fix(contract): size max_scan and the sweep budget together

Scanning an entry costs gas whether or not it is removed, so
RESHARE_CLEAN_INVALID_ATTESTATIONS_MAX_SCAN and
clean_invalid_attestations_tera_gas have to be sized against each other.
They were not: max_scan 100 needs ~28 TGas to walk the list with zero
removals, against a 10 TGas budget. The promise is detached, so exceeding
it rolls back every removal silently, which a live sweep on
v1.signer-prod.testnet confirmed by burning 13.1 TGas.

Lower max_scan 100 -> 30 and raise the budget 10 -> 15 TGas. A 30-entry
scan costs ~9.9 TGas before any removal; 15 TGas covers ~7 removals on top,
measured with #4016's storage-grant return in place (which took the
per-removal cost from 0.362 to 0.588 TGas).

Reset that field during migration rather than carrying the deployed value
forward, so it applies on upgrade without a governance config vote.

Every scanned entry being removable stays unfunded (~22 TGas); the
permissionless entry point is the recovery path.

Closes #4035

Author: barakeinav1

crates/contract/src/bench.rs

@@ -6,6 +6,10 @@
 
 use crate::MpcContract;
 use crate::primitives::participants::ParticipantInfo;
+use crate::tee::tee_state::{NodeAttestation, NodeId};
+use mpc_attestation::attestation::{
+    MockAttestation, ValidatedDstackAttestation, VerifiedAttestation, default_measurements,
+};
 use near_account_id::AccountId;
 use near_mpc_contract_interface::types as dtos;
 use near_sdk::near;
@@ -123,4 +127,53 @@ impl MpcContract {
             .update_info(account_id, new_info)
             .is_ok()
     }
+
+    /// Benchmark: seeds `count` attestations keyed by a synthetic TLS key derived from
+    /// `offset + i`, so successive calls with disjoint offsets accumulate. Returns the
+    /// resulting map size.
+    ///
+    /// Bypasses `add_participant`, and so DCAP verification, which is what makes seeding a
+    /// backlog of arbitrary size affordable.
+    /// `expired` picks an entry [`crate::tee::tee_state::TeeState::clean_invalid_attestations`]
+    /// removes over one it keeps, isolating the per-entry scan cost from the removal cost.
+    pub fn bench_seed_attestations(&mut self, offset: u32, count: u32, expired: bool) -> u32 {
+        let end = offset
+            .checked_add(count)
+            .expect("bench seeding range must not overflow");
+        let measurements = default_measurements()[0];
+        let verified_attestation = if expired {
+            VerifiedAttestation::Dstack(ValidatedDstackAttestation {
+                mpc_image_hash: [7u8; 32].into(),
+                launcher_compose_hash: [8u8; 32].into(),
+                expiry_timestamp_seconds: 1,
+                measurements,
+            })
+        } else {
+            VerifiedAttestation::Mock(MockAttestation::WithConstraints {
+                mpc_docker_image_hash: None,
+                launcher_docker_compose_hash: None,
+                expiry_timestamp_seconds: Some(u64::MAX),
+                expected_measurements: None,
+            })
+        };
+
+        for i in offset..end {
+            let mut key_bytes = [0u8; 32];
+            key_bytes[..4].copy_from_slice(&i.to_le_bytes());
+            let tls_public_key: dtos::Ed25519PublicKey = key_bytes.into();
+            let account_id: AccountId = format!("bench-attested-{i}.near").parse().unwrap();
+            self.tee_state.stored_attestations.insert(
+                tls_public_key.clone(),
+                NodeAttestation {
+                    node_id: NodeId {
+                        account_id,
+                        tls_public_key: tls_public_key.clone(),
+                        account_public_key: tls_public_key,
+                    },
+                    verified_attestation: verified_attestation.clone(),
+                },
+            );
+        }
+        self.tee_state.stored_attestations.len()
+    }
 }

