canton: migrate NTT Receive replay protection to ConsumedVAA guards

Receive now verifies and claims the VAA atomically via the core bridge's
VerifyAndConsumeVAA instead of ParseAndVerifyVAA plus a manager-local
consumed set. The guard is scoped to the deployment's admin party, so each
deployment claims a VAA at most once and distinct VAAs never contend.

With no manager state to update on the receive path, Receive becomes
nonconsuming: the manager contract is no longer archived/recreated per
inbound transfer, so concurrent receives of different VAAs do not race on
the manager. The ConsumedVAA fail-open lookup caveat is closed structurally
for NTT: operator, the controller and canonical submitter, co-signs every
guard the deployment creates, so the submitting view contains all prior
guards.

Verified live via TestCantonNttReceiveMatchIntegration: matching-recipient
Receive succeeds and a second relay of the same VAA is rejected.

Claude-Session: https://claude.ai/code/session_01QJMuDHkjKHxZ3KvoS9Ryyz

Author: bengtlofgren

canton/README.md

@@ -1071,7 +1071,8 @@ unlike requiring `admin` as an active co-controller would have been.
 
 ### Receive (`NttManager.Receive`, controller `operator` — guardian-relayed)
 
-Verifies the VAA via the core bridge's `ParseAndVerifyVAA`, resolving the
+Verifies the VAA **and claims it atomically** via the core bridge's
+`VerifyAndConsumeVAA`, resolving the
 `CoreState` **by key** against the manager's committed `guardianGovernance`
 anchor — there is deliberately no caller-supplied core-state reference to
 substitute. The key's maintainer is `guardianGovernance` itself, whose
@@ -1082,10 +1083,18 @@ compromised operator cannot recreate the manager under a forged anchor either.
 This is the Daml analog of EVM NTT calling `parseAndVerifyVM` on an immutable
 core address (and of Solana NTT's owner-checked posted-VAA account), and it
 reuses the single audited verification path rather than duplicating
-`verifyVAA` inline. `Receive` then enforces the configured peer
-(`(chainId → managerAddress, transceiverAddress)` from `SetPeer`), **replay-
-protects on the VAA hash** (integrator-owned — `CoreState.consumedGovernance`
-stays reserved for `"Core"`), decodes, binds the caller-supplied `recipient` to
+`verifyVAA` inline. **Replay protection is the per-VAA `ConsumedVAA` guard**
+(§4.6), scoped to the deployment's `admin` party — not a consumed-set in
+manager state (`CoreState.consumedGovernance` stays reserved for `"Core"`).
+Because no manager state changes per inbound transfer, `Receive` is
+`nonconsuming`: the manager contract is never archived/recreated on the
+receive path, so concurrent receives of distinct VAAs do not contend. The
+guard's fail-open lookup caveat (§4.6) is closed structurally here: `operator`
+— the controller and canonical submitter — co-signs every guard the deployment
+creates, so the submitting view provably contains all prior guards. `Receive`
+then enforces the configured peer
+(`(chainId → managerAddress, transceiverAddress)` from `SetPeer`), decodes,
+binds the caller-supplied `recipient` to
 the VAA's own `recipientAddress` (below), and drives `MintOrUnlock`. `pubKeys`
 are untrusted hints today (hint-free is a follow-up). Pinning is
 regression-tested by `testNttReceiveVerifiesAgainstPinnedGuardianSet`: a
@@ -1251,7 +1260,7 @@ and keyed by it (§4.1), so the operator can neither mutate the real `CoreState`
 nor fabricate one that a consumer would find by the governance anchor. Every
 inbound verification path really does resolve by that anchor: governance via
 `SubmitGovernanceVAA` on the keyed singleton, and NTT `Receive` via
-`ParseAndVerifyVAA` keyed on the manager's admin-co-signed `guardianGovernance`
+`VerifyAndConsumeVAA` keyed on the manager's admin-co-signed `guardianGovernance`
 field (§10, with no caller-supplied core-state reference). This closes
 the one gap that observation-only hosting does *not* cover — inbound state
 integrity — by moving it from "trust the single operator" to "trust the k-of-n

