[GH-ISSUE #3744] [Feature] Arbitrum Nitro reverse engineering: Inbox batches, retryables, ArbOS calls and L1-to-L2 message reconstruction #1451

New issue

Open

opened 2026-10-16 21:05:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:33 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3744

Problem Statement & Context

Arbitrum Nitro is the leading Optimistic Rollup platform by total value locked (TVL), executing Ethereum Layer 2 transactions through a custom architecture powered by ArbOS (Arbitrum Operating System) and WebAssembly:

Inbox & Batch Posting: Transactions posted by the Sequencer to the L1 SequencerInbox contract as compressed batches (utilizing Brotli compression).
Delayed Inbox & Force-Inclusion: Direct user transaction submissions via the L1 Bridge and DelayedInbox, providing censorship resistance by allowing L1 to force transaction inclusion after a grace period.
Retryable Tickets (L1-to-L2 Messaging): Complex asynchronous messaging system: L1 transaction calls Inbox.createRetryableTicket, depositing gas fees into the L2RetryableTicket buffer; ticket auto-redeems on L2 or awaits manual redemption before the 7-day expiration.
ArbOS Precompiles: Specialized system contracts operating at address range 0x0000000000000000000000000000000000000064–0x0000000000000000000000000000000000000072 (e.g. ArbSys, ArbGasInfo, ArbAddressTable, ArbOwner), handling withdrawals, gas calculations, and address compression.
WAVM (Wasm Virtual Machine) & Interactive Fraud Proofs: State transition verification executing within an instrumented WebAssembly environment using bisection challenge protocols.

REA needs an Arbitrum Nitro semantic engine capable of decompressing Brotli Sequencer batches, resolving retryable ticket lifecycles, and decoding ArbOS precompile calls.

Proposed Architecture

flowchart TD
    A["L1 Inbox Batches / L2 Transactions / Retryable Event Logs"] --> B["Arbitrum Nitro Semantic Engine"]
    B --> C["Brotli Batch Decompressor & Stream Slicer"]
    B --> D["Retryable Ticket Lifecycle Tracker"]
    B --> E["ArbOS Precompile & Address Table Resolver"]
    B --> F["WAVM Interactive Fraud Proof Inspector"]
    
    C --> C1["SequencerInbox Header Parsing"]
    C --> C2["Brotli Decompression & RLP Transaction Unpacking"]
    
    D --> D1["Inbox.createRetryableTicket Parameters"]
    D --> D2["L2 Ticket Auto-Redeem vs Manual Redeem State"]
    D --> D3["Escrowed Gas Refund Accounting"]
    
    E --> E1["ArbSys (sendTxToL1, getArbOSVersion)"]
    E --> E2["ArbAddressTable Compact Address De-serialization"]
    
    F --> F1["Wasm Virtual Machine (WAVM) State Snapshots (#2298)"]
    F --> F2["Bisection Game Challenge Progression"]
    
    C & D & E & F --> G["Synthesized Arbitrum Nitro Architecture Blueprint & L1 ↔ L2 Trace Graph"]

Technical Capabilities & Modules

Sequencer Batch Ingestion & Brotli Decompression:
- Ingest raw transactions targeting the L1 SequencerInbox.
- Parse Nitro batch headers: batch sequence number, previous accumulator, new accumulator.
- Decompress multi-block Brotli-compressed streams to extract sequential L2 transaction arrays.
Retryable Ticket Lifecycle Modeling:
- Trace L1 createRetryableTicket calls: extract destination, callvalue, deposit, maxSubmissionCost, excessFeeRefundAddress, callValueRefundAddress, gasLimit, maxFeePerGas, and calldata.
- Calculate unique ticket ID (keccak256(l1TxHash, ticketIndex)).
- Correlate with L2 execution logs: determine if the ticket auto-redeemed, failed due to insufficient gas, or was redeemed manually via ArbRetryableTx.redeem(ticketId).
ArbOS System Precompile Dissection:
- Decode calls to ArbOS system precompiles:
  - ArbSys (0x0000000000000000000000000000000000000064): sendTxToL1 (L2-to-L1 exit calls), arbBlockNumber.
  - ArbGasInfo (0x000000000000000000000000000000000000006c): L1 and L2 gas pricing breakdowns.
  - ArbAddressTable: Address compression lookup table translating 4-byte indexes to 20-byte addresses.
Delayed Inbox & Force-Inclusion Analysis:
- Map transactions submitted to the L1 DelayedInbox and track their inclusion into the canonical L2 sequence through Sequencer ingestion or force-inclusion timeouts.
WAVM State Transition Audit:
- Parse WAVM execution state hashes generated during challenge games.
- Correlate WAVM instructions with underlying ArbOS WebAssembly logic (#2298).

Acceptance Criteria

Automated decompression of Arbitrum Brotli batch streams from L1 SequencerInbox calls.
End-to-end tracking of Retryable Ticket lifecycles across L1 creation, L2 redeem, and refund transfers.
Full parameter decoding for ArbOS precompile calls (ArbSys, ArbGasInfo).
Address expansion for ArbAddressTable indexed lookups.
Interactive visualization of cross-chain message flows and state transitions.

