fix(host-contracts): align confirm context previous committee quorum (#3051)

* fix(host-contracts): align confirm context previous-committee quorum

* feat(test-suite): adjust the KMS tx-sender down scenario

* chore(common): trigger CI

* chore(test-suite): simplify test comments

* Update host-contracts/contracts/ProtocolConfig.sol

Co-authored-by: Oba <obatirou@gmail.com>

---------

Co-authored-by: Isaac Herrera <isaac.herrera@zama.ai>
Co-authored-by: Oba <obatirou@gmail.com>

Author: 3 people

host-contracts/contracts/ProtocolConfig.sol

@@ -304,12 +304,18 @@ contract ProtocolConfig is IProtocolConfig, UUPSUpgradeableEmptyProxy, ACLOwnabl
         $.contextState[contextId] = ContextState.Pending;
         _createPendingEpoch(contextId);
 
-        // Cache the previous-context confirmation quorum needed by confirmKmsContextCreation.
-        // `n - t + 1` (n = previous committee size, t = previous MPC fault threshold) so no t-subset ratifies alone.
-        $.contextCreationPreviousTxSenderThreshold[contextId] =
-            $.kmsNodesForContext[previousContextId].length -
-            $.mpcThresholdForContext[previousContextId] +
-            1;
+        // Cache the number of previous-committee confirmations confirmKmsContextCreation requires.
+        // The previous committee has `n` nodes, of which at most `t` (its MPC threshold) are assumed
+        // faulty — crashed, offline, or malicious. The quorum must be:
+        //   - more than `t`, so faulty nodes can never approve a switch on their own;
+        //   - at most `n - t`, because if `t` nodes stay silent only `n - t` confirmations ever
+        //     arrive — anything higher lets a dead node block the switch forever.
+        // `n - t` satisfies `n - t >= t + 1` under the `n = 3t + 1` topology the KMS core
+        // requires; the contract itself does not enforce the topology.
+        // Floored at 1 so the degenerate `t = n` config cannot make the quorum zero.
+        uint256 previousQuorum = $.kmsNodesForContext[previousContextId].length -
+            $.mpcThresholdForContext[previousContextId];
+        $.contextCreationPreviousTxSenderThreshold[contextId] = previousQuorum > 0 ? previousQuorum : 1;
 
         // Store context anchor and emit NewKmsContext event.
         $.contextAnchors[contextId] = KmsContextAnchor({
@@ -371,7 +377,7 @@ contract ProtocolConfig is IProtocolConfig, UUPSUpgradeableEmptyProxy, ACLOwnabl
 
         emit KmsContextCreationConfirmation(kmsContextId, msg.sender, isPreviousTxSender, isNewTxSender);
 
-        // All new nodes + (n - t + 1) previous nodes confirm to tell Connectors the epoch transition may start.
+        // All new nodes + (n - t) previous nodes confirm to tell Connectors the epoch transition may start.
         if (_hasContextCreationQuorum(kmsContextId)) {
             $.contextState[kmsContextId] = ContextState.Created;
             // The context-switch created this context and its epoch as a paired (Pending, Pending). The DAO

host-contracts/rust_bindings/src/protocol_config.rs

@@ -270,7 +270,7 @@ export interface KmsContextSwitchStatus {
   newTxSendersOutstanding?: string[];
   previousTxSendersConfirmed?: string[];
   previousConfirmationCount?: number;
-  previousTxSenderThreshold?: number; // the (n - t + 1) old-side quorum target
+  previousTxSenderThreshold?: number; // the (n - t) old-side quorum target
   contextCreationQuorumReached?: boolean;
   stuckBelowPreviousThreshold?: boolean;
 
