fix(contract): fund attestation storage from the contract balance

submit_participant_info takes no deposit; the contract's own balance stakes the
bounded attestation entry. A node self-submits with its function-call access key
for its first attestation and re-attestations alike, fixing onboarding: #3714
required a deposit, which a function-call key cannot attach.

This makes intentional what pre-#3714 did by accident. Pre-#3714 measured the
storage delta right after inserting into the IterableMap, before the deferred
write was flushed, so the delta read as 0 and the caller was never charged.
#3714 added the flush (kept here), which exposed the real cost and started
rejecting the node's zero-deposit submit. Storage is bounded and reclaimed by
clean_invalid_attestations, so the contract-funded cost is bounded and
self-healing.

Removes the charge path, the payable modifiers, deposit forwarding, and the
e2e funding workaround; updates tests and the ABI snapshot.

Author: pbeza

crates/contract/src/lib.rs

@@ -156,26 +156,6 @@ fn refund_to(account_id: &AccountId, amount: NearToken) {
     }
 }
 
-/// Charges `account_id` the storage growth since `initial_storage` and refunds the excess. A
-/// participant re-attesting an unchanged entry grows nothing and pays nothing, so the node's
-/// function-call access key can re-attest; a new entry costs the measured delta, funded by the
-/// caller (an operator's full-access key for a first submission).
-fn charge_storage(account_id: &AccountId, initial_storage: u64) -> Result<(), Error> {
-    // saturating_sub: a shrink charges nothing rather than underflowing.
-    let bytes_grown = env::storage_usage().saturating_sub(initial_storage);
-    let cost = env::storage_byte_cost().saturating_mul(u128::from(bytes_grown));
-    let attached = env::attached_deposit();
-    if attached < cost {
-        return Err(InvalidParameters::InsufficientDeposit {
-            attached: attached.as_yoctonear(),
-            required: cost.as_yoctonear(),
-        }
-        .into());
-    }
-    refund_to(account_id, attached.saturating_sub(cost));
-    Ok(())
-}
-
 impl Default for MpcContract {
     fn default() -> Self {
         env::panic_str("Calling default not allowed.");
@@ -798,13 +778,8 @@ impl MpcContract {
     ///   `verify_quote` call, with [`Self::resolve_verification`] chained as its
     ///   callback to run the post-DCAP checks and store the attestation.
     ///
-    /// Storage is charged to the caller only when a new entry is stored or the caller is not a
-    /// current participant. A participant re-attesting an existing entry grows nothing and is charged
-    /// nothing, so the node's function-call access key can re-attest with no deposit. A new entry
-    /// costs the measured storage delta, which the caller must cover (an operator's full-access key
-    /// funds a first submission); the excess is refunded, as is the full deposit on a rejected
-    /// attestation.
-    #[payable]
+    /// Storage is funded by the contract's own balance, so a node submits with no deposit via its
+    /// function-call access key, for its first attestation and re-attestations alike.
     #[handle_result]
     pub fn submit_participant_info(
         &mut self,
@@ -840,30 +815,19 @@ impl MpcContract {
             account_public_key,
         };
 
-        // Non-participants pay per entry so an outsider cannot drain the contract; participants
-        // re-attest for free.
-        let caller_is_not_participant = !self
-            .protocol_state
-            .is_existing_or_prospective_participant(&account_id)
-            .unwrap_or(false);
-
         match proposed_participant_attestation {
             Attestation::Mock(mock) => {
                 let tee_upgrade_deadline_duration =
                     Duration::from_secs(self.config.tee_upgrade_deadline_duration_seconds);
-                let initial_storage = env::storage_usage();
-                let insertion = self.tee_state.verify_and_store_mock(
+                self.tee_state.verify_and_store_mock(
                     node_id,
                     mock,
                     tee_upgrade_deadline_duration,
                 )?;
-                if insertion.is_new() || caller_is_not_participant {
-                    charge_storage(&account_id, initial_storage)?;
-                }
                 Ok(PromiseOrValue::Value(()))
             }
             Attestation::Dstack(attestation) => Ok(PromiseOrValue::Promise(
-                self.submit_dstack_attestation(node_id, attestation, caller_is_not_participant)?,
+                self.submit_dstack_attestation(node_id, attestation)?,
             )),
         }
     }
@@ -875,7 +839,6 @@ impl MpcContract {
         &mut self,
         node_id: NodeId,
         attestation: DstackAttestation,
-        caller_is_not_participant: bool,
     ) -> Result<Promise, Error> {
         let Some(verifier_account_id) = self.tee_verifier_account_id.clone() else {
             return Err(TeeError::VerifierNotConfigured.into());
@@ -892,11 +855,9 @@ impl MpcContract {
             .then(
                 Self::ext(env::current_account_id())
                     .with_static_gas(Gas::from_tgas(self.config.resolve_verification_tera_gas))
-                    .with_attached_deposit(env::attached_deposit())
                     .resolve_verification(VerificationContext {
                         node_id,
                         attestation,
-                        caller_is_not_participant,
                     }),
             ))
     }
@@ -2333,12 +2294,10 @@ impl MpcContract {
         }
     }
 
