feat(contract): async TEE attestation verification, drop dcap-qvl

crates/contract/Cargo.toml

@@ -65,6 +65,7 @@ abi = [
     "near-mpc-contract-interface/abi",
     "mpc-attestation/abi",
     "mpc-primitives/abi",
+    "tee-verifier-interface/borsh-schema",
     "schemars",
 ]
 # This is used when running `cargo clippy --all-features`, because otherwise `abi` feat will break compilation.
@@ -74,6 +75,7 @@ __abi-generate = ["abi", "near-sdk/__abi-generate"]
 
 [dependencies]
 assert_matches = { workspace = true }
+attestation = { workspace = true }
 blstrs = { workspace = true }
 borsh = { workspace = true }
 curve25519-dalek = { workspace = true }
@@ -87,7 +89,7 @@ k256 = { workspace = true, features = [
     "arithmetic",
     "expose-field",
 ] }
-mpc-attestation = { workspace = true, features = ["local-verify"] }
+mpc-attestation = { workspace = true }
 mpc-primitives = { workspace = true }
 near-account-id = { workspace = true, features = ["serde"] }
 near-mpc-bounded-collections = { workspace = true }
@@ -102,6 +104,7 @@ rand = { workspace = true, optional = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 serde_with = { workspace = true }
+tee-verifier-interface = { workspace = true }
 thiserror = { workspace = true }
 threshold-signatures = { workspace = true, optional = true }
 

crates/contract/src/config.rs

@@ -21,6 +21,8 @@ const DEFAULT_RETURN_SIGNATURE_AND_CLEAN_STATE_ON_SUCCESS_CALL_TERA_GAS: u64 = 7
 const DEFAULT_RETURN_CK_AND_CLEAN_STATE_ON_SUCCESS_CALL_TERA_GAS: u64 = 7;
 /// Prepaid gas for a `fail_on_timeout` call
 const DEFAULT_FAIL_ON_TIMEOUT_TERA_GAS: u64 = 2;
+/// Prepaid gas for a `fail_attestation_submission` call
+const DEFAULT_FAIL_ATTESTATION_SUBMISSION_TERA_GAS: u64 = 2;
 /// Prepaid gas for a `clean_tee_status` call
 const DEFAULT_CLEAN_TEE_STATUS_TERA_GAS: u64 = 10;
 /// Prepaid gas for the reshare-time `clean_invalid_attestations` promise.
@@ -34,6 +36,15 @@ const DEFAULT_REMOVE_NON_PARTICIPANT_UPDATE_VOTES_TERA_GAS: u64 = 5;
 const DEFAULT_CLEAN_FOREIGN_CHAIN_DATA_TERA_GAS: u64 = 5;
 /// Prepaid gas for a `remove_non_participant_tee_verifier_votes` call
 const DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS: u64 = 5;
+/// Gas attached to the cross-contract `verify_quote` call on the TEE verifier.
+const DEFAULT_VERIFIER_TERA_GAS: u64 = 100;
+/// Prepaid gas for the `resolve_verification` callback. Carries the bulk of the
+/// post-DCAP work (allowlist match, RTMR3 replay, app-compose validation, store).
+const DEFAULT_RESOLVE_VERIFICATION_TERA_GAS: u64 = 60;
+/// Prepaid gas for the `on_attestation_verified` yield-callback. Sized for its
+/// heaviest (timeout) branch, which removes the pending entry and schedules both
+/// a refund transfer and the `fail_attestation_submission` promise.
+const DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS: u64 = 10;
 
 /// Config for V2 of the contract.
 #[near(serializers=[borsh, json])]
@@ -56,6 +67,8 @@ pub(crate) struct Config {
     pub(crate) return_ck_and_clean_state_on_success_call_tera_gas: u64,
     /// Prepaid gas for a `fail_on_timeout` call.
     pub(crate) fail_on_timeout_tera_gas: u64,
+    /// Prepaid gas for a `fail_attestation_submission` call.
+    pub(crate) fail_attestation_submission_tera_gas: u64,
     /// Prepaid gas for a `clean_tee_status` call.
     pub(crate) clean_tee_status_tera_gas: u64,
     /// Prepaid gas for the reshare-time `clean_invalid_attestations` promise.
@@ -68,6 +81,12 @@ pub(crate) struct Config {
     pub(crate) clean_foreign_chain_data_tera_gas: u64,
     /// Prepaid gas for a `remove_non_participant_tee_verifier_votes` call.
     pub(crate) remove_non_participant_tee_verifier_votes_tera_gas: u64,
+    /// Gas attached to the cross-contract `verify_quote` call on the verifier.
+    pub(crate) verifier_tera_gas: u64,
+    /// Prepaid gas for the `resolve_verification` callback.
+    pub(crate) resolve_verification_tera_gas: u64,
+    /// Prepaid gas for the `on_attestation_verified` yield-callback.
+    pub(crate) on_attestation_verified_tera_gas: u64,
 }
 
 impl Default for Config {
@@ -85,6 +104,7 @@ impl Default for Config {
             return_ck_and_clean_state_on_success_call_tera_gas:
                 DEFAULT_RETURN_CK_AND_CLEAN_STATE_ON_SUCCESS_CALL_TERA_GAS,
             fail_on_timeout_tera_gas: DEFAULT_FAIL_ON_TIMEOUT_TERA_GAS,
+            fail_attestation_submission_tera_gas: DEFAULT_FAIL_ATTESTATION_SUBMISSION_TERA_GAS,
             clean_tee_status_tera_gas: DEFAULT_CLEAN_TEE_STATUS_TERA_GAS,
             clean_invalid_attestations_tera_gas: DEFAULT_CLEAN_INVALID_ATTESTATIONS_TERA_GAS,
             cleanup_orphaned_node_migrations_tera_gas:
@@ -94,6 +114,9 @@ impl Default for Config {
             clean_foreign_chain_data_tera_gas: DEFAULT_CLEAN_FOREIGN_CHAIN_DATA_TERA_GAS,
             remove_non_participant_tee_verifier_votes_tera_gas:
                 DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS,
+            verifier_tera_gas: DEFAULT_VERIFIER_TERA_GAS,
+            resolve_verification_tera_gas: DEFAULT_RESOLVE_VERIFICATION_TERA_GAS,
+            on_attestation_verified_tera_gas: DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS,
         }
     }
 }