@@ -293,7 +293,7 @@ function outstanding(expected: string[], confirmed: Set<string>): string[] {
 // plus the current active-context view. ProtocolConfig exposes no getter for the intermediate
 // `Created` state or the live confirmation tally, and the new (pending) context's signer set is not
 // readable via `getKmsSignersForContext` until it is `Active` — so the new set is taken from the
-// `NewKmsContext` event, while the old-side `(n - t + 1)` target is read from views on the still-
+// `NewKmsContext` event, while the old-side `(n - t)` target is read from views on the still-
 // active previous context.
 export async function inspectKmsContextSwitch(
   hre: HardhatRuntimeEnvironment,
@@ -388,10 +388,10 @@ async function fillContextSwitch(
   const newTxSenders = newContextEvent.args.kmsNodeParams.map((node) => checksum(node.txSenderAddress));
   status.newTxSenders = newTxSenders;
 
-  // Old-side (n - t + 1) target: the previous context is still active, so its views are readable.
+  // Old-side (n - t) target (floored at 1): the previous context is still active, so its views are readable.
   const previousSigners: string[] = await pc.getKmsSignersForContext(previousContextId);
   const previousMpcThreshold: bigint = await pc.getMpcThresholdForContext(previousContextId);
-  status.previousTxSenderThreshold = previousSigners.length - Number(previousMpcThreshold) + 1;
+  status.previousTxSenderThreshold = Math.max(previousSigners.length - Number(previousMpcThreshold), 1);
 
   // Tally creation confirmations from events.
   const creationConfirmations = await pc.queryFilter(
@@ -511,10 +511,10 @@ function printStatus(status: KmsContextSwitchStatus): void {
     }
     console.log(
       'previous tx senders confirmed:',
-      `${status.previousConfirmationCount} (need >= ${status.previousTxSenderThreshold} = n - t + 1)`,
+      `${status.previousConfirmationCount} (need >= ${status.previousTxSenderThreshold} = n - t)`,
     );
     if (status.stuckBelowPreviousThreshold) {
-      console.log('  ⚠ stuck below the (n - t + 1) old-side confirmation target');
+      console.log('  ⚠ stuck below the (n - t) old-side confirmation target');
     }
     console.log('creation quorum reached:', status.contextCreationQuorumReached);
   }

host-contracts/tasks/kmsContext.ts

@@ -100,11 +100,10 @@ contract KMSVerifierTest is HostContractsDeployerTestUtils {
     }
 
     function _activatePendingSingleSignerContext(uint256 contextId, uint256 epochId, uint256 pk) internal {
-        // Previous committee has 3 nodes (tx-senders 0xA1/0xA2/0xA3); the single new node reuses 0xA1,
-        // so confirming all three previous tx-senders covers the new-signer side via 0xA1 too.
+        // Previous committee has 3 nodes with mpc=1, so the previous-side quorum is n - t = 2. The
+        // single new node reuses 0xA1, whose confirmation also covers the new-signer side.
         _confirmContextCreation(contextId, address(0xA1));
         _confirmContextCreation(contextId, address(0xA2));
-        _confirmContextCreation(contextId, address(0xA3));
         _confirmEpochActivation(contextId, epochId, pk, address(0xA1), 0, 0);
     }
 

host-contracts/test/kmsVerifier/kmsVerifier.t.sol

@@ -1119,8 +1119,11 @@ contract ProtocolConfigTest is HostContractsDeployerTestUtils {
         assertEq(protocolConfig.getKmsGenThresholdForContext(KMS_CONTEXT_COUNTER_BASE + 2), 1);
     }
 
