feat(safe): Ethereum token-owner Safe — distinct per-chain address pin + policy-parity

[hardyjosh]

RAI-1109 (Josh, 2026-07-07): give Ethereum the SAME token-owner Safe
address as Base rather than a fresh per-chain address.

A Safe address is CREATE2(proxyFactory, keccak(keccak(initializer) ++
saltNonce), keccak(proxyCreationCode ++ singleton)), so replaying the
exact genesis creation call on Ethereum yields the identical address.

• LibStoxSafeGenesis pins the genesis params recovered from the Base
  creation tx (Safe tx service): the Safe was CREATED as v1.3.0 (factory
  0xa6B71E26…, singleton 0x3E5c6364…), saltNonce 0, with the verbatim
  setup initializer — 3 owners / threshold 2 — then later upgraded to
  v1.4.1 and expanded to the current 6 owners / threshold 3. Address is
  fixed by the v1.3.0 creation params, so the reproduction uses those.
  The v1.3.0 factory + singleton + fallback are already live at the same
  addresses on Ethereum (verified 2026-07-07).

• 20260707-deploy-safe-ethereum.s.sol: EOA-broadcast
  createProxyWithNonce with the pinned genesis inputs, asserting the
  produced proxy == LibSafeInvariants.STOX_TOKEN_OWNER_SAFE (a
  genesis-param drift fails loudly), guarded against re-running once the
  target has code.

• Fork test PROVES it: runs the real v1.3.0 factory on an Ethereum fork
  and asserts the proxy is byte-for-byte the Base Safe address, in the
  genesis 3-owner/threshold-2 state.

Scope boundary: this puts the matched ADDRESS on-chain in its genesis
state. Reaching Base's CURRENT policy (upgrade to v1.4.1, add the 3
later owners, raise threshold to 3) is a separate post-deploy replay
signed by the genesis owners — documented in the runbook § 3a.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01VPs1hCTxusmaSeFKvoc4Kr

Linear: RAI-1109. Sits right after the network-wiring PR (#227), below principals. Fork test proves it: the pinned genesis params reproduce the exact Base Safe address on a live Ethereum fork. Scope = the matched address in its genesis state (3 owners / threshold 2, v1.3.0); the genesis→current policy replay (upgrade to v1.4.1, +3 owners, threshold 3, signed by the genesis owners) is documented in the runbook § 3a as a follow-up. Alternative was a fresh v1.4.1 Safe with a different address.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VPs1hCTxusmaSeFKvoc4Kr

[coderabbitai]

Warning

Review limit reached

@hardyjosh, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: eae0d9ef-e75e-42cf-9796-11fae718a026

📥 Commits

Reviewing files that changed from the base of the PR and between 23c37f1 and 3cd70ce.

📒 Files selected for processing (2)

• src/lib/LibSafeInvariants.sol
• test/src/concrete/deploy/EthereumTokenOwnerSafeParity.t.sol

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/rai-1109-deploy-safe-ethereum

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• feat(script): deploy the Ethereum production tokens via the deploy key, matched to Base #231 : 2 dependent PRs (#257 , #258 )
• test(parity): cross-chain deployment parity pin + scheduled CI #230
• feat(deploy): Ethereum V4 authoriser clone — chain-parametric deploy script + per-chain pin selector #229
• refactor(invariants): structured token table + per-chain-Safe-parametric invariants #228
• feat(beacon): migrate Ethereum production beacons to the Ethereum Safe #262
• feat(safe): Ethereum token-owner Safe — distinct per-chain address pin + policy-parity #232 👈 (View in Graphite)
• feat(deploy): ship the audited 0.1.1 production set to Ethereum mainnet #227
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.