fix(node): confirm submit_participant_info via advancing attestation expiry

The post-submit confirmation reconstructed the attestation's creation time as
`stored_expiry - DEFAULT_EXPIRATION_DURATION_SECONDS`. This breaks when the node
and contract compile different values for that constant (version skew), making
the reconstructed age far exceed the freshness bound so every submission is
treated as NotExecuted and retried indefinitely.

Confirm instead that the stored expiry advanced past the value observed before
submitting: a successful submit re-stamps expiry forward, a failed one leaves it
unchanged. This drops the shared-constant dependency and also holds under the
planned verifier-rotation expiry cap (#3734), where stored expiry is no longer
`creation + constant`.

Author: barakeinav1

crates/node/src/indexer/tx_sender.rs

@@ -9,20 +9,18 @@ use crate::types::{
 };
 use anyhow::Context;
 use ed25519_dalek::SigningKey;
-use mpc_attestation::attestation::DEFAULT_EXPIRATION_DURATION_SECONDS;
 use near_account_id::AccountId;
 use near_indexer_primitives::types::Gas;
 use near_mpc_contract_interface::types::{Attestation, Ed25519PublicKey, VerifiedAttestation};
 use near_time::Clock;
 use std::future::Future;
 use std::sync::Arc;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use std::time::Duration;
 use tokio::sync::{mpsc, oneshot};
 use tokio::time;
 
 const TRANSACTION_PROCESSOR_CHANNEL_SIZE: usize = 10000;
 const TRANSACTION_TIMEOUT: Duration = Duration::from_secs(10);
-const MAX_ATTESTATION_AGE: Duration = Duration::from_secs(60 * 2);
 
 pub trait TransactionSender: Clone + Send + Sync {
     fn send(
@@ -183,10 +181,61 @@ async fn submit_tx(
     })
 }
 
+/// Reads the attestation expiry currently stored for a `submit_participant_info` request, to
+/// use as the pre-submit baseline for the advanced-expiry confirmation in [`observe_tx_result`].
+/// Must be called before submitting. Returns `Ok(None)` for other request types or when no
+/// Dstack attestation is stored yet.
+async fn read_pre_submit_attestation_expiry(
+    indexer_state: &IndexerState,
+    request: &ChainSendTransactionRequest,
+) -> anyhow::Result<Option<u64>> {
+    let SubmitParticipantInfo(submit_participant_info_args) = request else {
+        return Ok(None);
+    };
+
+    let stored_attestation = indexer_state
+        .view_client
+        .get_participant_attestation(
+            &indexer_state.mpc_contract_id,
+            &submit_participant_info_args.tls_public_key,
+        )
+        .await?;
+
+    Ok(match stored_attestation {
+        Some(VerifiedAttestation::Dstack(attestation)) => {
+            Some(attestation.expiry_timestamp_seconds)
+        }
+        _ => None,
+    })
+}
+
+/// Confirms a `submit_participant_info` landed by checking that the stored attestation expiry
+/// advanced past `pre_submit_expiry` (the expiry seen before submitting). A successful submit
+/// re-stamps expiry to `now + DEFAULT_EXPIRATION_DURATION_SECONDS`, strictly greater than any
+/// previously-stored value; a failed submit leaves the existing entry unchanged. Expiry only
+/// ever advances via our own submit for this key, so this never yields a false positive.
+///
+/// A `None` baseline means nothing was stored before, so a stored attestation now means it landed.
+///
+/// We deliberately avoid reconstructing the creation time as `expiry - constant`: that breaks
+/// under node/contract version skew, and the verifier-rotation expiry cap makes stored expiry no
+/// longer equal `creation + constant`.
+// TODO(#1637): confirm via a creation timestamp read from the certificate itself.
+fn attestation_expiry_advanced(pre_submit_expiry: Option<u64>, stored_expiry: u64) -> bool {
+    match pre_submit_expiry {
+        Some(expiry_before_submit) => stored_expiry > expiry_before_submit,
+        None => true,
+    }
+}
+
 /// Confirms whether the intended effect of the transaction request has been observed on chain.
+///
+/// `pre_submit_expiry` is the attestation expiry read *before* submitting, used by the
+/// `submit_participant_info` confirmation (see [`read_pre_submit_attestation_expiry`]).
 async fn observe_tx_result(
     indexer_state: Arc<IndexerState>,
     request: &ChainSendTransactionRequest,
+    pre_submit_expiry: anyhow::Result<Option<u64>>,
 ) -> anyhow::Result<TransactionStatus> {
     match request {
         Respond(respond_args) => {
@@ -257,45 +306,11 @@ async fn observe_tx_result(
 
