Mainnet Deployment

Deploy to Base and Arbitrum mainnet.

[x] Pre-deployment checklist

Before deploying to mainnet: complete two independent audits, run the keeper on testnet for at least 72 hours, and confirm the governance multisig is a hardware-wallet-backed Safe.

Pre-deployment checklist

  • All Foundry tests pass: forge test --fuzz-runs 10000
  • Two independent audits completed and findings addressed
  • Governance multisig configured (Gnosis Safe with 3-of-5 minimum)
  • Treasury address is a cold-storage or multisig wallet
  • Testnet keeper ran successfully for 72+ hours
  • Immunefi bug bounty program live
  • Incident response plan documented

Deploy to Base mainnet

bash
cd codebase/contracts

# Double-check .env has mainnet values
grep DEPLOYER_PRIVATE_KEY .env
grep PROTOCOL_TREASURY .env
grep GOVERNANCE_MULTISIG .env

forge script script/Deploy.s.sol \
  --rpc-url base \
  --broadcast \
  --verify \
  --slow \          # Slower but safer for mainnet
  -vvvv

Deploy to Arbitrum mainnet

bash
forge script script/Deploy.s.sol \
  --rpc-url arbitrum \
  --broadcast \
  --verify \
  --slow \
  -vvvv

[*] Same addresses

The CREATE2 salt ensures identical addresses on both chains. Verify this by comparing the registry address output from both deployments.

Post-deployment

1. Propagate addresses

bash
# Base mainnet
./scripts/configure-addresses.sh \
  --registry 0xYOUR_REGISTRY \
  --chain base \
  --start-block YOUR_DEPLOY_BLOCK

2. Verify on explorers

  • Check Basescan: contract source should be verified
  • Check Arbiscan: same
  • Confirm PaymentRouter has correct fee params
  • Confirm governance multisig is set correctly

3. Deploy subgraph

See Subgraph Deploy.

4. Start keeper(s)

Deploy at least one keeper on a reliable server. Consider running two for redundancy — they compete permissionlessly.

bash
# On your production server
cd packages/keeper
npm run start

# Or with pm2
pm2 start npm --name "cron-keeper-base" -- run start

5. Publish contract addresses

Update the SDK's src/utils/chains.ts with the deployed mainnet addresses so downstream users get the correct registry addresses automatically.