feat(contract): operator-prepaid attestation storage (grant counter)

crates/contract/README.md

@@ -264,6 +264,8 @@ stateDiagram-v2
 | `verify_foreign_transaction(request: VerifyForeignTransactionRequestArgs)`                   | Submits a foreign-chain transaction verification request to the contract. Requires a deposit of 1 yoctonear and that the requested foreign chain is in the contract's supported set. Duplicate submissions of the same request (same caller, domain, chain, and payload) while an earlier one is still pending are queued and all receive the same response when the MPC nodes reply; the queue is bounded — concurrent duplicates beyond that bound are rejected with `PendingRequestQueueFull`. | deferred to promise        | `10 Tgas`       | `~7 Tgas`          |
 | `public_key(domain: Option<DomainId>)`                                                       | Read-only function; returns the public key used for the given domain (defaulting to first).              | `Result<PublicKey, Error>` |                 |                    |
 | `derived_public_key(path: String, predecessor: Option<AccountId>, domain: Option<DomainId>)` | Generates a derived public key for a given path and account, for the given domain (defaulting to first). | `Result<PublicKey, Error>` |                 |                    |
+| `prepay_attestation_storage(account_id: AccountId, grants: u32)` | Prepays attestation-entry storage for `account_id`. One grant permits one stored attestation. Payable and permissionless — anyone may prepay for any account, which is how an operator funds a node whose function-call access key cannot attach a deposit. Requires an attached deposit of exactly `attestation_storage_fee_millinear × grants` (see `config`) and rejects anything else. Nothing is refunded and there is no withdrawal. | `Result<(), Error>` | 30Tgas | ~4Tgas |
+| `available_attestation_grants(account_id: AccountId)` | Read-only function; returns the grants `account_id` has available — bought, minus those currently backing a stored attestation. `0` therefore means either "never prepaid" or "prepaid, and the grant is backing an entry"; cross-reference `get_tee_accounts` to distinguish them. | `u32` | | |
 
 #### SignRequestArgs (Latest version)
 
@@ -310,7 +312,7 @@ These functions require the caller to be a participant or candidate.
 | `vote_cancel_keygen(next_domain_id: u64)`                                           | For Initializing state only. Votes to cancel the key generation (identified by the next_domain_id) and revert to the Running state.                                                                                                     | `Result<(), Error>`       | TBD             | TBD                |
 | `propose_update(args: ProposeUpdateArgs)`                                           | Proposes an update to the contract, requiring an attached deposit.                                                                                                                                                                      | `Result<UpdateId, Error>` | TBD             | TBD                |
 | `vote_update(id: UpdateId)`                                                         | Votes on a proposed update. If the threshold is met, the update is executed.                                                                                                                                                            | `Result<bool, Error>`     | TBD             | TBD                |
-| `submit_participant_info(proposed_participant_attestation: Attestation, tls_public_key: Ed25519PublicKey)` | Submits the tee participant info for a potential candidate. c.f. TEE section | `Result<(), Error>` | TBD | TBD |
+| `submit_participant_info(proposed_participant_attestation: Attestation, tls_public_key: Ed25519PublicKey)` | Submits the tee participant info for a potential candidate. c.f. TEE section. Storing a new attestation entry consumes one attestation-storage grant, so the account must have one prepaid via `prepay_attestation_storage`; re-submitting for a TLS key the account already owns does not. | `Result<(), Error>` | TBD | TBD |
 