crates/contract/src/config.rs

@@ -25,8 +25,18 @@ const DEFAULT_FAIL_ON_TIMEOUT_TERA_GAS: u64 = 2;
 const DEFAULT_FAIL_ATTESTATION_SUBMISSION_TERA_GAS: u64 = 2;
 /// Prepaid gas for a `clean_tee_status` call
 const DEFAULT_CLEAN_TEE_STATUS_TERA_GAS: u64 = 10;
-/// Prepaid gas for the reshare-time `clean_invalid_attestations` promise.
-const DEFAULT_CLEAN_INVALID_ATTESTATIONS_TERA_GAS: u64 = 10;
+/// Prepaid gas for the reshare-time [`crate::MpcContract::clean_invalid_attestations`] promise.
+///
+/// Sized against [`crate::RESHARE_CLEAN_INVALID_ATTESTATIONS_MAX_SCAN`]. Measured on
+/// `v1.signer-prod.testnet`: ~3.5 TGas of fixed overhead and ~0.215 TGas per entry
+/// re-verified, so a full 30-entry scan costs ~9.9 TGas before a single removal. Each removal
+/// adds ~0.5 TGas on top, dominated by returning that entry's storage grant, leaving this
+/// budget room for ~10 of them.
+///
+/// It does **not** cover every scanned entry being removable (~18 TGas). The promise is
+/// detached, so exceeding it rolls back every removal with no partial progress; the
+/// permissionless entry point is the recovery path, clearing ~750 entries in one call.
+const DEFAULT_CLEAN_INVALID_ATTESTATIONS_TERA_GAS: u64 = 15;
 /// Prepaid gas for a `cleanup_orphaned_node_migrations` call
 /// TODO(#1164): benchmark
 const DEFAULT_CLEANUP_ORPHANED_NODE_MIGRATIONS_TERA_GAS: u64 = 4;

crates/contract/src/lib.rs

@@ -121,7 +121,11 @@ pub const MINIMUM_NODE_MANAGEMENT_DEPOSIT: NearToken =
 
 /// Entries to scan in the post-reshare `clean_invalid_attestations` sweep. External
 /// callers may pick a different value; this only governs the automatic invocation.
-const RESHARE_CLEAN_INVALID_ATTESTATIONS_MAX_SCAN: u32 = 100;
+///
+/// Kept in step with `clean_invalid_attestations_tera_gas`: scanning an entry costs gas
+/// whether or not it is removed, so this limit and that budget must be sized together
+/// (#4035). `clean_invalid_attestations__budget_covers_max_scan` pins the relation.
+const RESHARE_CLEAN_INVALID_ATTESTATIONS_MAX_SCAN: u32 = 30;
 
 /// Checks that the caller attached at least `minimum_deposit` and refunds any excess.
 ///

crates/contract/src/tee/tee_state.rs

@@ -274,9 +274,12 @@ impl TeeState {
     }
 
     /// Evicts expired entries from the allowed docker-image and launcher-image sets, then
-    /// reverifies stored participant attestations, removing any that fail reverification
-    /// (e.g. the MPC image hash the attestation was tied to is no longer allowed, or a
-    /// certificate expired).
+    /// reverifies stored participant attestations and returns the subset that still passes.
+    /// Reverification fails when, for example, the MPC image hash the attestation was tied
+    /// to is no longer allowed, or a certificate expired.
+    ///
+    /// Despite the name, `stored_attestations` is only read here, never pruned —
+    /// reclaiming entries is [`Self::clean_invalid_attestations`]'s job alone.
     pub fn reverify_and_cleanup_participants(
         &mut self,
         participants: &Participants,