-    /// Verify-quote callback: on a verifier verdict it runs the post-DCAP
-    /// checks and stores the attestation, keeping the storage delta and
-    /// refunding the excess. Refunds the full deposit if the attestation is not
-    /// accepted.
+    /// Verify-quote callback: on a verifier verdict it runs the post-DCAP checks and stores the
+    /// attestation (storage funded by the contract's balance). On any failure it fails the
+    /// submitter's transaction.
     #[private]
-    #[payable]
     pub fn resolve_verification(
         &mut self,
         #[serializer(borsh)] context: VerificationContext,
@@ -2370,9 +2329,8 @@ impl MpcContract {
         match attestation_result {
             Ok(()) => PromiseOrValue::Value(()),
             Err(err) => {
-                refund_to(&account_id, env::attached_deposit());
-                // Fail the submitter's transaction from a separate receipt so
-                // the refund above commits (a panic here would roll it back)
+                // Fail the submitter's transaction from a separate receipt so any prior state
+                // commits (a panic here would roll it back)
                 let promise = Promise::new(env::current_account_id()).function_call(
                     method_names::FAIL_ATTESTATION_SUBMISSION.to_string(),
                     borsh::to_vec(&err.to_string())
@@ -2386,8 +2344,7 @@ impl MpcContract {
     }
 
     /// Runs the post-DCAP checks and stores the attestation for a
-    /// [`VerificationResult::Verified`] response, then charges the storage delta unless a
-    /// participant re-attested an existing entry.
+    /// [`VerificationResult::Verified`] response. Storage is funded by the contract's balance.
     fn verify_post_dcap_and_store(
         &mut self,
         context: &VerificationContext,
@@ -2397,22 +2354,14 @@ impl MpcContract {
         let tee_upgrade_deadline_duration =
             Duration::from_secs(self.config.tee_upgrade_deadline_duration_seconds);
 
-        let initial_storage = env::storage_usage();
-        let insertion = match self.tee_state.verify_and_store_dstack(
+        if let Err(err) = self.tee_state.verify_and_store_dstack(
             context.node_id.clone(),
             &context.attestation,
             report,
             tee_upgrade_deadline_duration,
         ) {
-            Ok(insertion) => insertion,
-            Err(err) => {
-                log!("post-DCAP check failed for {account_id}: {err}");
-                return Err(err.into());
-            }
-        };
-
-        if insertion.is_new() || context.caller_is_not_participant {
-            charge_storage(account_id, initial_storage)?;
+            log!("post-DCAP check failed for {account_id}: {err}");
+            return Err(err.into());
         }
         Ok(())
     }
@@ -4687,9 +4636,6 @@ mod tests {
             VerificationContext {
                 node_id,
                 attestation,
-                // Fixed, not parametrized: this flag only affects charging, which the mock VM
-                // can't observe, so true and false would store identical state here.
-                caller_is_not_participant: true,
             },
         )
     }

crates/contract/src/tee/tee_state.rs

@@ -53,12 +53,6 @@ pub(crate) enum ParticipantInsertion {
     UpdatedExistingParticipant,
 }
 
-impl ParticipantInsertion {
-    pub(crate) fn is_new(&self) -> bool {
-        matches!(self, Self::NewlyInsertedParticipant)
-    }
-}
-
 #[derive(Debug)]
 pub enum TeeValidationResult {
     /// All participants are valid

crates/contract/src/tee/verification_context.rs

@@ -11,5 +11,4 @@ use super::tee_state::NodeId;
 pub struct VerificationContext {
     pub(crate) node_id: NodeId,
     pub(crate) attestation: DstackAttestation,
-    pub(crate) caller_is_not_participant: bool,
 }

