BLAST Withdrawal Guide

This guide covers the steps necessary to bridge the BLAST token from Blast (L2) to Ethereum (L1). The guide is geared towards exchanges and other custodians that need to bridge BLAST from contracts on L2, such as multisigs or custody contracts.

The steps on Blast are calls made by the contract that holds your BLAST; each lists the contract, function, arguments, and ETH value, so you can execute them with whatever your contract or custody platform supports. The steps on Ethereum can be sent from any account; see Building the Prove and Finalize Transactions for TypeScript code examples.

How It Works

BLAST is native to Blast. It moves to Ethereum through the standard OP Stack bridge using a lock-and-mint model:

• On Blast, your BLAST is locked in the L2StandardBridge.
• On Ethereum, the same amount of L1 BLAST (0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa) is minted to your recipient when the withdrawal is finalized.

L1 BLAST is an OptimismMintableERC20. Its remoteToken() is L2 BLAST, and its bridge() is the L1StandardBridge, the only address that can mint it.

Stage	Network	Function called
Approve	Blast (L2)	approve on BLAST
Initiate	Blast (L2)	bridgeERC20To on the L2StandardBridge
Wait up to ~1 hour until ready to prove
Prove	Ethereum (L1)	proveWithdrawalTransaction on the OptimismPortal
Wait 1 day for the challenge period
Finalize	Ethereum (L1)	finalizeWithdrawalTransaction on the OptimismPortal

Before You Start

Your L2 Contract Must Be Able to Call the Bridge

The withdrawal is initiated by the contract that holds the BLAST on the L2. It must be able to make the following contract calls: approve on the BLAST token, then bridgeERC20To on the L2StandardBridge. A contract that can only transfer tokens to an address can’t start a withdrawal itself; move the BLAST to a contract or account that can.

Verify Your L1 Recipient

Before you start, verify that the intended recipient address meets the following conditions:

• It exists on Ethereum. There is contract code at the address, or it’s an EOA you control. If nothing is deployed there yet, the BLAST still arrives, but whoever later deploys a contract at that address controls it. A not-yet-deployed multisig must later be deployed with exactly the same configuration to reach the same address.
• It’s the contract you expect. Its source is verified and it’s the contract type you intended. For a multisig, it has the owners and threshold you expect.
• It can transfer the BLAST out. It must be able to send ERC20 tokens it holds to another address. A contract that can receive tokens but not send them leaves the BLAST stuck permanently.

Anyone Can Prove and Finalize

proveWithdrawalTransaction and finalizeWithdrawalTransaction on Ethereum don’t check who sends them. Any EOA with ETH for gas can submit them; your L2 contract and its signers don’t need to do anything on Ethereum.

Test With a Small Amount First

Be sure to run the whole flow end-to-end with a small amount before moving large balances.

Withdraw Your BLAST

1. Approve the bridge (Blast)

   The bridge pulls the BLAST into escrow, so it must be approved first.

   Sent by	Your L2 contract
   Contract	BLAST 0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad
   Function	approve(address spender, uint256 amount) (selector 0x095ea7b3)
   Arguments	spender: L2StandardBridge 0x4200000000000000000000000000000000000010 amount: amount of BLAST to withdraw in wei
   ETH value	0

2. Initiate the withdrawal (Blast)

   Sent by	Your L2 contract
   Contract	L2StandardBridge 0x4200000000000000000000000000000000000010
   Function	bridgeERC20To(address _localToken, address _remoteToken, address _to, uint256 _amount, uint32 _minGasLimit, bytes _extraData) (selector 0x540abf73)
   Arguments	_localToken: L2 BLAST 0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad _remoteToken: L1 BLAST 0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa _to: your Ethereum recipient _amount: same amount as the previous step, in wei _minGasLimit: 200000 _extraData: 0x (empty), or an internal reference
   ETH value	0

   Failure to use the official L1 BLAST address (0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa) as _remoteToken will permanently lock your BLAST. The L2 bridge accepts any address, but the withdrawal will then fail on Ethereum, and the BLAST can’t be recovered from the L2 bridge.

