> ## Documentation Index
> Fetch the complete documentation index at: https://metalayerlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# BLAST Withdrawal Guide

This guide covers the steps necessary to bridge the BLAST token from Blast (L2) to Ethereum (L1). The guide is geared towards exchanges and other custodians that need to bridge BLAST from contracts on L2, such as multisigs or custody contracts.

The steps on Blast are calls made by the contract that holds your BLAST; each lists the contract, function, arguments, and ETH value, so you can execute them with whatever your contract or custody platform supports. The steps on Ethereum can be sent from any account; see [Building the Prove and Finalize Transactions](#building-the-prove-and-finalize-transactions) for TypeScript code examples.

## How It Works

BLAST is native to Blast. It moves to Ethereum through the standard OP Stack bridge using a **lock-and-mint** model:

* **On Blast**, your BLAST is **locked** in the **L2StandardBridge**.
* **On Ethereum**, the same amount of **L1 BLAST** (`0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa`) is **minted** to your recipient when the withdrawal is finalized.

L1 BLAST is an [`OptimismMintableERC20`](https://docs.optimism.io/app-developers/tutorials/bridging/standard-bridge-standard-token#about-optimismmintableerc20s). Its `remoteToken()` is L2 BLAST, and its `bridge()` is the **L1StandardBridge**, the only address that can mint it.

| Stage | Network | Function called |
| - | - | - |
| Approve | Blast (L2) | `approve` on BLAST |
| Initiate | Blast (L2) | `bridgeERC20To` on the L2StandardBridge |
| *Wait up to \~1 hour until ready to prove* | | |
| Prove | Ethereum (L1) | `proveWithdrawalTransaction` on the OptimismPortal |
| *Wait **1 day** for the challenge period* | | |
| Finalize | Ethereum (L1) | `finalizeWithdrawalTransaction` on the OptimismPortal |

## Before You Start

### Your L2 Contract Must Be Able to Call the Bridge

The withdrawal is initiated by **the contract that holds the BLAST** on the L2. It must be able to make the following contract calls: `approve` on the BLAST token, then `bridgeERC20To` on the L2StandardBridge. A contract that can only transfer tokens to an address can't start a withdrawal itself; move the BLAST to a contract or account that can.

### Verify Your L1 Recipient

Before you start, verify that the intended recipient address meets the following conditions:

* **It exists on Ethereum.** There is contract code at the address, or it's an EOA you control. If nothing is deployed there yet, the BLAST still arrives, but whoever later deploys a contract at that address controls it. A not-yet-deployed multisig must later be deployed with exactly the same configuration to reach the same address.
* **It's the contract you expect.** Its source is verified and it's the contract type you intended. For a multisig, it has the owners and threshold you expect.
* **It can transfer the BLAST out.** It must be able to send ERC20 tokens it holds to another address. A contract that can receive tokens but not send them leaves the BLAST stuck permanently.

### Anyone Can Prove and Finalize

`proveWithdrawalTransaction` and `finalizeWithdrawalTransaction` on Ethereum don't check who sends them. Any EOA with ETH for gas can submit them; your L2 contract and its signers don't need to do anything on Ethereum.

### Test With a Small Amount First

Be sure to run the whole flow end-to-end with a small amount before moving large balances.

## Withdraw Your BLAST

<Steps>
  <Step title="Approve the bridge (Blast)">
    The bridge pulls the BLAST into escrow, so it must be approved first.

    | | |
    | - | - |
    | Sent by | Your L2 contract |
    | Contract | **BLAST** `0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad` |
    | Function | `approve(address spender, uint256 amount)` (selector `0x095ea7b3`) |
    | Arguments | `spender`: L2StandardBridge `0x4200000000000000000000000000000000000010` <br /> `amount`: amount of BLAST to withdraw in wei |
    | ETH value | 0 |
  </Step>

  <Step title="Initiate the withdrawal (Blast)">
    | | |
    | - | - |
    | Sent by | Your L2 contract |
    | Contract | **L2StandardBridge** `0x4200000000000000000000000000000000000010` |
    | Function | `bridgeERC20To(address _localToken, address _remoteToken, address _to, uint256 _amount, uint32 _minGasLimit, bytes _extraData)` (selector `0x540abf73`) |
    | Arguments | `_localToken`: L2 BLAST `0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad` <br /> `_remoteToken`: L1 BLAST `0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa` <br /> `_to`: your Ethereum recipient <br /> `_amount`: same amount as the previous step, in wei <br /> `_minGasLimit`: `200000` <br /> `_extraData`: `0x` (empty), or an internal reference |
    | ETH value | 0 |

    <Warning>
      **Failure to use the official L1 BLAST address (`0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa`) as `_remoteToken` will permanently lock your BLAST.** The L2 bridge accepts any address, but the withdrawal will then fail on Ethereum, and the BLAST can't be recovered from the L2 bridge.
    </Warning>