crates/contract/src/dto_mapping.rs

@@ -472,6 +472,9 @@ impl From<near_mpc_contract_interface::types::InitConfig> for Config {
         if let Some(v) = config_ext.fail_on_timeout_tera_gas {
             config.fail_on_timeout_tera_gas = v;
         }
+        if let Some(v) = config_ext.fail_attestation_submission_tera_gas {
+            config.fail_attestation_submission_tera_gas = v;
+        }
         if let Some(v) = config_ext.clean_tee_status_tera_gas {
             config.clean_tee_status_tera_gas = v;
         }
@@ -490,6 +493,15 @@ impl From<near_mpc_contract_interface::types::InitConfig> for Config {
         if let Some(v) = config_ext.remove_non_participant_tee_verifier_votes_tera_gas {
             config.remove_non_participant_tee_verifier_votes_tera_gas = v;
         }
+        if let Some(v) = config_ext.verifier_tera_gas {
+            config.verifier_tera_gas = v;
+        }
+        if let Some(v) = config_ext.resolve_verification_tera_gas {
+            config.resolve_verification_tera_gas = v;
+        }
+        if let Some(v) = config_ext.on_attestation_verified_tera_gas {
+            config.on_attestation_verified_tera_gas = v;
+        }
 
         config
     }
@@ -510,6 +522,7 @@ impl From<&Config> for near_mpc_contract_interface::types::Config {
             return_ck_and_clean_state_on_success_call_tera_gas: value
                 .return_ck_and_clean_state_on_success_call_tera_gas,
             fail_on_timeout_tera_gas: value.fail_on_timeout_tera_gas,
+            fail_attestation_submission_tera_gas: value.fail_attestation_submission_tera_gas,
             clean_tee_status_tera_gas: value.clean_tee_status_tera_gas,
             clean_invalid_attestations_tera_gas: value.clean_invalid_attestations_tera_gas,
             cleanup_orphaned_node_migrations_tera_gas: value
@@ -519,6 +532,9 @@ impl From<&Config> for near_mpc_contract_interface::types::Config {
             clean_foreign_chain_data_tera_gas: value.clean_foreign_chain_data_tera_gas,
             remove_non_participant_tee_verifier_votes_tera_gas: value
                 .remove_non_participant_tee_verifier_votes_tera_gas,
+            verifier_tera_gas: value.verifier_tera_gas,
+            resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            on_attestation_verified_tera_gas: value.on_attestation_verified_tera_gas,
         }
     }
 }
@@ -538,6 +554,7 @@ impl From<near_mpc_contract_interface::types::Config> for Config {
             return_ck_and_clean_state_on_success_call_tera_gas: value
                 .return_ck_and_clean_state_on_success_call_tera_gas,
             fail_on_timeout_tera_gas: value.fail_on_timeout_tera_gas,
+            fail_attestation_submission_tera_gas: value.fail_attestation_submission_tera_gas,
             clean_tee_status_tera_gas: value.clean_tee_status_tera_gas,
             clean_invalid_attestations_tera_gas: value.clean_invalid_attestations_tera_gas,
             cleanup_orphaned_node_migrations_tera_gas: value
@@ -547,6 +564,9 @@ impl From<near_mpc_contract_interface::types::Config> for Config {
             clean_foreign_chain_data_tera_gas: value.clean_foreign_chain_data_tera_gas,
             remove_non_participant_tee_verifier_votes_tera_gas: value
                 .remove_non_participant_tee_verifier_votes_tera_gas,
+            verifier_tera_gas: value.verifier_tera_gas,
+            resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            on_attestation_verified_tera_gas: value.on_attestation_verified_tera_gas,
         }
     }
 }

crates/contract/src/errors.rs

@@ -1,6 +1,7 @@
 use crate::crypto_shared::kdf::TweakNotOnCurve;
 use crate::primitives::domain::MIN_RECONSTRUCTION_THRESHOLD;
 use crate::primitives::key_state::{EpochId, Keyset};
+use crate::tee::tee_state::AttestationSubmissionError;
 use near_account_id::AccountId;
 use near_mpc_contract_interface::types as dtos;
 use near_mpc_contract_interface::types::{DomainId, DomainPurpose, ForeignChain, Protocol};
@@ -28,6 +29,14 @@ pub enum TeeError {
         "Due to previously failed TEE validation, the network is not accepting new requests at this point in time. Try again later."
     )]
     TeeValidationFailed,
+    #[error(
+        "A Dstack attestation verification is already in flight for this account; wait for it to finish before resubmitting."
+    )]
+    VerificationAlreadyPending,
+    #[error(
+        "No TEE verifier is configured yet. Participants must vote one in via vote_tee_verifier_change before Dstack attestations can be submitted."
+    )]
+    VerifierNotConfigured,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
@@ -318,6 +327,9 @@ pub enum Error {
     // Tee errors
     #[error(transparent)]
     NodeMigrationError(#[from] NodeMigrationError),
+    // Tee attestation submission errors
+    #[error(transparent)]
+    AttestationSubmission(#[from] AttestationSubmissionError),
 }
 
 impl near_sdk::FunctionError for Error {