   Record these values. The later steps and status checks use them:

   • the L2 transaction hash
   • its L2 block number
   • the withdrawalHash: the last field of the MessagePassed event emitted by the L2ToL1MessagePasser (0x4200000000000000000000000000000000000016) in this transaction
3. Prove the withdrawal (Ethereum)

   Wait until the L2 output containing your transaction has been posted to Ethereum, up to ~1 hour (see Ready to Prove?). Then call proveWithdrawalTransaction on the OptimismPortal (0x0Ec68c5B10F21EFFb74f2A5C61DFe6b08C0Db6Cb):

   function proveWithdrawalTransaction(
       Types.WithdrawalTransaction memory _tx,
       uint256 _l2OutputIndex,
       Types.OutputRootProof calldata _outputRootProof,
       bytes[] calldata _withdrawalProof
   ) external;
   

   The proof arguments are built from your L2 transaction hash. See Building the Prove and Finalize Transactions for code that does this.

4. Wait for the challenge period

   Wait 1 day after proving.

5. Finalize the withdrawal (Ethereum)

   Call finalizeWithdrawalTransaction on the OptimismPortal, with hintId set to 0:

   function finalizeWithdrawalTransaction(
       uint256 hintId,                        // 0 for BLAST
       Types.WithdrawalTransaction memory _tx // same _tx as in the prove step
   ) external;
   

   This signature differs from other OP Stack chains: Blast’s portal takes an extra hintId argument before the withdrawal. For BLAST, hintId is always 0.

   Set the finalize transaction’s gas limit explicitly. The portal reverts with SafeCall: Not enough gas if the limit is too low. A withdrawal initiated with _minGasLimit 200000 needs about 670,000 gas, so use 800,000.

   See Building the Prove and Finalize Transactions for code that builds and sends this call.

   The L1StandardBridge mints L1 BLAST to your recipient in the same transaction. Confirm it arrived (see Delivered?).

Building the Prove and Finalize Transactions

The examples below use TypeScript and viem 2.57.3. Each builds the transaction from the L2 transaction hash of your initiate step and sends it.

Setup

import { createPublicClient, createWalletClient, http, parseAbi, type Hash, type Hex } from 'viem';
import { privateKeyToAccount } from 'viem/accounts';
import { blast, mainnet } from 'viem/chains';
import { getWithdrawals, publicActionsL1, publicActionsL2, walletActionsL1 } from 'viem/op-stack';

// Any Ethereum account with ETH for gas can prove and finalize.
const account = privateKeyToAccount(process.env.PRIVATE_KEY as Hex);

const publicClientL1 = createPublicClient({ chain: mainnet, transport: http(process.env.L1_RPC_URL) })
  .extend(publicActionsL1());
const walletClientL1 = createWalletClient({ account, chain: mainnet, transport: http(process.env.L1_RPC_URL) })
  .extend(walletActionsL1());
const publicClientL2 = createPublicClient({ chain: blast, transport: http() })
  .extend(publicActionsL2());

Prove

Run this once the withdrawal is ready to prove.

async function prove(l2TxHash: Hash) {
  const receipt = await publicClientL2.getTransactionReceipt({ hash: l2TxHash });
  const [withdrawal] = getWithdrawals(receipt);

  // Prove against the latest L2 output posted to Ethereum. Any output at or after the withdrawal's
  // block works, and public Blast RPCs only serve storage proofs for recent blocks.
  const latestL2Block = await publicClientL1.readContract({
    address: blast.contracts.l2OutputOracle[mainnet.id].address,
    abi: parseAbi(['function latestBlockNumber() view returns (uint256)']),
    functionName: 'latestBlockNumber',
  });
  const output = await publicClientL1.getL2Output({ l2BlockNumber: latestL2Block, targetChain: blast });

  const args = await publicClientL2.buildProveWithdrawal({ output, withdrawal });
  return walletClientL1.proveWithdrawal(args);
}

Finalize

Run this once the challenge period is over, 1 day after proving. Then confirm delivery.