canton/ntt/daml/Wormhole/Ntt/Manager.daml

@@ -20,27 +20,27 @@
 --
 -- Send rides the core bridge: 'Transfer' publishes via 'Emitter.PublishMessage',
 -- so the guardian watcher observes it as an ordinary core message (no NTT-specific
--- watcher code). Receive is guardian-relayed: 'Receive' verifies the VAA via the
--- core bridge's 'ParseAndVerifyVAA', resolving the 'CoreState' BY KEY against the
--- deployment's committed @guardianGovernance@ anchor (admin-co-signed at approval,
--- so a compromised operator cannot substitute a forged guardian set — the Daml
--- analog of EVM NTT calling @parseAndVerifyVM@ on an immutable core address). It
--- then enforces the configured peer, replay-protects on the VAA hash, decodes,
--- binds the caller-supplied @recipient@ to the VAA's own @recipientAddress@ via
--- 'recipientAddressFor', and drives the token mint/unlock.
+-- watcher code). Receive is guardian-relayed: 'Receive' verifies the VAA and
+-- claims it atomically via the core bridge's 'VerifyAndConsumeVAA' (per-VAA
+-- 'ConsumedVAA' replay guards scoped to the deployment's @admin@), resolving the
+-- 'CoreState' BY KEY against the deployment's committed @guardianGovernance@
+-- anchor (admin-co-signed at approval, so a compromised operator cannot
+-- substitute a forged guardian set — the Daml analog of EVM NTT calling
+-- @parseAndVerifyVM@ on an immutable core address). It then enforces the
+-- configured peer, decodes, binds the caller-supplied @recipient@ to the VAA's
+-- own @recipientAddress@ via 'recipientAddressFor', and drives the token
+-- mint/unlock.
 module Wormhole.Ntt.Manager where
 
 import DA.Crypto.Text (keccak256, toHex)
 import DA.Map (Map)
 import DA.Map qualified as Map
 import DA.Optional (fromSomeNote)
-import DA.Set (Set)
-import DA.Set qualified as Set
 
 import Splice.Api.Token.HoldingV1 (Holding)
 import Splice.Api.Token.MetadataV1 (ExtraArgs)
 import Wormhole.Core.Bytes
-import Wormhole.Core.State (Emitter, CoreState, ParseAndVerifyVAA (..), PublishMessage (..))
+import Wormhole.Core.State (Emitter, CoreState, VerifyAndConsumeVAA (..), PublishMessage (..))
 import Wormhole.Core.VAA ()   -- HasField instances for VAA record-dot access
 import Wormhole.Ntt.Payload
 import Wormhole.Ntt.Token
@@ -154,7 +154,6 @@ template NttDeploymentRequest
           tokenDecimals
           peers = Map.empty
           outboundSequence = 0
-          consumed = Set.empty
 
 template NttManager
   with
@@ -170,7 +169,8 @@ template NttManager
     tokenDecimals        : Int
     peers                : Map Int Peer     -- recipient/ source chainId -> peer
     outboundSequence     : Int              -- next NttManagerMessage id
-    consumed             : Set Bytes32      -- inbound VAA hashes already executed
+    -- (Inbound replay protection lives in per-VAA 'ConsumedVAA' guards keyed
+    -- by (admin, vaaHash), not in manager state — see 'Receive'.)
   where
     -- Admin co-signs (mirroring 'Emitter'): the manager address includes the
     -- admin, so a compromised operator cannot mint a manager carrying an existing
@@ -268,21 +268,34 @@ template NttManager
                consistencyLevel
         create this with outboundSequence = outboundSequence + 1
 
