Implement restriction to allow limiting chain admin in power

[StanislavBreadless]

What ❔

Why ❔

Checklist

• PR title corresponds to the body of PR (we generate changelog entries from PRs).
• Tests for the changes have been added / updated.
• Documentation comments have been added / updated.

[vladbochok]

Very nice! I think we can also add roles to the contracts so instead of requiring onlyOwner to be the caller, we can pass msg.sender to restriction module contract and it will check whether such a role can do what it wants to do.

[github-actions]

Changes to gas cost

Generated at commit: 6011d4cde5cd2c00e5e188a946ec6d977fb526a6, compared to commit: f1a8c2df06b2b3fa275eb439a662334917adcf51

🧾 Summary (100% most significant diffs)

Contract	Method	Avg (+/-)	%
MerkleTest	calculateRoot(bytes32[],uint256,bytes32)	-1 ✅	-0.03%
DummyStateTransitionManagerWBH	setHyperchain	+1 ❌	+0.00%

---

Full diff report 👇

Contract	Deployment Cost (+/-)	Method	Min (+/-)	%	Avg (+/-)	%	Median (+/-)	%	Max (+/-)	%	# Calls (+/-)
Bridgehub	3,520,685 (0)	addStateTransitionManager proveL1ToL2TransactionStatus proveL2LogInclusion removeStateTransitionManager setPendingAdmin	23,896 (0) 0 (0) 0 (0) 23,895 (0) 25,942 (0)	0.00% +∞% +∞% 0.00% 0.00%	41,155 (+1) 1,944 (-5) 2,056 (+19) 25,550 (+5) 37,885 (-3)	+0.00% -0.26% +0.93% +0.02% -0.01%	47,587 (0) 1,539 (-3) 1,676 (0) 25,905 (0) 37,852 (0)	0.00% -0.19% 0.00% 0.00% 0.00%	47,587 (0) 4,748 (0) 5,026 (0) 26,362 (0) 49,762 (0)	0.00% 0.00% 0.00% 0.00% 0.00%	3,584 (0) 512 (0) 512 (0) 2,048 (0) 512 (0)
MerkleTest	468,218 (0)	calculateRoot(bytes32[],uint256,bytes32)	606 (0)	0.00%	2,919 (-1)	-0.03%	2,943 (0)	0.00%	2,998 (+11)	+0.37%	261 (0)
MerkleTreeNoSort	534,636 (0)	getProof	32,953 (0)	0.00%	33,183 (+3)	+0.01%	33,193 (0)	0.00%	33,215 (0)	0.00%	273 (0)
DummyStateTransitionManagerWBH	4,205,170 (0)	setHyperchain	111,114 (0)	0.00%	111,152 (+1)	+0.00%	111,162 (-12)	-0.01%	111,174 (0)	0.00%	768 (0)

[vladbochok]

Not a final review

[vladbochok]

@StanislavBreadless Perhaps you should change the base branch to main as this is a change we can quickly roll out without need to do the proper upgrade.

[github-actions]

