner is an EOA (0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430) which is not compatible with the superchain-ops upgrade process.
+
+## Procedure
+
+### 1. Update repo:
+
+```bash
+cd contract-deployments
+git pull
+cd sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe
+make deps
+```
+
+### 2. Run relevant script(s)
+
+#### Simulate the transaction
+
+```bash
+make simulate
+```
+
+You will see a "Simulation link" from the output.
+
+Paste this URL in your browser. A prompt may ask you to choose a
+project, any project will do. You can create one if necessary.
+
+Click "Simulate Transaction".
+
+1. Validate integrity of the simulation.
+2. Validate correctness of the state diff.
+
+##### 2.1 Validate integrity of the simulation.
+
+Make sure you are on the "Overview" tab of the tenderly simulation, to
+validate integrity of the simulation, we need to check the following:
+
+1. "Network": Check the network is Sepolia.
+2. "Timestamp": Check the simulation is performed on a block with a
+   recent timestamp (i.e. close to when you run the script).
+3. "Sender": Check the address shown is your signer account. If not see the derivation path Note above.
+
+##### 2.2. Validate correctness of the state diff.
+
+Now click on the "State" tab, and refer to the [State Validations](./VALIDATION.md) instructions for the transaction you are sending.
+Once complete return to this document to complete the execution.
+
+#### Execute the transaction
+
+```bash
+make execute
+```

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/VALIDATION.md

@@ -0,0 +1,55 @@
+# Validation
+
+<!-- NOTE: This validation file was created manually, not generated by state-diff.
+     The state-diff tool requires MultisigScript transactions that output EIP-712 signatures.
+     This is a simple EOA transaction, so the validation was written by hand based on
+     the expected state changes from the script simulation.
+
+     STORAGE SLOT DERIVATION:
+     The SystemConfig owner is stored at slot 51 (0x33). This can be verified with:
+       forge inspect OwnableUpgradeable storageLayout  # Shows _owner at Slot 51
+       cast storage 0x7F67DC4959cb3E532B10A99F41bDD906C46FdFdE 51 --rpc-url <rpc>
+
+     OWNERSHIP TYPES:
+     This transfer changes the SystemConfig **parameter owner** (who can call setBatcherHash, setGasLimit, etc.).
+     The **upgrade admin** (ProxyAdmin at 0xC5aE9023bFA79124ffA50169E1423E733D0166f1) controls upgrades
+     and was already transferred to the Safe in task `2025-04-08-transfer-proxy-admin-ownership-to-safe`.
+-->
+
+This document can be used to validate the inputs and result of the execution of the upgrade transaction which you are
+signing.
+
+# State Validations
+
+For each contract listed in the state diff, please verify that no contracts or state changes shown in the Tenderly diff are missing from this document. Additionally, please verify that for each contract:
+
+- The following state changes (and none others) are made to that contract. This validates that no unexpected state
+  changes occur.
+- All addresses (in section headers and storage values) match the provided name, using the Etherscan and Superchain
+  Registry links provided. This validates the bytecode deployed at the addresses contains the correct logic.
+- All key values match the semantic meaning provided, which can be validated using the storage layout links provided.
+
+## Task State Changes
+
+<pre>
+<code>
+----- DecodedStateDiff[0] -----
+  Who:               0x7F67DC4959cb3E532B10A99F41bDD906C46FdFdE
+  Contract:          SystemConfig (Proxy) - Sepolia Alpha
+  Chain ID:          11155111
+  Raw Slot:          0x0000000000000000000000000000000000000000000000000000000000000033
+  Raw Old Value:     0x000000000000000000000000af6e0e871f38c7b653700f7cbaedafaa2784d430
+  Raw New Value:     0x0000000000000000000000000fe884546476ddd290ec46318785046ef68a0ba9
+  Decoded Kind:      address
+  Decoded Old Value: 0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430
+  Decoded New Value: 0x0fe884546476dDd290eC46318785046ef68a0BA9
+
+  Summary:           Update SystemConfig owner from `0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430` to `0x0fe884546476dDd290eC46318785046ef68a0BA9`
+
+----- Additional Nonce Changes -----
+  Who:               0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430
+
+  Details:           Nonce Updates for all addresses listed above.
+  Summary:
+    - 0xAf6E0E871f38c7B653700F7CbAEDafaa2784D430 is the caller
+</pre>

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/foundry.toml

@@ -0,0 +1,20 @@
+[profile.default]
+src = 'src'
+out = 'out'
+libs = ['lib']
+broadcast = 'records'
+fs_permissions = [{ access = "read-write", path = "./" }]
+optimizer = true
+optimizer_runs = 999999
+solc_version = "0.8.15"
+via-ir = false
+remappings = [
+    '@eth-optimism-bedrock/=lib/optimism/packages/contracts-bedrock/',
+    '@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts',
+    '@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts',
+    '@rari-capital/solmate/=lib/solmate/',
+    '@base-contracts/=lib/base-contracts',
+    'solady/=lib/solady/src/',
+]
+
+# See more config options https://github.com/foundry-rs/foundry/tree/master/config

sepolia-alpha/2025-11-03-transfer-systemconfig-ownership-to-safe/script/TransferSystemConfigOwnership.s.sol

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import {Script} from "forge-std/Script.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import {Simulation} from "@base-contracts/script/universal/Simulation.sol";
+
+contract TransferSystemConfigOwnership is Script {
+    address public immutable NEW_OWNER;
+    address public immutable SYSTEM_CONFIG;
+
+    constructor() {
+        NEW_OWNER = vm.envAddress("NEW_OWNER");
+        SYSTEM_CONFIG = vm.envAddress("SYSTEM_CONFIG");
+    }
+
+    function run() public {
+        Simulation.StateOverride[] memory overrides;
+        bytes memory data = _buildCall();
+        Simulation.logSimulationLink({to: SYSTEM_CONFIG, data: data, from: msg.sender, overrides: overrides});
+
+        vm.startBroadcast();
+        (bool success,) = SYSTEM_CONFIG.call(data);
+        vm.stopBroadcast();
+
+        require(success, "TransferSystemConfigOwnership call failed");
+        _postCheck();
+    }
+
+    function _buildCall() private view returns (bytes memory) {
+        return abi.encodeCall(OwnableUpgradeable.transferOwnership, (NEW_OWNER));
+    }
+
+    function _postCheck() private view {
+        OwnableUpgradeable systemConfig = OwnableUpgradeable(SYSTEM_CONFIG);
+        require(systemConfig.owner() == NEW_OWNER, "SystemConfig owner did not get updated");
+    }
+}