crates/contract/src/v3_14_0_state.rs

@@ -58,6 +58,12 @@ impl From<OldConfig> for Config {
     fn from(old: OldConfig) -> Self {
         // Carry the deployed values; the attestation-storage fee is new in this release, so
         // it takes its default.
+        //
+        // `clean_invalid_attestations_tera_gas` is the deliberate exception: it is reset to
+        // the new default rather than carried over. The deployed 10 TGas cannot fund the scan
+        // `vote_reshared` requests, and the promise is detached, so every removal rolls back
+        // unnoticed (#4035). Carrying it forward would leave the fix unreachable without a
+        // governance config vote.
         Config {
             key_event_timeout_blocks: old.key_event_timeout_blocks,
             tee_upgrade_deadline_duration_seconds: old.tee_upgrade_deadline_duration_seconds,
@@ -73,7 +79,8 @@ impl From<OldConfig> for Config {
             fail_on_timeout_tera_gas: old.fail_on_timeout_tera_gas,
             fail_attestation_submission_tera_gas: old.fail_attestation_submission_tera_gas,
             clean_tee_status_tera_gas: old.clean_tee_status_tera_gas,
-            clean_invalid_attestations_tera_gas: old.clean_invalid_attestations_tera_gas,
+            clean_invalid_attestations_tera_gas: Config::default()
+                .clean_invalid_attestations_tera_gas,
             cleanup_orphaned_node_migrations_tera_gas: old
                 .cleanup_orphaned_node_migrations_tera_gas,
             remove_non_participant_update_votes_tera_gas: old
@@ -153,3 +160,131 @@ struct Metrics {
     sign_with_v1_payload_count: u64,
     sign_with_v2_payload_count: u64,
 }
+
+#[cfg(test)]
+#[expect(non_snake_case)]
+mod tests {
+    use super::*;
+
+    /// Every field distinguishable from [`Config::default()`], so a carried-forward value
+    /// cannot be mistaken for a defaulted one.
+    fn deployed_config() -> OldConfig {
+        OldConfig {
+            key_event_timeout_blocks: 1,
+            tee_upgrade_deadline_duration_seconds: 2,
+            contract_upgrade_deposit_tera_gas: 3,
+            sign_call_gas_attachment_requirement_tera_gas: 4,
+            ckd_call_gas_attachment_requirement_tera_gas: 5,
+            return_signature_and_clean_state_on_success_call_tera_gas: 6,
+            return_ck_and_clean_state_on_success_call_tera_gas: 7,
+            fail_on_timeout_tera_gas: 8,
+            fail_attestation_submission_tera_gas: 9,
+            clean_tee_status_tera_gas: 10,
+            clean_invalid_attestations_tera_gas: 11,
+            cleanup_orphaned_node_migrations_tera_gas: 12,
+            remove_non_participant_update_votes_tera_gas: 13,
+            clean_foreign_chain_data_tera_gas: 14,
+            remove_non_participant_tee_verifier_votes_tera_gas: 15,
+            verifier_tera_gas: 16,
+            resolve_verification_tera_gas: 17,
+            launcher_hash_unused_ttl_seconds: 18,
+        }
+    }
+
+    /// The deployed budget cannot fund the scan [`crate::MpcContract::vote_reshared`] requests,
+    /// and the promise is detached, so the sweep rolls back silently. Migration resets this one
+    /// field so the fix lands on upgrade rather than needing a governance vote (#4035).
+    #[test]
+    fn config_migration__should_reset_clean_invalid_attestations_gas_to_the_new_default() {
+        // given
+        let old = deployed_config();
+        assert_ne!(
+            old.clean_invalid_attestations_tera_gas,
+            Config::default().clean_invalid_attestations_tera_gas
+        );
+
+        // when
+        let migrated = Config::from(old);
+
+        // then
+        assert_eq!(
+            migrated.clean_invalid_attestations_tera_gas,
+            Config::default().clean_invalid_attestations_tera_gas
+        );
+    }
+
+    /// The reset must not leak into any other field an operator may have voted in.
+    #[test]
+    fn config_migration__should_carry_every_other_deployed_value_forward() {
+        // given / when
+        let old = deployed_config();
+        let migrated = Config::from(deployed_config());
+
+        // then
+        assert_eq!(
+            migrated.key_event_timeout_blocks,
+            old.key_event_timeout_blocks
+        );
+        assert_eq!(
+            migrated.tee_upgrade_deadline_duration_seconds,
+            old.tee_upgrade_deadline_duration_seconds
+        );
+        assert_eq!(
+            migrated.contract_upgrade_deposit_tera_gas,
+            old.contract_upgrade_deposit_tera_gas
+        );
+        assert_eq!(
+            migrated.sign_call_gas_attachment_requirement_tera_gas,
+            old.sign_call_gas_attachment_requirement_tera_gas
+        );
+        assert_eq!(
+            migrated.ckd_call_gas_attachment_requirement_tera_gas,
+            old.ckd_call_gas_attachment_requirement_tera_gas
+        );
+        assert_eq!(
+            migrated.return_signature_and_clean_state_on_success_call_tera_gas,
+            old.return_signature_and_clean_state_on_success_call_tera_gas
+        );
+        assert_eq!(
+            migrated.return_ck_and_clean_state_on_success_call_tera_gas,
+            old.return_ck_and_clean_state_on_success_call_tera_gas
+        );
+        assert_eq!(
+            migrated.fail_on_timeout_tera_gas,
+            old.fail_on_timeout_tera_gas
+        );
+        assert_eq!(
+            migrated.fail_attestation_submission_tera_gas,
+            old.fail_attestation_submission_tera_gas
+        );
+        assert_eq!(
+            migrated.clean_tee_status_tera_gas,
+            old.clean_tee_status_tera_gas
+        );
+        assert_eq!(
+            migrated.cleanup_orphaned_node_migrations_tera_gas,
+            old.cleanup_orphaned_node_migrations_tera_gas
+        );
+        assert_eq!(
+            migrated.remove_non_participant_update_votes_tera_gas,
+            old.remove_non_participant_update_votes_tera_gas
+        );
+        assert_eq!(
+            migrated.clean_foreign_chain_data_tera_gas,
+            old.clean_foreign_chain_data_tera_gas
+        );
+        assert_eq!(
+            migrated.remove_non_participant_tee_verifier_votes_tera_gas,
+            old.remove_non_participant_tee_verifier_votes_tera_gas
+        );
+        assert_eq!(migrated.verifier_tera_gas, old.verifier_tera_gas);
+        assert_eq!(
+            migrated.resolve_verification_tera_gas,
+            old.resolve_verification_tera_gas
+        );
+        assert_eq!(
+            migrated.launcher_hash_unused_ttl_seconds,
+            old.launcher_hash_unused_ttl_seconds
+        );
+    }
+}