Complements #972 (Solidity/EVM reverse engineering)
Complements #2391 (EVM calldata and execution trace analysis)
Complements #2298 (Decompile WebAssembly modules)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3744 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Arbitrum Nitro is the leading Optimistic Rollup platform by total value locked (TVL), executing Ethereum Layer 2 transactions through a custom architecture powered by **ArbOS** (Arbitrum Operating System) and WebAssembly: 1. **Inbox & Batch Posting**: Transactions posted by the Sequencer to the L1 `SequencerInbox` contract as compressed batches (utilizing Brotli compression). 2. **Delayed Inbox & Force-Inclusion**: Direct user transaction submissions via the L1 `Bridge` and `DelayedInbox`, providing censorship resistance by allowing L1 to force transaction inclusion after a grace period. 3. **Retryable Tickets (L1-to-L2 Messaging)**: Complex asynchronous messaging system: L1 transaction calls `Inbox.createRetryableTicket`, depositing gas fees into the `L2RetryableTicket` buffer; ticket auto-redeems on L2 or awaits manual redemption before the 7-day expiration. 4. **ArbOS Precompiles**: Specialized system contracts operating at address range `0x0000000000000000000000000000000000000064`–`0x0000000000000000000000000000000000000072` (e.g. `ArbSys`, `ArbGasInfo`, `ArbAddressTable`, `ArbOwner`), handling withdrawals, gas calculations, and address compression. 5. **WAVM (Wasm Virtual Machine) & Interactive Fraud Proofs**: State transition verification executing within an instrumented WebAssembly environment using bisection challenge protocols. REA needs an Arbitrum Nitro semantic engine capable of decompressing Brotli Sequencer batches, resolving retryable ticket lifecycles, and decoding ArbOS precompile calls. ### Proposed Architecture ```mermaid flowchart TD A["L1 Inbox Batches / L2 Transactions / Retryable Event Logs"] --> B["Arbitrum Nitro Semantic Engine"] B --> C["Brotli Batch Decompressor & Stream Slicer"] B --> D["Retryable Ticket Lifecycle Tracker"] B --> E["ArbOS Precompile & Address Table Resolver"] B --> F["WAVM Interactive Fraud Proof Inspector"] C --> C1["SequencerInbox Header Parsing"] C --> C2["Brotli Decompression & RLP Transaction Unpacking"] D --> D1["Inbox.createRetryableTicket Parameters"] D --> D2["L2 Ticket Auto-Redeem vs Manual Redeem State"] D --> D3["Escrowed Gas Refund Accounting"] E --> E1["ArbSys (sendTxToL1, getArbOSVersion)"] E --> E2["ArbAddressTable Compact Address De-serialization"] F --> F1["Wasm Virtual Machine (WAVM) State Snapshots (#2298)"] F --> F2["Bisection Game Challenge Progression"] C & D & E & F --> G["Synthesized Arbitrum Nitro Architecture Blueprint & L1 ↔ L2 Trace Graph"] ``` ### Technical Capabilities & Modules 1. **Sequencer Batch Ingestion & Brotli Decompression:** - Ingest raw transactions targeting the L1 `SequencerInbox`. - Parse Nitro batch headers: batch sequence number, previous accumulator, new accumulator. - Decompress multi-block Brotli-compressed streams to extract sequential L2 transaction arrays. 2. **Retryable Ticket Lifecycle Modeling:** - Trace L1 `createRetryableTicket` calls: extract destination, callvalue, deposit, maxSubmissionCost, excessFeeRefundAddress, callValueRefundAddress, gasLimit, maxFeePerGas, and calldata. - Calculate unique ticket ID (`keccak256(l1TxHash, ticketIndex)`). - Correlate with L2 execution logs: determine if the ticket auto-redeemed, failed due to insufficient gas, or was redeemed manually via `ArbRetryableTx.redeem(ticketId)`. 3. **ArbOS System Precompile Dissection:** - Decode calls to ArbOS system precompiles: - `ArbSys` (`0x0000000000000000000000000000000000000064`): `sendTxToL1` (L2-to-L1 exit calls), `arbBlockNumber`. - `ArbGasInfo` (`0x000000000000000000000000000000000000006c`): L1 and L2 gas pricing breakdowns. - `ArbAddressTable`: Address compression lookup table translating 4-byte indexes to 20-byte addresses. 4. **Delayed Inbox & Force-Inclusion Analysis:** - Map transactions submitted to the L1 `DelayedInbox` and track their inclusion into the canonical L2 sequence through Sequencer ingestion or force-inclusion timeouts. 5. **WAVM State Transition Audit:** - Parse WAVM execution state hashes generated during challenge games. - Correlate WAVM instructions with underlying ArbOS WebAssembly logic (#2298). ### Acceptance Criteria - [ ] Automated decompression of Arbitrum Brotli batch streams from L1 SequencerInbox calls. - [ ] End-to-end tracking of Retryable Ticket lifecycles across L1 creation, L2 redeem, and refund transfers. - [ ] Full parameter decoding for ArbOS precompile calls (`ArbSys`, `ArbGasInfo`). - [ ] Address expansion for `ArbAddressTable` indexed lookups. - [ ] Interactive visualization of cross-chain message flows and state transitions. ### Related Issues & Dependencies - Complements #972 (Solidity/EVM reverse engineering) - Complements #2391 (EVM calldata and execution trace analysis) - Complements #2298 (Decompile WebAssembly modules)

~~bsakaguchi referenced this issue 2026-10-16 21:05:48 +00:00~~

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

bsakaguchi referenced this issue

2026-10-16 21:05:50 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

bsakaguchi referenced this issue

2026-10-16 21:06:43 +00:00

[GH-ISSUE #3918] [Feature] Make JADX operation deadlines configurable for slow multidex APK loading #1529

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794