-    -- | Inbound transfer, guardian-relayed. Verifies the VAA via the core
-    -- bridge's 'ParseAndVerifyVAA', resolving the 'CoreState' BY KEY against
-    -- the manager's committed @guardianGovernance@ anchor — the key's
-    -- maintainer is @guardianGovernance@ itself, whose signature the operator
-    -- lacks, so only the authentic 'CoreState' can ever satisfy the lookup
-    -- (there is deliberately no caller-supplied core-state reference to
-    -- substitute). The anchor was attested by @admin@ at deployment and is
-    -- covered by the admin co-signature, so a compromised operator cannot
-    -- recreate the manager under a forged anchor either. This mirrors EVM NTT
-    -- (@parseAndVerifyVM@ on an immutable core address) and Solana NTT (the
-    -- owner-checked posted-VAA account). It then enforces the configured
-    -- peer, replay-protects on the VAA hash, decodes, binds the
-    -- caller-supplied @recipient@ to the VAA's own @recipientAddress@ via
-    -- 'recipientAddressFor', and mints/unlocks to it. @pubKeys@ are untrusted
-    -- hints bound to guardian addresses inside 'verifyVAA'.
+    -- | Inbound transfer, guardian-relayed. Verifies the VAA and records its
+    -- consumption atomically via the core bridge's 'VerifyAndConsumeVAA',
+    -- resolving the 'CoreState' BY KEY against the manager's committed
+    -- @guardianGovernance@ anchor — the key's maintainer is
+    -- @guardianGovernance@ itself, whose signature the operator lacks, so only
+    -- the authentic 'CoreState' can ever satisfy the lookup (there is
+    -- deliberately no caller-supplied core-state reference to substitute). The
+    -- anchor was attested by @admin@ at deployment and is covered by the admin
+    -- co-signature, so a compromised operator cannot recreate the manager
+    -- under a forged anchor either. This mirrors EVM NTT (@parseAndVerifyVM@
+    -- on an immutable core address) and Solana NTT (the owner-checked
+    -- posted-VAA account). It then enforces the configured peer, decodes,
+    -- binds the caller-supplied @recipient@ to the VAA's own
+    -- @recipientAddress@ via 'recipientAddressFor', and mints/unlocks to it.
+    -- @pubKeys@ are untrusted hints bound to guardian addresses inside
+    -- 'verifyVAA'.
+    --
+    -- REPLAY PROTECTION is the per-VAA 'Wormhole.Core.Replay.ConsumedVAA'
+    -- guard (the Solana claim-account shape), scoped to @admin@ — the
+    -- deployment's integrator party — so each deployment claims a VAA at most
+    -- once and distinct VAAs never contend. That is also why this choice is
+    -- @nonconsuming@: with no consumed-set to update, the manager is not
+    -- archived/recreated per inbound transfer, so concurrent 'Receive's of
+    -- different VAAs do not race on the manager contract. The guard's
+    -- fail-open lookup caveat (see 'Wormhole.Core.Replay') is closed here
+    -- structurally: @operator@ — the controller and canonical submitter —
+    -- co-signs every guard this deployment creates, so the submission's read
+    -- view provably contains all prior guards.
     --
     -- @recipient@ is a choice argument, but the relayer (@operator@, the
     -- controller) cannot supply an arbitrary one: 'recipientAddressFor recipient'
@@ -304,7 +317,7 @@ template NttManager
     --
     -- NOTE (milestone gap, see README §10): hint-free verification via persisted
     -- guardian pubkeys is a tracked follow-up.
-    choice Receive : NativeTokenTransfer
+    nonconsuming choice Receive : NativeTokenTransfer
       with
         vaaBytes         : Bytes
         pubKeys          : [(Int, Bytes)]
@@ -313,15 +326,17 @@ template NttManager
         extraArgs        : ExtraArgs             -- CIP-56 registry choice context
       controller operator
       do
-        vaa <- exerciseByKey @CoreState guardianGovernance ParseAndVerifyVAA with
-                 verifier = operator
-                 encodedVAA = vaaBytes
-                 pubKeys
+        -- Verify + claim in one atomic step; a second relay of the same VAA
+        -- fails inside VerifyAndConsumeVAA on the existing guard. @admin@'s
+        -- controller authority is inherited from this contract's signatories.
+        (vaa, _guardCid) <- exerciseByKey @CoreState guardianGovernance VerifyAndConsumeVAA with
+                              encodedVAA = vaaBytes
+                              pubKeys
+                              consumer = admin
         let peer = fromSomeNote ("ntt: no peer for source chain " <> show vaa.emitterChain)
                      (Map.lookup vaa.emitterChain peers)
         assertMsg "ntt: VAA emitter is not the configured peer transceiver"
           (normalizeHex vaa.emitterAddress == peer.transceiverAddress)
-        assertMsg "ntt: message already consumed" (not (Set.member vaa.hash consumed))
         let wm = decodeWormholeTransceiverMessage vaa.payload
         assertMsg "ntt: wrong recipient manager" (wm.recipientManager == managerAddress)
         assertMsg "ntt: source manager is not the peer manager"
@@ -335,5 +350,4 @@ template NttManager
           amount = TrimmedAmount with decimals = ntt.decimals, amount = ntt.amount
           inputHoldingCids
           extraArgs
-        create this with consumed = Set.insert vaa.hash consumed
         pure ntt

canton/test/daml/Test/TestNtt.daml

@@ -276,7 +276,6 @@ testNttReceiveRecipientMismatchFails = do
       tokenDecimals = 8
       peers = Map.empty
       outboundSequence = 0
-      consumed = Set.empty
   mgrId <- submit admin do
     exerciseCmd mgrId SetPeer with
       chainId = 2
@@ -334,7 +333,6 @@ testNttReceiveVerifiesAgainstPinnedGuardianSet = do
       tokenDecimals = 8
       peers = Map.empty
       outboundSequence = 0
-      consumed = Set.empty
   mgrId <- submit admin do
     exerciseCmd mgrId SetPeer with
       chainId = 2
@@ -409,7 +407,6 @@ integrationNttReceiveMatchSetup = do
       tokenDecimals = 8
       peers = Map.empty
       outboundSequence = 0
-      consumed = Set.empty
   mgrId <- submit admin do
     exerciseCmd mgrId SetPeer with
       chainId = 2