Authenticate the L2 sender in a direct OP withdrawal callback
A direct withdrawal calls an L1 target through the portal. Checking only the apparent L1 caller proves that some withdrawal was finalized, not which L2 application initiated it.
Verify both the portal and its current sender
For the direct path below, require the L1 caller to be the configured portal and compare its l2Sender() value during the callback with the authorized L2 sender. Chain-specific deployment addresses belong in configuration.
L2 application → L2ToL1MessagePasser → OptimismPortal → L1 target
If L2 contract A is authorized but contract B initiates an otherwise identical call, both callbacks can arrive from the same L1 portal. The recorded L2 sender separates them. Withdrawals do not apply the deposit address alias to this value.
Identify when a messenger changes the calling path
When an application uses the cross-domain messenger instead, the final application call comes through the local messenger and uses its sender context. Trace the actual route before wiring the authentication check. A later unrelated read cannot reproduce a transient callback context. specs.optimism.io OP Stack specification