batcher: add batchSubmitter.checkExpectedProgress

[geoknee]

towards #12124

[semgrep-app]

Semgrep found 1 err-todo finding:

• op-program/client/l2/engineapi/l2_engine_api.go
  • L500 - Triage

TODO in error handling code

_{Ignore this finding from err-todo.}

[semgrep-app]

Semgrep found 3 sol-style-require-reason findings:

• packages/contracts-bedrock/scripts/deploy/Deploy.s.sol
  • L1002 - Triage
  • L1083 - Triage
  • L1090-1093 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 6 sol-style-input-arg-fmt findings:

• packages/contracts-bedrock/src/L2/interfaces/ISuperchainWETH.sol
  • L20 - Triage
  • L25 - Triage
  • L26 - Triage
  • L29 - Triage
  • L30 - Triage
  • L32 - Triage

Inputs to functions must be prepended with an underscore (_)

_{Ignore this finding from sol-style-input-arg-fmt.}

Semgrep found 4 golang_fmt_errorf_no_params findings:

• op-supervisor/supervisor/backend/db/db_test.go
  • L280 - Triage
• op-chain-ops/deployer/state/intent.go
  • L75 - Triage
  • L83 - Triage
• op-chain-ops/deployer/bootstrap/bootstrap.go
  • L59 - Triage

No fmt.Errorf invocations without fmt arguments allowed

_{Ignore this finding from golang_fmt_errorf_no_params.}

Semgrep found 1 math-random-used finding:

• op-supervisor/supervisor/backend/source/head_monitor_test.go
  • L7 - Triage

Do not use math/rand. Use crypto/rand instead.

_{Ignore this finding from math-random-used.}

Semgrep found 1 marshal-json-pointer-receiver finding:

• op-supervisor/supervisor/backend/db/heads/types.go
  • L99 - Triage

MarshalJSON with a pointer receiver has surprising results: golang/go#22967

_{Ignore this finding from marshal-json-pointer-receiver.}

Semgrep found 1 err-nil-check finding:

• op-supervisor/supervisor/backend/db/db.go
  • L108-112 - Triage

superfluous nil err check before return

_{Ignore this finding from err-nil-check.}

[semgrep-app]

Semgrep found 7 sol-style-require-reason findings:

• packages/contracts-bedrock/src/universal/WETH98.sol
  • L60 - Triage
  • L85 - Triage
  • L88 - Triage
• packages/contracts-bedrock/src/L2/SuperchainWETH.sol
  • L94 - Triage
• packages/contracts-bedrock/scripts/ops/FeeVaultWithdrawal.s.sol
  • L23 - Triage
• op-chain-ops/script/testdata/scripts/ScriptExample.s.sol
  • L126 - Triage
  • L131 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 2 sol-style-notice-over-dev-natspec findings:

• packages/contracts-bedrock/src/cannon/interfaces/IPreimageOracle.sol
  • L25 - Triage
• packages/contracts-bedrock/scripts/autogen/SemverLock.s.sol
  • L22 - Triage

Prefer @notice over @dev in natspec comments

_{Ignore this finding from sol-style-notice-over-dev-natspec.}

Semgrep found 11 sol-style-input-arg-fmt findings:

• packages/contracts-bedrock/src/universal/interfaces/IWETH.sol
  • L44 - Triage
  • L50 - Triage
  • L57 - Triage
  • L67 - Triage
  • L73 - Triage
  • L80 - Triage
• packages/contracts-bedrock/src/L2/SuperchainWETH.sol
  • L34 - Triage
  • L40 - Triage
  • L61 - Triage
  • L85 - Triage
  • L93 - Triage

Inputs to functions must be prepended with an underscore (_)

_{Ignore this finding from sol-style-input-arg-fmt.}

Semgrep found 19 golang_fmt_errorf_no_params findings:

• packages/contracts-bedrock/scripts/checks/semver-natspec/main.go
  • L186 - Triage
• op-chain-ops/deployer/state/intent.go
  • L37 - Triage
  • L63 - Triage
  • L124 - Triage
  • L128 - Triage
  • L140 - Triage
  • L144 - Triage
• op-chain-ops/deployer/opcm/opchain.go
  • L321 - Triage
• op-chain-ops/deployer/bootstrap/bootstrap.go
  • L41 - Triage
  • L45 - Triage
  • L55 - Triage
  • L63 - Triage
• op-chain-ops/deployer/apply.go
  • L34 - Triage
  • L38 - Triage
  • L42 - Triage
  • L52 - Triage
• op-bootnode/bootnode/entrypoint.go
  • L75 - Triage
  • L80 - Triage
  • L93 - Triage

No fmt.Errorf invocations without fmt arguments allowed

_{Ignore this finding from golang_fmt_errorf_no_params.}

Semgrep found 1 ban_non_wraparound_modifiers finding:

• packages/contracts-bedrock/src/L1/DelayedVetoable.sol
  • L64-65 - Triage

Modifiers that don't do something before and after execution are banned.

_{Ignore this finding from ban_non_wraparound_modifiers.}

Semgrep found 1 no-direct-write-to-responsewriter finding:

• op-challenger/game/fault/trace/prestates/multi_test.go
  • L172 - Triage

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

_{Ignore this finding from no-direct-write-to-responsewriter.}

Semgrep found 1 math-random-used finding:

• op-e2e/system/conductor/sequencer_failover_setup.go
  • L6 - Triage

Do not use math/rand. Use crypto/rand instead.

_{Ignore this finding from math-random-used.}

Semgrep found 1 no-direct-write-to-responsewriter-taint finding:

• op-challenger/game/fault/trace/prestates/multi_test.go
  • L172 - Triage

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: Go XSS prevention.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>op-challenger/game/fault/trace/prestates/multi_test.go</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/ethereum-optimism/optimism/blob/3df8d166daaea9e96139c050c390244192766239/op-challenger/game/fault/trace/prestates/multi_test.go#L172 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 172] r.URL</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/ethereum-optimism/optimism/blob/3df8d166daaea9e96139c050c390244192766239/op-challenger/game/fault/trace/prestates/multi_test.go#L172 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 172] w.Write([]byte(r.URL.Path))</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

_{Ignore this finding from no-direct-write-to-responsewriter-taint.}

Semgrep found 5 sprintf-host-port findings:

• op-e2e/system/conductor/sequencer_failover_setup.go
  • L61 - Triage
  • L61 - Triage
• op-conductor/conductor/service.go
  • L171 - Triage
  • L171 - Triage
  • L171 - Triage

use net.JoinHostPort instead of fmt.Sprintf(localhost, c.consensusPort)

_{Ignore this finding from sprintf-host-port.}