fix(contract): validate config TTL on init, dedup dummy_config value

Address review feedback:
- init/init_running now validate the config (not just update_config), so the
  contract cannot be initialized with launcher_hash_unused_ttl_seconds below
  the attestation validity window; add a regression test.
- dummy_config: give clean_expired_launcher_hashes_tera_gas a unique offset
  (was duplicating remove_non_participant_tee_verifier_votes_tera_gas).

Author: barakeinav1

crates/contract/src/lib.rs

@@ -1998,6 +1998,13 @@ impl MpcContract {
         let initial_participants = parameters.participants();
         let tee_state = TeeState::with_mocked_participant_attestations(initial_participants);
 
+        let config: Config = init_config.map(Into::into).unwrap_or_default();
+        config
+            .validate()
+            .map_err(|reason| InvalidParameters::MalformedPayload {
+                reason: reason.to_string(),
+            })?;
+
         Ok(Self {
             protocol_state: ProtocolContractState::Running(RunningContractState::new(
                 DomainRegistry::default(),
@@ -2011,7 +2018,7 @@ impl MpcContract {
                 StorageKey::PendingVerifyForeignTxRequestsV2,
             ),
             proposed_updates: ProposedUpdates::default(),
-            config: init_config.map(Into::into).unwrap_or_default(),
+            config,
             tee_state,
             accept_requests: true,
             node_migrations: NodeMigrations::default(),
@@ -2077,8 +2084,15 @@ impl MpcContract {
         let initial_participants = parameters.participants();
         let tee_state = TeeState::with_mocked_participant_attestations(initial_participants);
 
+        let config: Config = init_config.map(Into::into).unwrap_or_default();
+        config
+            .validate()
+            .map_err(|reason| InvalidParameters::MalformedPayload {
+                reason: reason.to_string(),
+            })?;
+
         Ok(MpcContract {
-            config: init_config.map(Into::into).unwrap_or_default(),
+            config,
             protocol_state: ProtocolContractState::Running(RunningContractState::new(
                 domains,
                 keyset,
@@ -3939,6 +3953,33 @@ mod tests {
         (contract, participants, first_participant_id)
     }
 
+    #[test]
+    fn init_rejects_launcher_ttl_below_attestation_validity() {
+        let participants = gen_participants(3);
+        let signer = participants.participants()[0].0.clone();
+        testing_env!(
+            VMContextBuilder::new()
+                .signer_account_id(signer.clone())
+                .predecessor_account_id(signer)
+                .attached_deposit(NearToken::from_near(1))
+                .build()
+        );
+        let parameters = ThresholdParameters::new(participants, Threshold::new(2)).unwrap();
+        let bad_config = dtos::InitConfig {
+            launcher_hash_unused_ttl_seconds: Some(
+                mpc_attestation::attestation::DEFAULT_EXPIRATION_DURATION_SECONDS - 1,
+            ),
+            ..Default::default()
+        };
+
+        let err = MpcContract::init((&parameters).into_dto_type(), Some(bad_config))
+            .expect_err("init must reject a launcher TTL below the attestation validity window");
+        assert!(
+            format!("{err:?}").contains("launcher_hash_unused_ttl_seconds"),
+            "error should point at the invalid config field, got: {err:?}"
+        );
+    }
+
     #[test]
     #[expect(non_snake_case)]
     fn vote_tee_verifier_change__should_apply_candidate_when_threshold_reached() {

crates/test-utils/src/contract_types.rs

@@ -17,6 +17,6 @@ pub fn dummy_config(value: u64) -> near_mpc_contract_interface::types::Config {
         remove_non_participant_tee_verifier_votes_tera_gas: value + 13,
         // Must satisfy `Config::validate` (>= DEFAULT_EXPIRATION_DURATION_SECONDS = 7 days).
         launcher_hash_unused_ttl_seconds: value + (14 * 24 * 60 * 60),
-        clean_expired_launcher_hashes_tera_gas: value + 13,
+        clean_expired_launcher_hashes_tera_gas: value + 14,
     }
 }