async function finalize(l2TxHash: Hash) {
  const receipt = await publicClientL2.getTransactionReceipt({ hash: l2TxHash });
  const [withdrawal] = getWithdrawals(receipt);

  // Blast's portal takes a hintId before the withdrawal, so call it directly instead of using viem's
  // finalizeWithdrawal. The hintId is only used for ETH withdrawals; for BLAST it is always 0.
  const hintId = 0n;
  const finalizeCall = {
    address: blast.contracts.portal[mainnet.id].address,
    abi: parseAbi([
      'struct WithdrawalTransaction { uint256 nonce; address sender; address target; uint256 value; uint256 gasLimit; bytes data; }',
      'function finalizeWithdrawalTransaction(uint256 hintId, WithdrawalTransaction _tx)',
    ]),
    functionName: 'finalizeWithdrawalTransaction',
    args: [hintId, withdrawal],
  } as const;

  // The portal reverts with "SafeCall: Not enough gas" if the gas limit is too low. 800,000 is enough for a
  // withdrawal initiated with _minGasLimit 200000; increase it if you used a higher _minGasLimit.
  return walletClientL1.writeContract({ ...finalizeCall, gas: 800_000n });
}

Checking Withdrawal Status

Every stage can be checked with read-only calls on Ethereum, from your own tooling or the Read as Proxy tab on Etherscan, using the L2 block number and withdrawalHash you recorded when you initiated.

Stage	Check	Done when
Ready to prove	L2OutputOracle.latestBlockNumber()	≥ your L2 block number
Proven	OptimismPortal.provenWithdrawals(withdrawalHash)	timestamp ≠ 0
Challenge period over	proven timestamp + L2OutputOracle.FINALIZATION_PERIOD_SECONDS()	≤ the current time
Finalized	OptimismPortal.finalizedWithdrawals(withdrawalHash)	true
Delivered	L1BLAST.balanceOf(_to)	increased by your amount

Ready to Prove?

L2OutputOracle.latestBlockNumber() >= l2BlockNumber

Proven?

(bytes32 outputRoot, uint128 timestamp, uint128 l2OutputIndex, uint256 requestId)
    = OptimismPortal.provenWithdrawals(withdrawalHash);

A timestamp of 0 means the withdrawal hasn’t been proven. requestId is always 0 for BLAST.

Challenge Period Over?

block.timestamp >= timestamp + L2OutputOracle.FINALIZATION_PERIOD_SECONDS()

timestamp is the proven timestamp from the previous check. The challenge period is currently 86400 seconds (1 day).

Finalized?

OptimismPortal.finalizedWithdrawals(withdrawalHash) == true

This means the finalize transaction has run. It doesn’t by itself mean the BLAST was minted: check Delivered?.

Delivered?

Finalizing hands the withdrawal to the L1CrossDomainMessenger (0x5D4472f31Bd9385709ec61305AFc749F0fA8e9d0), which calls the L1StandardBridge to mint. If that call fails (for example, because of a wrong _remoteToken), the withdrawal is still marked as finalized, but the messenger records the message as failed and nothing is minted.

Confirm delivery in any of these ways:

• L1BLAST.balanceOf(_to) increased by your amount.
• The finalize transaction emitted ERC20BridgeFinalized from the L1StandardBridge.
• L1CrossDomainMessenger.successfulMessages(keccak256(data)) is true, where data is the data field of your withdrawal’s MessagePassed event.

Contract Addresses

Blast (Chain ID 81457)

Contract	Address
BLAST	0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad
L2StandardBridge	0x4200000000000000000000000000000000000010
L2ToL1MessagePasser	0x4200000000000000000000000000000000000016

Ethereum (Chain ID 1)

Contract	Address
L1 BLAST	0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa
OptimismPortal	0x0Ec68c5B10F21EFFb74f2A5C61DFe6b08C0Db6Cb
L2OutputOracle	0x826D1B0D4111Ad9146Eb8941D7Ca2B6a44215c76
L1StandardBridge	0x697402166Fbf2F22E970df8a6486Ef171dbfc524
L1CrossDomainMessenger	0x5D4472f31Bd9385709ec61305AFc749F0fA8e9d0