    Record these values. The later steps and status checks use them:

    * the **L2 transaction hash**
    * its **L2 block number**
    * the **`withdrawalHash`**: the last field of the `MessagePassed` event emitted by the L2ToL1MessagePasser (`0x4200000000000000000000000000000000000016`) in this transaction
  </Step>

  <Step title="Prove the withdrawal (Ethereum)">
    Wait until the L2 output containing your transaction has been posted to Ethereum, up to \~1 hour (see [Ready to Prove?](#ready-to-prove)). Then call `proveWithdrawalTransaction` on the **OptimismPortal** (`0x0Ec68c5B10F21EFFb74f2A5C61DFe6b08C0Db6Cb`):

    ```solidity theme={null}
    function proveWithdrawalTransaction(
        Types.WithdrawalTransaction memory _tx,
        uint256 _l2OutputIndex,
        Types.OutputRootProof calldata _outputRootProof,
        bytes[] calldata _withdrawalProof
    ) external;
    ```

    The proof arguments are built from your L2 transaction hash. See [Building the Prove and Finalize Transactions](#building-the-prove-and-finalize-transactions) for code that does this.
  </Step>

  <Step title="Wait for the challenge period">
    Wait **1 day** after proving.
  </Step>

  <Step title="Finalize the withdrawal (Ethereum)">
    Call `finalizeWithdrawalTransaction` on the **OptimismPortal**, with `hintId` set to `0`:

    ```solidity theme={null}
    function finalizeWithdrawalTransaction(
        uint256 hintId,                        // 0 for BLAST
        Types.WithdrawalTransaction memory _tx // same _tx as in the prove step
    ) external;
    ```

    <Warning>
      This signature **differs from other OP Stack chains**: Blast's portal takes an extra `hintId` argument before the withdrawal. For BLAST, `hintId` is always `0`.
    </Warning>

    <Warning>
      Set the finalize transaction's gas limit explicitly. The portal reverts with `SafeCall: Not enough gas` if the limit is too low. A withdrawal initiated with `_minGasLimit` `200000` needs about 670,000 gas, so use **800,000**.
    </Warning>

    See [Building the Prove and Finalize Transactions](#building-the-prove-and-finalize-transactions) for code that builds and sends this call.

    The L1StandardBridge mints L1 BLAST to your recipient in the same transaction. Confirm it arrived (see [Delivered?](#delivered)).
  </Step>
</Steps>

## Building the Prove and Finalize Transactions

The examples below use TypeScript and [viem](https://viem.sh) `2.57.3`. Each builds the transaction from the **L2 transaction hash** of your initiate step and sends it.

### Setup

```typescript theme={null}
import { createPublicClient, createWalletClient, http, parseAbi, type Hash, type Hex } from 'viem';
import { privateKeyToAccount } from 'viem/accounts';
import { blast, mainnet } from 'viem/chains';
import { getWithdrawals, publicActionsL1, publicActionsL2, walletActionsL1 } from 'viem/op-stack';

// Any Ethereum account with ETH for gas can prove and finalize.
const account = privateKeyToAccount(process.env.PRIVATE_KEY as Hex);

const publicClientL1 = createPublicClient({ chain: mainnet, transport: http(process.env.L1_RPC_URL) })
  .extend(publicActionsL1());
const walletClientL1 = createWalletClient({ account, chain: mainnet, transport: http(process.env.L1_RPC_URL) })
  .extend(walletActionsL1());
const publicClientL2 = createPublicClient({ chain: blast, transport: http() })
  .extend(publicActionsL2());
```

### Prove

Run this once the withdrawal is [ready to prove](#ready-to-prove).

```typescript theme={null}
async function prove(l2TxHash: Hash) {
  const receipt = await publicClientL2.getTransactionReceipt({ hash: l2TxHash });
  const [withdrawal] = getWithdrawals(receipt);

  // Prove against the latest L2 output posted to Ethereum. Any output at or after the withdrawal's
  // block works, and public Blast RPCs only serve storage proofs for recent blocks.
  const latestL2Block = await publicClientL1.readContract({
    address: blast.contracts.l2OutputOracle[mainnet.id].address,
    abi: parseAbi(['function latestBlockNumber() view returns (uint256)']),
    functionName: 'latestBlockNumber',
  });
  const output = await publicClientL1.getL2Output({ l2BlockNumber: latestL2Block, targetChain: blast });

  const args = await publicClientL2.buildProveWithdrawal({ output, withdrawal });
  return walletClientL1.proveWithdrawal(args);
}
```

