feat(contract): TEE verifier contract-account voting

[pbeza]

Closes #3625. Next slice of #3540, stacked on #3590; each slice leaves main runnable.

Why

Moving DCAP verification off the mpc-contract WASM means offloading it to a standalone tee-verifier contract over a cross-contract call — which needs a trusted verifier contract account chosen by participants, not hardcoded. This PR adds that governance layer (the voting that picks the verifier contract account).

What changed

• Verifier-account voting was added (new tee::verifier_votes, built on the existing Votes primitive):

  • vote_tee_verifier_change(candidate, expected_code_hash)
    

    mpc/crates/contract/src/lib.rs

    Lines 1688 to 1736 in 46d04a0

    	/// Vote for a candidate account to become the trusted verifier contract
    	/// account, committing to the code hash the voter audited. When the proposal
    	/// crosses the signing threshold, the trusted verifier account is updated
    	/// and all pending verifier-change votes are cleared.
    	#[handle_result]
    	pub fn vote_tee_verifier_change(
    	&mut self,
    	candidate_account_id: AccountId,
    	expected_code_hash: TeeVerifierCodeHash,
    	) -> Result<(), Error> {
    	log!(
    	"vote_tee_verifier_change: signer={}, candidate={}, expected_code_hash={}",
    	env::signer_account_id(),
    	candidate_account_id,
    	expected_code_hash,
    	);
    	self.voter_or_panic();
    	// Reject the placeholder up front so a quorum can never roll the verifier
    	// back to the unconfigured state.
    	if candidate_account_id == initial_tee_verifier_account_id(None) {
    	return Err(TeeError::VerifierCandidateIsPlaceholder.into());
    	}
    	// Voting in the already-current verifier is a no-op; return without
    	// recording a vote so it can't clear an in-flight rotation proposal.
    	if candidate_account_id == self.tee_verifier_account_id {
    	return Ok(());
    	}
    	let threshold_parameters = self
    	.protocol_state
    	.threshold_parameters()
    	.expect("voter_or_panic() above already errors on NotInitialized");
    	let participant = AuthenticatedParticipantId::new(threshold_parameters.participants())?;
    	let proposal = VerifierChangeProposal {
    	candidate_account_id,
    	expected_code_hash,
    	};
    	if let Some(new_verifier) =
    	self.tee_verifier_votes
    	.vote(proposal, participant, threshold_parameters)?
    	{
    	log!("vote_tee_verifier_change: new verifier = {}", new_verifier);
    	self.tee_verifier_account_id = new_verifier;
    	}
    	Ok(())
    	}

    expected_code_hash makes each voter commit to the code they audited — same account, different hash ⇒ different buckets, so neither reaches threshold alone. Crossing threshold updates tee_verifier_account_id and clears pending votes; stale votes are swept after resharing.

  • withdraw_tee_verifier_vote()
    

    mpc/crates/contract/src/lib.rs

    Lines 1738 to 1756 in 46d04a0

    	/// Withdraw the caller's current vote on any pending verifier-change
    	/// proposal. No-op if the caller has not voted.
    	#[handle_result]
    	pub fn withdraw_tee_verifier_vote(&mut self) -> Result<(), Error> {
    	log!(
    	"withdraw_tee_verifier_vote: signer={}",
    	env::signer_account_id(),
    	);
    	self.voter_or_panic();
    	let threshold_parameters = self
    	.protocol_state
    	.threshold_parameters()
    	.expect("voter_or_panic() above already errors on NotInitialized");
    	let participant = AuthenticatedParticipantId::new(threshold_parameters.participants())?;
    	self.tee_verifier_votes.withdraw(&participant);
    	Ok(())
    	}

  • MpcContract gains tee_verifier_account_id and tee_verifier_votes.
    

    mpc/crates/contract/src/lib.rs

    Lines 185 to 190 in 46d04a0

    	/// The verifier contract account the contract trusts for DCAP verification.
    	/// Starts at the [`UNSET_TEE_VERIFIER_ACCOUNT`] placeholder until
    	/// participants vote one in. Not yet used to dispatch verification (the
    	/// async flow lands in a follow-up); stored and voted on here.
    	tee_verifier_account_id: AccountId,
    	tee_verifier_votes: TeeVerifierVotes,

    Migration and fresh deploys start unconfigured (tee_verifier_account_id: None); a verifier is set only by vote_tee_verifier_change once participants vote one in. Since a vote only ever carries a real account, it can never reset the verifier back to unconfigured.

• Lower attestation expiry 7d → 1d (DEFAULT_EXPIRATION_DURATION_SECONDS) — bounds how long a wrongly-accepted attestation stays trusted after a verifier rotation, while staying well above the node's hourly resubmit cadence.

No behavior change yet

Verification still runs synchronously in-WASM via verify_locally. tee_verifier_account_id is stored and voted on, but not yet used for dispatch.

The async flow that consumes it, cross-contract verify_quote plus the post-DCAP callback, and actually removes DCAP from the WASM, is the next slice of #3540, which will be submitted after this PR.

[Copilot]

Pull request overview

Adds governance plumbing to let MPC participants choose a trusted tee-verifier contract account (with votes bucketed by (account_id, code_hash)), and reduces the default attestation expiry window from 7 days to 1 day to limit trust duration after verifier rotation.

Changes:

• Introduces tee::verifier_votes with VerifierChangeProposal + TeeVerifierVotes, and wires new vote/withdraw methods into MpcContract (incl. placeholder-candidate rejection + post-reshare vote retention).
• Adds tee_verifier_account_id initialization/migration support (init-time optional config + migration defaulting to an “unset” placeholder).
• Lowers DEFAULT_EXPIRATION_DURATION_SECONDS to 1 day and updates affected tests/snapshots (ABI + borsh schema).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/near-mpc-contract-interface/src/types/config.rs	Adds optional tee_verifier_account_id to InitConfig and updates serde round-trip tests.
crates/near-mpc-contract-interface/src/method_names.rs	Adds method-name constants for verifier voting/withdraw.
crates/mpc-attestation/src/attestation.rs	Lowers default attestation expiry from 7d to 1d with rationale comment.
crates/contract/tests/snapshots/abi__abi_has_not_changed.snap	Regenerates ABI snapshot to include new methods and init field.
crates/contract/tests/sandbox/contract_configuration.rs	Adjusts sandbox init config construction to include the new optional field.
crates/contract/src/v3_12_0_state.rs	Migration: initializes new verifier fields for pre-existing deployed state.
crates/contract/src/tee/verifier_votes.rs	New module implementing verifier-account vote tracking on top of Votes.
crates/contract/src/tee.rs	Exposes the new verifier_votes module.
crates/contract/src/storage_keys.rs	Adds new storage prefixes for verifier votes.
crates/contract/src/snapshots/mpc_contract__tests__mpc_contract_borsh_schema_has_not_changed.snap	Updates borsh schema snapshot for new MpcContract fields and types.
crates/contract/src/lib.rs	Adds verifier fields + init helper, public vote/withdraw methods, and post-reshare vote retention.
crates/contract/src/errors.rs	Adds TeeError::VerifierCandidateIsPlaceholder.
crates/attestation-cli/tests/test_verification.rs	Updates expected expiry calculation to use DEFAULT_EXPIRATION_DURATION_SECONDS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

[gilcu3]

Thank you!

Left some minor comments. A test that covers the new cleanup step after resharing might be missing, but to do that we need a way to observe these votes, which IIUC is now missing as well, and could be a good addition

[netrome]

Shallow review, looks good to me - thanks!