feat(contract): async TEE attestation verification via verifier contract, drop dcap-qvl

Cargo.toml

@@ -34,6 +34,7 @@ members = [
     "crates/test-migration-contract",
     "crates/test-parallel-contract",
     "crates/test-port-allocator",
+    "crates/test-tee-verifier",
     "crates/test-utils",
     "crates/threshold-signatures",
     "crates/tls",

crates/contract/Cargo.toml

@@ -65,6 +65,7 @@ abi = [
     "near-mpc-contract-interface/abi",
     "mpc-attestation/abi",
     "mpc-primitives/abi",
+    "tee-verifier-interface/borsh-schema",
     "schemars",
 ]
 # This is used when running `cargo clippy --all-features`, because otherwise `abi` feat will break compilation.
@@ -74,6 +75,7 @@ __abi-generate = ["abi", "near-sdk/__abi-generate"]
 
 [dependencies]
 assert_matches = { workspace = true }
+attestation = { workspace = true }
 blstrs = { workspace = true }
 borsh = { workspace = true }
 curve25519-dalek = { workspace = true }
@@ -87,7 +89,7 @@ k256 = { workspace = true, features = [
     "arithmetic",
     "expose-field",
 ] }
-mpc-attestation = { workspace = true, features = ["local-verify"] }
+mpc-attestation = { workspace = true }
 mpc-primitives = { workspace = true }
 near-account-id = { workspace = true, features = ["serde"] }
 near-mpc-bounded-collections = { workspace = true }
@@ -102,6 +104,7 @@ rand = { workspace = true, optional = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 serde_with = { workspace = true }
+tee-verifier-interface = { workspace = true }
 thiserror = { workspace = true }
 threshold-signatures = { workspace = true, optional = true }
 

crates/contract/src/config.rs

@@ -34,6 +34,15 @@ const DEFAULT_REMOVE_NON_PARTICIPANT_UPDATE_VOTES_TERA_GAS: u64 = 5;
 const DEFAULT_CLEAN_FOREIGN_CHAIN_DATA_TERA_GAS: u64 = 5;
 /// Prepaid gas for a `remove_non_participant_tee_verifier_votes` call
 const DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS: u64 = 5;
+/// Gas attached to the cross-contract `verify_quote` call on the TEE verifier.
+const DEFAULT_VERIFIER_TERA_GAS: u64 = 100;
+/// Prepaid gas for the `resolve_verification` callback. Carries the bulk of the
+/// post-DCAP work (allowlist match, RTMR3 replay, app-compose validation, store).
+const DEFAULT_RESOLVE_VERIFICATION_TERA_GAS: u64 = 60;
+/// Prepaid gas for the `on_attestation_verified` yield-callback. Sized for its
+/// heaviest (timeout) branch, which removes the pending entry and schedules both
+/// a refund transfer and the `fail_attestation_submission` promise.
+const DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS: u64 = 10;
 
 /// Config for V2 of the contract.
 #[near(serializers=[borsh, json])]
@@ -68,6 +77,12 @@ pub(crate) struct Config {
     pub(crate) clean_foreign_chain_data_tera_gas: u64,
     /// Prepaid gas for a `remove_non_participant_tee_verifier_votes` call.
     pub(crate) remove_non_participant_tee_verifier_votes_tera_gas: u64,
+    /// Gas attached to the cross-contract `verify_quote` call on the verifier.
+    pub(crate) verifier_tera_gas: u64,
+    /// Prepaid gas for the `resolve_verification` callback.
+    pub(crate) resolve_verification_tera_gas: u64,
+    /// Prepaid gas for the `on_attestation_verified` yield-callback.
+    pub(crate) on_attestation_verified_tera_gas: u64,
 }
 
 impl Default for Config {
@@ -94,6 +109,9 @@ impl Default for Config {
             clean_foreign_chain_data_tera_gas: DEFAULT_CLEAN_FOREIGN_CHAIN_DATA_TERA_GAS,
             remove_non_participant_tee_verifier_votes_tera_gas:
                 DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS,
+            verifier_tera_gas: DEFAULT_VERIFIER_TERA_GAS,
+            resolve_verification_tera_gas: DEFAULT_RESOLVE_VERIFICATION_TERA_GAS,
+            on_attestation_verified_tera_gas: DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS,
         }
     }
 }

crates/contract/src/dto_mapping.rs

@@ -490,6 +490,15 @@ impl From<near_mpc_contract_interface::types::InitConfig> for Config {
         if let Some(v) = config_ext.remove_non_participant_tee_verifier_votes_tera_gas {
             config.remove_non_participant_tee_verifier_votes_tera_gas = v;
         }
+        if let Some(v) = config_ext.verifier_tera_gas {
+            config.verifier_tera_gas = v;
+        }
+        if let Some(v) = config_ext.resolve_verification_tera_gas {
+            config.resolve_verification_tera_gas = v;
+        }
+        if let Some(v) = config_ext.on_attestation_verified_tera_gas {
+            config.on_attestation_verified_tera_gas = v;
+        }
 
         config
     }
@@ -519,6 +528,9 @@ impl From<&Config> for near_mpc_contract_interface::types::Config {
             clean_foreign_chain_data_tera_gas: value.clean_foreign_chain_data_tera_gas,
             remove_non_participant_tee_verifier_votes_tera_gas: value
                 .remove_non_participant_tee_verifier_votes_tera_gas,
+            verifier_tera_gas: value.verifier_tera_gas,
+            resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            on_attestation_verified_tera_gas: value.on_attestation_verified_tera_gas,
         }
     }
 }
@@ -547,6 +559,9 @@ impl From<near_mpc_contract_interface::types::Config> for Config {
             clean_foreign_chain_data_tera_gas: value.clean_foreign_chain_data_tera_gas,
             remove_non_participant_tee_verifier_votes_tera_gas: value
                 .remove_non_participant_tee_verifier_votes_tera_gas,
+            verifier_tera_gas: value.verifier_tera_gas,
+            resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            on_attestation_verified_tera_gas: value.on_attestation_verified_tera_gas,
         }
     }
 }

crates/contract/src/errors.rs

@@ -28,6 +28,14 @@ pub enum TeeError {
         "Due to previously failed TEE validation, the network is not accepting new requests at this point in time. Try again later."
     )]
     TeeValidationFailed,
+    #[error(
+        "A Dstack attestation verification is already in flight for this account; wait for it to finish before resubmitting."
+    )]
+    VerificationAlreadyPending,
+    #[error(
+        "No TEE verifier is configured yet. Participants must vote one in via vote_tee_verifier_change before Dstack attestations can be submitted."
+    )]
+    VerifierNotConfigured,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]