(This is a Runbook template specifically for addressing alerts.)

Related Alerts

1. two-step-withdraw-forgery-detected
2. two-step-withdraw-forgery-detection-stalled
3. two-step-withdraw-forgery-detection-error-unhandled

Alert Severity

1. SEV2 for two-step-withdraw-forgery-detected OP and SuperChain Networks (Base,Mode,…) mainnet
2. SEV3 for two-step-withdraw-forgery-detection-stalled OP and SuperChain Networks (Base,Mode,…) mainnet
3. SEV3 for two-step-withdraw-forgery-detection-error-unhandled OP and SuperChain Networks (Base,Mode,…) mainnet

Alert Summary

1. two-step-withdraw-forgery-detected indicates there a withdrawal has been proven on L1, which was not initiated on L2
2. two-step-withdraw-forgery-detection-stalled indicates that wd-mon has not see any WithdrawalProven events emitted for some period of time.
3. two-step-withdraw-forgery-detection-error-unhandled indicates that the wd-mon threw unhandled errors.

An alert contains the name of the network to which the alert refers. For example:

Fault Detector Stalled (OP MAINNET A1S2 PROD)

• OP refers to the optimism network. Other example values could be MODE, BASE, … (for a specific superchain network).
• A1S2 PROD: is the specific deployment type on which the alert was triggered. For the same network, we may have multiple deployments of the monitoring to have multiple sources of truth in terms of which node we use for our checks.

Investigation

Dashboard: https://optimistic.grafana.net/d/culLm8a4k/withdraw-monitor?orgId=1