|
| 1 | +//! Sandbox tests for the async `submit_participant_info` flow that offloads DCAP |
| 2 | +//! verification to a separate `tee-verifier` contract. |
| 3 | +//! |
| 4 | +//! These deploy the `test-tee-verifier` stub (which returns a test-chosen |
| 5 | +//! `verify_quote` answer instead of running real `dcap-qvl`) and point |
| 6 | +//! `mpc-contract` at it via `vote_tee_verifier_change`, then exercise each |
| 7 | +//! resolution branch of the yield-resume flow: |
| 8 | +//! |
| 9 | +//! - verifier not configured → submission rejected, nothing stored. |
| 10 | +//! - `Rejected` → submission fails, deposit refunded, no stored attestation. |
| 11 | +//! - no-verdict (stub panics) → the ~200-block yield timeout cleans up. |
| 12 | +#![allow(non_snake_case)] |
| 13 | + |
| 14 | +use crate::sandbox::{ |
| 15 | + common::SandboxTestSetup, |
| 16 | + utils::{ |
| 17 | + consts::ALL_PROTOCOLS, |
| 18 | + contract_build::stub_tee_verifier_contract, |
| 19 | + mpc_contract::{ |
| 20 | + get_participant_attestation, has_pending_attestation, submit_participant_info, |
| 21 | + submit_participant_info_with_deposit, vote_tee_verifier_change, |
| 22 | + }, |
| 23 | + }, |
| 24 | +}; |
| 25 | +use anyhow::Result; |
| 26 | +use borsh::BorshSerialize; |
| 27 | +use near_mpc_contract_interface::types::{self as dtos, Attestation}; |
| 28 | +use near_workspaces::{Account, Contract, Worker, network::Sandbox, types::NearToken}; |
| 29 | +use test_utils::attestation::{mock_dto_dstack_attestation, p2p_tls_key}; |
| 30 | + |
| 31 | +/// Blocks to fast-forward past the ~200-block yield-resume timeout so the |
| 32 | +/// runtime fires `on_attestation_verified`'s timeout branch. |
| 33 | +const YIELD_TIMEOUT_BLOCKS: u64 = 250; |
| 34 | + |
| 35 | +/// Mirror of `test_tee_verifier::StubResponse`. Re-declared here (rather than |
| 36 | +/// depending on the stub crate) so the test only needs its Borsh encoding to |
| 37 | +/// initialize the deployed stub; the stub is a separate `#[near]` contract and |
| 38 | +/// linking its crate into this test binary would collide on ABI symbols. |
| 39 | +#[expect(clippy::large_enum_variant)] |
| 40 | +#[derive(BorshSerialize)] |
| 41 | +enum StubResponse { |
| 42 | + #[expect(dead_code)] |
| 43 | + Verified(tee_verifier_interface::VerifiedReport), |
| 44 | + Rejected(String), |
| 45 | + Panic, |
| 46 | +} |
| 47 | + |
| 48 | +/// Deploys the stub verifier with the given response, initializes it, and votes |
| 49 | +/// it in as `mpc-contract`'s trusted verifier (all participants vote so the |
| 50 | +/// change crosses threshold). |
| 51 | +async fn deploy_and_trust_stub( |
| 52 | + worker: &Worker<Sandbox>, |
| 53 | + contract: &Contract, |
| 54 | + participants: &[Account], |
| 55 | + response: StubResponse, |
| 56 | +) -> Result<Contract> { |
| 57 | + let stub = worker.dev_deploy(stub_tee_verifier_contract()).await?; |
| 58 | + stub.call("new") |
| 59 | + .args_borsh(response) |
| 60 | + .transact() |
| 61 | + .await? |
| 62 | + .into_result()?; |
| 63 | + |
| 64 | + // The contract only consumes `candidate_account_id`; the hash is a voter |
| 65 | + // commitment, so any agreed value works for the test. |
| 66 | + let expected_code_hash = [7u8; 32]; |
| 67 | + for account in participants { |
| 68 | + vote_tee_verifier_change(account, contract, stub.id(), expected_code_hash).await?; |