 ### Developer API
 

crates/contract/src/config.rs

@@ -23,6 +23,10 @@ const DEFAULT_RETURN_CK_AND_CLEAN_STATE_ON_SUCCESS_CALL_TERA_GAS: u64 = 7;
 const DEFAULT_FAIL_ON_TIMEOUT_TERA_GAS: u64 = 2;
 /// Prepaid gas for a `fail_attestation_submission` call
 const DEFAULT_FAIL_ATTESTATION_SUBMISSION_TERA_GAS: u64 = 2;
+/// Fee, in milliNEAR, for one attestation-storage grant. Covers the worst-case
+/// stored entry plus the grant-counter row it creates, with headroom for layout
+/// growth; see `docs/design/operator-prepaid-attestation-storage.md`.
+const DEFAULT_ATTESTATION_STORAGE_FEE_MILLINEAR: u64 = 20;
 /// Prepaid gas for a `clean_tee_status` call
 const DEFAULT_CLEAN_TEE_STATUS_TERA_GAS: u64 = 10;
 /// Prepaid gas for the reshare-time `clean_invalid_attestations` promise.
@@ -83,6 +87,8 @@ pub(crate) struct Config {
     pub(crate) verifier_tera_gas: u64,
     /// Prepaid gas for the `resolve_verification` callback.
     pub(crate) resolve_verification_tera_gas: u64,
+    /// Fee, in milliNEAR, charged for one attestation-storage grant.
+    pub(crate) attestation_storage_fee_millinear: u64,
     /// TTL after which a launcher image hash unused by any participant is evicted.
     /// Applied when an entry's expiry is next stamped (vote-in, re-vote, or a refresh on
     /// use), not retroactively — changing it does not re-date existing entries.
@@ -116,6 +122,7 @@ impl Default for Config {
                 DEFAULT_REMOVE_NON_PARTICIPANT_TEE_VERIFIER_VOTES_TERA_GAS,
             verifier_tera_gas: DEFAULT_VERIFIER_TERA_GAS,
             resolve_verification_tera_gas: DEFAULT_RESOLVE_VERIFICATION_TERA_GAS,
+            attestation_storage_fee_millinear: DEFAULT_ATTESTATION_STORAGE_FEE_MILLINEAR,
             launcher_hash_unused_ttl_seconds: DEFAULT_LAUNCHER_HASH_UNUSED_TTL_SECONDS,
         }
     }

crates/contract/src/dto_mapping.rs

@@ -505,6 +505,9 @@ impl TryFrom<near_mpc_contract_interface::types::InitConfig> for Config {
         if let Some(v) = config_ext.resolve_verification_tera_gas {
             config.resolve_verification_tera_gas = v;
         }
+        if let Some(v) = config_ext.attestation_storage_fee_millinear {
+            config.attestation_storage_fee_millinear = v;
+        }
         if let Some(v) = config_ext.launcher_hash_unused_ttl_seconds {
             config.launcher_hash_unused_ttl_seconds = v;
         }
@@ -545,6 +548,7 @@ impl From<&Config> for near_mpc_contract_interface::types::Config {
                 .remove_non_participant_tee_verifier_votes_tera_gas,
             verifier_tera_gas: value.verifier_tera_gas,
             resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            attestation_storage_fee_millinear: value.attestation_storage_fee_millinear,
             launcher_hash_unused_ttl_seconds: value.launcher_hash_unused_ttl_seconds,
         }
     }
@@ -579,6 +583,7 @@ impl TryFrom<near_mpc_contract_interface::types::Config> for Config {
                 .remove_non_participant_tee_verifier_votes_tera_gas,
             verifier_tera_gas: value.verifier_tera_gas,
             resolve_verification_tera_gas: value.resolve_verification_tera_gas,
+            attestation_storage_fee_millinear: value.attestation_storage_fee_millinear,
             launcher_hash_unused_ttl_seconds: value.launcher_hash_unused_ttl_seconds,
         };
 

crates/contract/src/errors.rs

@@ -127,6 +127,14 @@ pub enum InvalidParameters {
     MalformedPayload { reason: String },
     #[error("Attached deposit is lower than required. Attached: {attached}, required: {required}")]
     InsufficientDeposit { attached: u128, required: u128 },
+    #[error(
+        "attached deposit {attached} must be exactly the attestation storage fee times the requested grants, {required}"
+    )]
+    UnexpectedDeposit { attached: u128, required: u128 },
+    #[error(
+        "no attestation storage grant available for {account_id}; prepay one with prepay_attestation_storage"
+    )]
+    NoAttestationStorageGrant { account_id: String },
     #[error("Provided gas is lower than required. Provided: {provided}, required: {required}")]
     InsufficientGas { provided: u64, required: u64 },
     #[error("This sign request has timed out, was completed, or never existed.")]