             let submitted_attestation_is_on_chain =
                 match (stored_attestation, submitted_attestation) {
-                    (
-                        VerifiedAttestation::Dstack(verified_dstack_attestation),
-                        Attestation::Dstack(_),
-                    ) => {
-                        // Check if the attestation stored on chain is fresh by verifying its age
-                        // is less than `MAX_ATTESTATION_AGE`
-                        //
-                        // TODO(#1637): extract expiration timestamp from the certificate itself,
-                        // instead of using heuristics.
-                        let expiry_timestamp_seconds =
-                            verified_dstack_attestation.expiry_timestamp_seconds;
-
-                        let Some(attestation_duration_since_unix_epoch) = expiry_timestamp_seconds
-                            .checked_sub(DEFAULT_EXPIRATION_DURATION_SECONDS)
-                            .map(Duration::from_secs)
-                        else {
-                            tracing::error!(
-                                ?expiry_timestamp_seconds,
-                                "could not calculate attestation storage time"
-                            );
-
-                            return Ok(TransactionStatus::NotExecuted);
-                        };
-
-                        let timestamp_seconds_now = SystemTime::now()
-                            .duration_since(UNIX_EPOCH)
-                            .context("could not calculate system time")?;
-
-                        let attestation_age =
-                            attestation_duration_since_unix_epoch.abs_diff(timestamp_seconds_now);
-                        let attestation_is_fresh = attestation_age < MAX_ATTESTATION_AGE;
-
-                        tracing::info!(
-                            ?attestation_age,
-                            ?attestation_is_fresh,
-                            "node found dstack attestation on chain"
-                        );
-
-                        attestation_is_fresh
+                    (VerifiedAttestation::Dstack(stored), Attestation::Dstack(_)) => {
+                        attestation_expiry_advanced(
+                            pre_submit_expiry?,
+                            stored.expiry_timestamp_seconds,
+                        )
                     }
                     (
                         VerifiedAttestation::Mock(stored_mock_attestation),
@@ -338,6 +353,11 @@ async fn ensure_send_transaction(
         public_key: Ed25519PublicKey::from(&tx_signer.public_key()),
         method,
     };
+    // Baseline for the submit_participant_info confirmation: the attestation expiry stored
+    // before we submit. Captured before submit_tx so a successful submit is detected as an
+    // advance in observe_tx_result.
+    let pre_submit_expiry = read_pre_submit_attestation_expiry(&indexer_state, &request).await;
+
     let submitted_metadata = submit_tx(
         tx_signer.clone(),
         indexer_state.clone(),
@@ -369,7 +389,8 @@ async fn ensure_send_transaction(
     time::sleep(TRANSACTION_TIMEOUT).await;
 
     // Then try to check whether it had the intended effect
-    let transaction_status = observe_tx_result(indexer_state.clone(), &request).await;
+    let transaction_status =
+        observe_tx_result(indexer_state.clone(), &request, pre_submit_expiry).await;
 
     let (outcome_label, recorded_status) = match &transaction_status {
         Ok(TransactionStatus::Executed) => ("succeeded", SubmittedTransactionStatus::Executed),
@@ -391,3 +412,62 @@ async fn ensure_send_transaction(
         SubmittedTransaction::submitted(signer, metadata, recorded_status, submitted_at),
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::attestation_expiry_advanced;
+
+    #[test]
+    #[expect(non_snake_case)]
+    fn attestation_expiry_advanced__should_confirm_when_expiry_advances() {
+        // Given: an attestation was stored before submitting
+        let pre_submit_expiry = Some(100);
+
+        // When: the stored expiry is now higher than before
+        let landed = attestation_expiry_advanced(pre_submit_expiry, 200);
+
+        // Then: our submission is confirmed to have landed
+        assert!(landed);
+    }
+
+    #[test]
+    #[expect(non_snake_case)]
+    fn attestation_expiry_advanced__should_reject_when_expiry_unchanged() {
+        // Given: an attestation was stored before submitting
+        let pre_submit_expiry = Some(200);
+
+        // When: the stored expiry is unchanged (our submit did not land)
+        let landed = attestation_expiry_advanced(pre_submit_expiry, 200);
+
+        // Then: the submission is treated as not executed
+        assert!(!landed);
+    }
+
+    #[test]
+    #[expect(non_snake_case)]
+    fn attestation_expiry_advanced__should_reject_when_expiry_regresses() {
+        // Given: an attestation was stored before submitting, and a verifier rotation has since
+        // capped the stored expiry to a lower value
+        let pre_submit_expiry = Some(300);
+
+        // When: the stored expiry is now lower than before
+        let landed = attestation_expiry_advanced(pre_submit_expiry, 200);
+
+        // Then: the submission is treated as not executed (a harmless false negative that
+        // self-heals on the next resubmission, never a false positive)
+        assert!(!landed);
+    }
+
+    #[test]
+    #[expect(non_snake_case)]
+    fn attestation_expiry_advanced__should_confirm_when_no_prior_attestation() {
+        // Given: no attestation was stored before submitting
+        let pre_submit_expiry = None;
+
+        // When: an attestation is now stored
+        let landed = attestation_expiry_advanced(pre_submit_expiry, 200);
+
+        // Then: its presence confirms our submission landed
+        assert!(landed);
+    }
+}