| 69 | + } |
| 70 | + Ok(stub) |
| 71 | +} |
| 72 | + |
| 73 | +fn dstack_attestation() -> Attestation { |
| 74 | + mock_dto_dstack_attestation() |
| 75 | +} |
| 76 | + |
| 77 | +fn tls_key() -> dtos::Ed25519PublicKey { |
| 78 | + p2p_tls_key().into() |
| 79 | +} |
| 80 | + |
| 81 | +#[tokio::test] |
| 82 | +async fn submit_participant_info__should_reject_dstack_when_verifier_not_configured() -> Result<()> |
| 83 | +{ |
| 84 | + // Given: a running contract with no verifier voted in. |
| 85 | + let SandboxTestSetup { |
| 86 | + mpc_signer_accounts, |
| 87 | + contract, |
| 88 | + .. |
| 89 | + } = SandboxTestSetup::builder() |
| 90 | + .with_protocols(ALL_PROTOCOLS) |
| 91 | + .build() |
| 92 | + .await; |
| 93 | + |
| 94 | + // When: a participant submits a Dstack attestation. |
| 95 | + let result = submit_participant_info( |
| 96 | + &mpc_signer_accounts[0], |
| 97 | + &contract, |
| 98 | + &dstack_attestation(), |
| 99 | + &tls_key(), |
| 100 | + ) |
| 101 | + .await?; |
| 102 | + |
| 103 | + // Then: it is rejected (no verifier configured) and nothing is stored. |
| 104 | + assert!( |
| 105 | + result.is_failure(), |
| 106 | + "Dstack submit must fail when no verifier is configured: {result:#?}" |
| 107 | + ); |
| 108 | + let stored = get_participant_attestation(&contract, &tls_key()).await?; |
| 109 | + assert!(stored.is_none(), "no attestation should be stored"); |
| 110 | + Ok(()) |
| 111 | +} |
| 112 | + |
| 113 | +#[tokio::test] |
| 114 | +async fn submit_participant_info__should_refund_and_store_nothing_on_verifier_rejection() |
| 115 | +-> Result<()> { |
| 116 | + // Given: a contract whose trusted verifier always rejects. |
| 117 | + let SandboxTestSetup { |
| 118 | + worker, |
| 119 | + mpc_signer_accounts, |
| 120 | + contract, |
| 121 | + .. |
| 122 | + } = SandboxTestSetup::builder() |
| 123 | + .with_protocols(ALL_PROTOCOLS) |
| 124 | + .with_sandbox_test_methods() |
| 125 | + .build() |
| 126 | + .await; |
| 127 | + deploy_and_trust_stub( |
| 128 | + &worker, |
| 129 | + &contract, |
| 130 | + &mpc_signer_accounts, |
| 131 | + StubResponse::Rejected("test rejection".to_string()), |
| 132 | + ) |
| 133 | + .await?; |
| 134 | + |
| 135 | + // When: a participant submits a Dstack attestation with a 1 NEAR deposit. |
| 136 | + let submitter = &mpc_signer_accounts[0]; |
| 137 | + let balance_before = submitter.view_account().await?.balance; |
| 138 | + let _ = submit_participant_info_with_deposit( |
| 139 | + submitter, |
| 140 | + &contract, |
| 141 | + &dstack_attestation(), |
| 142 | + &tls_key(), |
| 143 | + NearToken::from_near(1), |
| 144 | + ) |
| 145 | + .await?; |
| 146 | + |
| 147 | + // Then: nothing is stored, the pending entry is cleaned up, and the deposit |
| 148 | + // is refunded. The rejection resolves in the verifier's response receipt (a |
| 149 | + // later receipt than the original call), so the outcome is observable in |
| 150 | + // state rather than on the original transaction's result. |
| 151 | + let stored = get_participant_attestation(&contract, &tls_key()).await?; |
| 152 | + assert!(stored.is_none(), "a rejected quote must not be stored"); |
| 153 | + assert!( |
| 154 | + !has_pending_attestation(&contract, submitter.id()).await?, |
| 155 | + "the pending entry must be cleaned up on rejection" |
