fix(evm): propagate a broken endorser registration instead of only logging it

registerEndorser swallowed every failure past the second-network and
empty-allowlist checks (an unusable signing key, allowlist
resolution, authorizer or responder construction, view-registry
registration) as a log line. installEndorsement and Driver.New always
returned success regardless, so a node explicitly configured with
endorser.enabled came up looking healthy while never answering an
endorsement request - discoverable only once a quorum it was needed
for timed out, with nothing connecting the timeout back to the
startup log.

registerEndorser now returns an error that installEndorsement and New
propagate, the same contract a broken submitter key already gets in
newSubmitter. registeredFor is still only set once every step
succeeds, so this does not change the existing retry-on-later-call or
refuse-a-second-network behavior.

Signed-off-by: atharrva01 <atharvaborade568@gmail.com>

Author: atharrva01

x/token/services/network/evm/driver.go

@@ -312,7 +312,9 @@ func (d *Driver) installEndorsement(n *Network, config *Config, evmClient client
 	// Registration happens now, not on the first approval. An endorser node answers requests without
 	// ever making one, so registering lazily on the approval path would mean it never registers at
 	// all and every request to it times out.
-	d.registerEndorser(network+":"+channel, factory, config)
+	if err := d.registerEndorser(network+":"+channel, factory, config); err != nil {
+		return errors.Wrap(err, "evm: failed to register this node as an endorser")
+	}
 
 	return nil
 }
@@ -350,11 +352,19 @@ func (d *Driver) newSubmitter(config *Config, evmClient client.EVMClient) (*Subm
 // against the wrong chain, so it is refused loudly here instead of silently discarded: an operator who
 // configures two endorsing networks on one node needs to see why the second one never answers.
 //
+// Because a broken endorser configuration answers no requests and looks identical to network trouble
+// from the outside, discoverable only once a quorum times out, every failure past that check is
+// returned to the caller instead of only logged: a node explicitly configured with endorser.enabled
+// must not start up looking healthy while unable to fulfil that role, the same contract newSubmitter
+// already holds for a configured-but-broken submitter key. registeredFor is set only once every step
+// succeeds, so a failed attempt does not permanently lock the node out of registering on a later,
+// successful call for the same network.
+//
 // The TMS is resolved when a request arrives rather than now: resolving one here would ask the token
 // layer for a service that is still being built through this very driver.
-func (d *Driver) registerEndorser(networkKey string, factory *endorsement.ServiceFactory, config *Config) {
+func (d *Driver) registerEndorser(networkKey string, factory *endorsement.ServiceFactory, config *Config) error {
 	if d.viewRegistry == nil || !config.Endorser.Enabled {
-		return
+		return nil
 	}
 
 	d.registerMu.Lock()
@@ -367,40 +377,32 @@ func (d *Driver) registerEndorser(networkKey string, factory *endorsement.Servic
 				networkKey, d.registeredFor, networkKey)
 		}
 
-		return
+		return nil
 	}
 
 	signer, err := config.EndorserSigner()
 	if err != nil || signer == nil {
-		logger.Errorf("this node is configured as an endorser but its key is unusable: %v", err)
-
-		return
+		return errors.Wrap(err, "this node is configured as an endorser but its key is unusable")
 	}
 	allowed, err := config.AllowedRequesters(d.resolveIdentity)
 	if err != nil {
-		logger.Errorf("failed to resolve the endorsement allowlist: %v", err)
-
-		return
+		return errors.Wrap(err, "failed to resolve the endorsement allowlist")
 	}
 	authorizer, err := endorsement.NewAuthorizer(allowed)
 	if err != nil {
-		logger.Errorf("failed to build the endorsement allowlist: %v", err)
-
-		return
+		return errors.Wrap(err, "failed to build the endorsement allowlist")
 	}
 	responder, err := factory.NewResponder(authorizer, signer, d.resolveTMS)
 	if err != nil {
-		logger.Errorf("failed to build the endorsement responder: %v", err)
-
-		return
+		return errors.Wrap(err, "failed to build the endorsement responder")
 	}
 	if err := endorsement.RegisterEndorser(d.viewRegistry, responder); err != nil {
-		logger.Errorf("failed to register the endorsement responder: %v", err)
-
-		return
+		return errors.Wrap(err, "failed to register the endorsement responder")
 	}
 	d.registeredFor = networkKey
 	logger.Infof("registered as the endorser for [%s] with address %s", networkKey, signer.Address())
+
+	return nil
 }
 
 // resolveIdentity turns a configured node name into the identity that node speaks with.

x/token/services/network/evm/driver_test.go

@@ -245,3 +245,22 @@ func TestRegisterEndorserSkipsANonEndorsingNetwork(t *testing.T) {
 	assert.Equal(t, 1, registry.calls)
 	assert.Equal(t, "network-a:", d.registeredFor)
 }
+
+// TestRegisterEndorserReturnsAnErrorForABrokenKey is the regression test for the finding that a node
+// explicitly configured as an endorser, but whose signing key cannot be loaded, used to register
+// nothing and only log the failure: nothing told the caller registration never happened, so
+// installEndorsement and Driver.New both reported success regardless. A broken endorser answers no
+// requests, which looks identical to ordinary network trouble from the outside and was otherwise
+// discoverable only once a quorum it was needed for timed out.
+func TestRegisterEndorserReturnsAnErrorForABrokenKey(t *testing.T) {
+	registry := &fakeViewRegistry{}
+	d := &Driver{viewRegistry: registry, identities: fakeIdentityProvider{}}
+	config := endorserConfig(t)
+	config.Endorser.Keystore = "" // unusable: LoadKey rejects an empty path
+	factory := testServiceFactory(t, config)
+
+	err := d.registerEndorser("network-a:", factory, config)
+	require.Error(t, err)
+	assert.Zero(t, registry.calls, "a broken key must not reach the view registry")
+	assert.Empty(t, d.registeredFor, "a failed attempt must not mark the network as registered")
+}