Coverage after merging sb-limited-chain-amdin into dev will be

87.39%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
contracts/bridge
L1ERC20Bridge.sol	81.82%	80%	75%	83.87%	62, 70, 70–71, 73–74
L1SharedBridge.sol	79.29%	68.66%	82.35%	82.21%	103–104, 111–112, 119, 119–120, 153–154, 162–163, 175–176, 178–179, 190, 190, 190–194, 194–195, 197, 202–204, 204–205, 207–209, 209–210, 212, 224, 233, 233–234, 393–394, 396–397, 528–529, 545–546, 556–557, 572–573, 669–670, 911, 916, 95–96
contracts/bridgehub
Bridgehub.sol	89.29%	74.07%	100%	91.49%	100–101, 112–113, 132–133, 155–156, 158–159, 332–333, 49, 63–64
contracts/common
ReentrancyGuard.sol	90%	66.67%	100%	92.86%	78–79
contracts/common/libraries
L2ContractHelper.sol	42.86%	0%	50%	52.63%	25–26, 31–32, 35–36, 50, 52, 52–53, 57, 57–58, 66
SemVer.sol	100%	100%	100%	100%
UncheckedMath.sol	100%	100%	100%	100%
UnsafeBytes.sol	100%	100%	100%	100%
contracts/governance
AccessControlRestriction.sol	100%	100%	100%	100%
ChainAdmin.sol	95.12%	80%	100%	96.15%	27–28
Governance.sol	91.67%	94.74%	95%	89.86%	45, 45–46, 49, 51–52, 54–55
PermanentRestriction.sol	87.32%	78.57%	100%	87.23%	142, 142–143, 146, 148, 148–149, 176–177
contracts/state-transition
StateTransitionManager.sol	59.48%	35.71%	50%	65.42%	101, 106–110, 116, 149–150, 152–153, 155–156, 158–159, 201, 203–204, 209, 211, 211–212, 215–217, 219–220, 255, 275, 289, 294, 299, 304, 309, 314, 319, 386, 386–387, 390, 455–456, 79, 92, 92–93
TestnetVerifier.sol	44.44%	33.33%	50%	50%	16, 16, 16, 32
ValidatorTimelock.sol	95.89%	83.33%	100%	95.83%	241, 82–83
Verifier.sol	89.88%	35.71%	96.30%	90.93%	1673–1674, 287–302, 305–308, 311–318, 321–328, 331–332, 335–336, 339, 384–385, 395–396, 406–407, 417–418, 428–429, 444–445, 454, 454–455, 904–905
contracts/state-transition/chain-deps
DiamondInit.sol	77.55%	45.45%	100%	86.11%	34–35, 37–38, 40–41, 43–44, 46–47, 71
DiamondProxy.sol	92.31%	75%	100%	100%	16, 27
contracts/state-transition/chain-deps/facets
Admin.sol	86.21%	72.73%	92.31%	87.30%	109, 109–110, 112–113, 178, 180, 83–84, 94–95
Executor.sol	82.04%	63.41%	84.38%	87.90%	137–138, 192, 197, 202, 207, 212, 217, 222, 227, 230–231, 235–236, 240–242, 244–245, 260–261, 280, 294–295, 361–362, 425, 447–449, 469, 48, 48–49, 519–520, 528–529, 549, 556–557, 57, 59, 59–60, 619, 62, 620, 63, 646–647, 696–697, 70, 700–701, 71, 74–75, 775
Getters.sol	94.17%	100%	92.86%	94.92%	211, 77, 82
Mailbox.sol	100%	100%	100%	100%
ZkSyncHyperchainBase.sol	92.86%	85.71%	100%	92.86%	55–56
contracts/state-transition/libraries
Diamond.sol	93.33%	80.77%	100%	95.96%	109–110, 113, 115, 117, 120, 198–199, 316
LibMap.sol	100%	100%	100%	100%
Merkle.sol	100%	100%	100%	100%
PriorityQueue.sol	100%	100%	100%	100%
TransactionValidator.sol	94.44%	88.24%	100%	96%	66–67, 69–70
contracts/upgrades
BaseZkSyncUpgrade.sol	58.20%	27.27%	100%	60.23%	104, 104–105, 108, 111, 114–115, 126, 126–127, 130, 133, 136–137, 151–153, 171–173, 212–213, 215, 215–216, 232–233, 249–250, 252–253, 258–259, 259–260, 271–272, 278–279, 285–286, 293–294, 298–299, 308–309, 311–312, 75–76
BaseZkSyncUpgradeGenesis.sol	56.67%	14.29%	100%	68.18%	25, 25–26, 33–34, 40–41, 52–53, 62–63, 65–66
DefaultUpgrade.sol	100%	100%	100%	100%
GenesisUpgrade.sol	100%	100%	100%	100%
contracts/vendor
AddressAliasHelper.sol	85.71%	75%	100%	85.71%	60, 62