| 156 | + ); |
| 157 | + assert_deposit_refunded(submitter, balance_before).await?; |
| 158 | + Ok(()) |
| 159 | +} |
| 160 | + |
| 161 | +#[tokio::test] |
| 162 | +async fn submit_participant_info__should_clean_up_on_verifier_crash() -> Result<()> { |
| 163 | + // Given: a contract whose trusted verifier panics (no verdict). |
| 164 | + let SandboxTestSetup { |
| 165 | + worker, |
| 166 | + mpc_signer_accounts, |
| 167 | + contract, |
| 168 | + .. |
| 169 | + } = SandboxTestSetup::builder() |
| 170 | + .with_protocols(ALL_PROTOCOLS) |
| 171 | + .with_sandbox_test_methods() |
| 172 | + .build() |
| 173 | + .await; |
| 174 | + deploy_and_trust_stub( |
| 175 | + &worker, |
| 176 | + &contract, |
| 177 | + &mpc_signer_accounts, |
| 178 | + StubResponse::Panic, |
| 179 | + ) |
| 180 | + .await?; |
| 181 | + |
| 182 | + // When: a participant submits, the verifier crashes (no resume lands), and |
| 183 | + // the chain advances past the ~200-block yield timeout so the runtime fires |
| 184 | + // `on_attestation_verified`'s timeout branch. |
| 185 | + let submitter = &mpc_signer_accounts[0]; |
| 186 | + let balance_before = submitter.view_account().await?.balance; |
| 187 | + // Unlike the rejection test, the outer-tx result isn't asserted here: the |
| 188 | + // failure only resolves when the yield times out, which `near-workspaces` |
| 189 | + // does not surface on the original `transact()`, so we assert state instead. |
| 190 | + let _ = submit_participant_info_with_deposit( |
| 191 | + submitter, |
| 192 | + &contract, |
| 193 | + &dstack_attestation(), |
| 194 | + &tls_key(), |
| 195 | + NearToken::from_near(1), |
| 196 | + ) |
| 197 | + .await?; |
| 198 | + worker.fast_forward(YIELD_TIMEOUT_BLOCKS).await?; |
| 199 | + |
| 200 | + // Then: nothing is stored, and the timeout cleanup actually committed: the |
| 201 | + // pending entry is gone and the deposit refunded. (Guards the regression |
| 202 | + // where the cleanup was rolled back by a panic in the same receipt, leaking |
| 203 | + // the entry and locking the account out of resubmitting.) |
| 204 | + let stored = get_participant_attestation(&contract, &tls_key()).await?; |
| 205 | + assert!( |
| 206 | + stored.is_none(), |
| 207 | + "nothing should be stored when the verifier crashes" |
| 208 | + ); |
| 209 | + assert!( |
| 210 | + !has_pending_attestation(&contract, submitter.id()).await?, |
| 211 | + "the pending entry must be cleaned up after the yield timeout" |
| 212 | + ); |
| 213 | + assert_deposit_refunded(submitter, balance_before).await?; |
| 214 | + Ok(()) |
| 215 | +} |
| 216 | + |
| 217 | +/// Asserts the 1 NEAR storage deposit was returned: the net spend since |
| 218 | +/// `balance_before` is well under 1 NEAR (only gas), rather than the full |
| 219 | +/// deposit being retained by the contract. |
| 220 | +async fn assert_deposit_refunded(account: &Account, balance_before: NearToken) -> Result<()> { |
| 221 | + let balance_after = account.view_account().await?.balance; |
| 222 | + let net_spent = balance_before.saturating_sub(balance_after); |
| 223 | + assert!( |
| 224 | + net_spent < NearToken::from_near(1), |
| 225 | + "deposit should be refunded (net spent {net_spent} should be < 1 NEAR, gas only)" |
| 226 | + ); |
| 227 | + Ok(()) |
| 228 | +} |
0 commit comments