### Finalize

Run this once the [challenge period is over](#challenge-period-over), 1 day after proving. Then [confirm delivery](#delivered).

```typescript theme={null}
async function finalize(l2TxHash: Hash) {
  const receipt = await publicClientL2.getTransactionReceipt({ hash: l2TxHash });
  const [withdrawal] = getWithdrawals(receipt);

  // Blast's portal takes a hintId before the withdrawal, so call it directly instead of using viem's
  // finalizeWithdrawal. The hintId is only used for ETH withdrawals; for BLAST it is always 0.
  const hintId = 0n;
  const finalizeCall = {
    address: blast.contracts.portal[mainnet.id].address,
    abi: parseAbi([
      'struct WithdrawalTransaction { uint256 nonce; address sender; address target; uint256 value; uint256 gasLimit; bytes data; }',
      'function finalizeWithdrawalTransaction(uint256 hintId, WithdrawalTransaction _tx)',
    ]),
    functionName: 'finalizeWithdrawalTransaction',
    args: [hintId, withdrawal],
  } as const;

  // The portal reverts with "SafeCall: Not enough gas" if the gas limit is too low. 800,000 is enough for a
  // withdrawal initiated with _minGasLimit 200000; increase it if you used a higher _minGasLimit.
  return walletClientL1.writeContract({ ...finalizeCall, gas: 800_000n });
}
```

## Checking Withdrawal Status

Every stage can be checked with read-only calls on Ethereum, from your own tooling or the **Read as Proxy** tab on Etherscan, using the **L2 block number** and **`withdrawalHash`** you recorded when you initiated.

| Stage | Check | Done when |
| - | - | - |
| Ready to prove | `L2OutputOracle.latestBlockNumber()` | ≥ your L2 block number |
| Proven | `OptimismPortal.provenWithdrawals(withdrawalHash)` | `timestamp` ≠ 0 |
| Challenge period over | proven `timestamp` + `L2OutputOracle.FINALIZATION_PERIOD_SECONDS()` | ≤ the current time |
| Finalized | `OptimismPortal.finalizedWithdrawals(withdrawalHash)` | `true` |
| Delivered | `L1BLAST.balanceOf(_to)` | increased by your amount |

### Ready to Prove?

```solidity theme={null}
L2OutputOracle.latestBlockNumber() >= l2BlockNumber
```

### Proven?

```solidity theme={null}
(bytes32 outputRoot, uint128 timestamp, uint128 l2OutputIndex, uint256 requestId)
    = OptimismPortal.provenWithdrawals(withdrawalHash);
```

A `timestamp` of `0` means the withdrawal hasn't been proven. `requestId` is always `0` for BLAST.

### Challenge Period Over?

```solidity theme={null}
block.timestamp >= timestamp + L2OutputOracle.FINALIZATION_PERIOD_SECONDS()
```

`timestamp` is the proven timestamp from the previous check. The challenge period is currently 86400 seconds (1 day).

### Finalized?

```solidity theme={null}
OptimismPortal.finalizedWithdrawals(withdrawalHash) == true
```

This means the finalize transaction has run. It doesn't by itself mean the BLAST was minted: check [Delivered?](#delivered).

### Delivered?

Finalizing hands the withdrawal to the **L1CrossDomainMessenger** (`0x5D4472f31Bd9385709ec61305AFc749F0fA8e9d0`), which calls the L1StandardBridge to mint. If that call fails (for example, because of a wrong `_remoteToken`), the withdrawal is still marked as finalized, but the messenger records the message as failed and nothing is minted.

Confirm delivery in any of these ways:

* `L1BLAST.balanceOf(_to)` increased by your amount.
* The finalize transaction emitted `ERC20BridgeFinalized` from the L1StandardBridge.
* `L1CrossDomainMessenger.successfulMessages(keccak256(data))` is `true`, where `data` is the `data` field of your withdrawal's `MessagePassed` event.

## Contract Addresses

### Blast (Chain ID 81457)

| Contract | Address |
| - | - |
| BLAST | `0xb1a5700fA2358173Fe465e6eA4Ff52E36e88E2ad` |
| L2StandardBridge | `0x4200000000000000000000000000000000000010` |
| L2ToL1MessagePasser | `0x4200000000000000000000000000000000000016` |

### Ethereum (Chain ID 1)

| Contract | Address |
| - | - |
| L1 BLAST | `0x71b9e0FD392713A14FCaB92D9aF7A21F47E3b1Fa` |
| OptimismPortal | `0x0Ec68c5B10F21EFFb74f2A5C61DFe6b08C0Db6Cb` |
| L2OutputOracle | `0x826D1B0D4111Ad9146Eb8941D7Ca2B6a44215c76` |
| L1StandardBridge | `0x697402166Fbf2F22E970df8a6486Ef171dbfc524` |
| L1CrossDomainMessenger | `0x5D4472f31Bd9385709ec61305AFc749F0fA8e9d0` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.