crates/contract/tests/inprocess/attestation_submission.rs

@@ -3,7 +3,7 @@
 use super::common;
 use mpc_contract::{
     MpcContract,
-    errors::{Error, InvalidParameters, InvalidState, TeeError},
+    errors::{Error, InvalidState, TeeError},
     primitives::{
         key_state::EpochId,
         participants::{ParticipantId, ParticipantInfo},
@@ -15,25 +15,21 @@ use mpc_contract::{
     },
     tee::tee_state::{AttestationSubmissionError, NodeId},
 };
-use near_mpc_contract_interface::{
-    deposits::SUBMIT_PARTICIPANT_INFO_DEPOSIT_MILLINEAR,
-    types::{Attestation, InitConfig, MockAttestation, ProtocolContractState},
+use near_mpc_contract_interface::types::{
+    Attestation, InitConfig, MockAttestation, ProtocolContractState,
 };
 use std::collections::BTreeMap;
 
 use assert_matches::assert_matches;
 use near_account_id::AccountId;
-use near_sdk::{NearToken, test_utils::VMContextBuilder, testing_env};
+use near_sdk::{test_utils::VMContextBuilder, testing_env};
 use rstest::rstest;
 use std::time::Duration;
 use test_utils::attestation::mock_dto_dstack_attestation;
 
 const SECOND: Duration = Duration::from_secs(1);
 const NANOS_IN_SECOND: u64 = SECOND.as_nanos() as u64;
 
-const ATTESTATION_STORAGE_DEPOSIT: NearToken =
-    NearToken::from_millinear(SUBMIT_PARTICIPANT_INFO_DEPOSIT_MILLINEAR);
-
 const DEFAULT_PARTICIPANT_COUNT: usize = 3;
 const DEFAULT_THRESHOLD_SIZE: u64 = 2;
 const DEFAULT_CONTRACT_PROTOCOL_STATE: ContractProtocolState = ContractProtocolState::Running;
@@ -163,16 +159,7 @@ impl TestSetup {
         node_id: &NodeId,
         attestation: Attestation,
     ) -> Result<(), mpc_contract::errors::Error> {
-        // `submit_participant_info` requires the flat storage fee, unlike the
-        // deposit-free calls `common::participant_context` is built for.
-        testing_env!(
-            VMContextBuilder::new()
-                .signer_account_id(node_id.account_id.clone())
-                .predecessor_account_id(node_id.account_id.clone())
-                .block_timestamp(near_sdk::env::block_timestamp())
-                .attached_deposit(ATTESTATION_STORAGE_DEPOSIT)
-                .build()
-        );
+        testing_env!(common::participant_context(&node_id.account_id));
         self.contract
             .submit_participant_info(attestation, node_id.tls_public_key.clone())
             .map(|_| ())
@@ -278,21 +265,14 @@ fn submit_participant_info__should_reject_overwrite_from_other_account() {
     assert_eq!(stored_before, stored_after);
 }
 
-/// A non-participant storing a new entry must cover its storage cost, so an outsider cannot
-/// store an attestation without paying for it.
+/// A newcomer stores its first attestation with no deposit (contract-funded storage), so the
+/// node's function-call access key can self-onboard.
 #[test]
-fn submit_participant_info__should_reject_when_non_participant_deposit_is_below_storage_cost() {
+fn submit_participant_info__should_store_new_entry_with_zero_deposit() {
     // Given
     let mut setup = TestSetupBuilder::new().build();
     let newcomer = node_id_for(&"newcomer.near".parse().unwrap());
-    let attached_deposit = NearToken::from_yoctonear(1);
-    testing_env!(
-        VMContextBuilder::new()
-            .signer_account_id(newcomer.account_id.clone())
-            .predecessor_account_id(newcomer.account_id.clone())
-            .attached_deposit(attached_deposit)
-            .build()
-    );
+    testing_env!(common::participant_context(&newcomer.account_id));
 
     // When
     let result = setup
@@ -304,17 +284,20 @@ fn submit_participant_info__should_reject_when_non_participant_deposit_is_below_
         .map(|_| ());
 
     // Then
-    assert_matches!(
-        &result,
-        Err(Error::InvalidParameters(InvalidParameters::InsufficientDeposit { attached, required }))
-            if *attached == attached_deposit.as_yoctonear() && required > attached
+    assert_matches!(&result, Ok(()));
+    assert!(
+        setup
+            .contract
+            .get_attestation(newcomer.tls_public_key)
+            .unwrap()
+            .is_some()
     );
 }
 
-/// A current participant re-attesting an existing entry is charged nothing and need not attach
-/// any deposit, so the node's function-call access key can re-attest.
+/// A current participant re-attesting an existing entry succeeds with no attached deposit, so the
+/// node's function-call access key can re-attest.
 #[test]
-fn submit_participant_info__should_charge_nothing_when_participant_reattests_with_zero_deposit() {
+fn submit_participant_info__should_reattest_with_zero_deposit() {
     // Given
     let mut setup = TestSetupBuilder::new().build();
     let node = setup.get_participant_node_ids()[0].clone();