+    /// @dev Previous-side quorum boundary, both sides: with n = 4 previous nodes and t = 2, the
+    ///      target is n - t = 2. All-new + n - t - 1 previous confirmations stay Pending, the
+    ///      (n - t)-th completes creation (NewKmsEpoch), and any later one hits the Created state.
     function test_confirmKmsContextCreationUsesNewSignersAndOldQuorum() public {
-        _setupDefaultWithMpcThreshold(3);
+        _setupDefaultWithMpcThreshold(2);
         KmsNodeParams[] memory nodes = _makeKmsNodeParams(2);
         nodes[0].txSenderAddress = address(0xC1);
         nodes[0].signerAddress = address(0xB2);
@@ -1150,6 +1153,11 @@ contract ProtocolConfigTest is HostContractsDeployerTestUtils {
         );
         vm.prank(kmsTxSender1);
         protocolConfig.confirmKmsContextCreation(newContextId);
+
+        // The context left Pending on the (n - t)-th previous confirmation; a further one is rejected.
+        vm.prank(kmsTxSender2);
+        vm.expectRevert(abi.encodeWithSelector(IProtocolConfig.KmsContextNotPending.selector, newContextId));
+        protocolConfig.confirmKmsContextCreation(newContextId);
     }
 
     function test_confirmKmsContextCreationRequiresAllNewSigners() public {

host-contracts/test/protocolConfig/protocolConfig.t.sol

@@ -239,7 +239,7 @@ describe('KMS context tasks', function () {
   // ---------------------------------------------------------------------------
 
   describe('context-switch status', function () {
-    // Old context: 3 nodes, mpc=2 -> previous-side creation target (n - t + 1) = 2.
+    // Old context: 3 nodes, mpc=2 -> previous-side creation target (n - t) = 1.
     // New context: 2 nodes, mpc=1. Old/new committees are disjoint so confirmations partition cleanly.
     let proxyAddress: string;
     let protocolConfig: ProtocolConfig;
@@ -329,7 +329,7 @@ describe('KMS context tasks', function () {
         publicDecryption: 1,
         userDecryption: 1,
         kmsGen: 1,
-        mpc: 2, // -> previousTxSenderThreshold = 3 - 2 + 1 = 2
+        mpc: 2, // -> previousTxSenderThreshold = 3 - 2 = 1
       });
       protocolConfig = (await ethers.getContractAt('ProtocolConfig', proxyAddress)) as unknown as ProtocolConfig;
     });
@@ -353,22 +353,22 @@ describe('KMS context tasks', function () {
       expect(result.contextCreationQuorumReached).to.equal(false);
     });
 
-    it('surfaces the (n - t + 1) old-side target and flags being stuck below it', async function () {
+    it('surfaces the (n - t) old-side target and flags being stuck below it', async function () {
       const contextId = await defineSwitch();
-      await confirmCreation(contextId, [...newTxSenders, oldTxSenders[0]]);
+      await confirmCreation(contextId, [...newTxSenders]);
 
       const result = await inspectKmsContextSwitch(hre, proxyAddress, 0);
       expect(result.contextState).to.equal('PENDING');
       expect(result.newTxSendersOutstanding).to.have.lengthOf(0);
-      expect(result.previousTxSenderThreshold).to.equal(2);
-      expect(result.previousConfirmationCount).to.equal(1);
+      expect(result.previousTxSenderThreshold).to.equal(1);
+      expect(result.previousConfirmationCount).to.equal(0);
       expect(result.stuckBelowPreviousThreshold).to.equal(true);
       expect(result.contextCreationQuorumReached).to.equal(false);
     });
 
     it('reports CREATED once the creation quorum is reached, with the epoch still PENDING', async function () {
       const contextId = await defineSwitch();
-      const epochId = await confirmCreation(contextId, [...newTxSenders, oldTxSenders[0], oldTxSenders[1]]);
+      const epochId = await confirmCreation(contextId, [...newTxSenders, oldTxSenders[0]]);
       expect(epochId, 'creation quorum should emit NewKmsEpoch').to.not.be.undefined;
 
       const result = await inspectKmsContextSwitch(hre, proxyAddress, 0);
@@ -382,7 +382,7 @@ describe('KMS context tasks', function () {
 
     it('reports fully live once the epoch is activated', async function () {
       const contextId = await defineSwitch();
-      const epochId = await confirmCreation(contextId, [...newTxSenders, oldTxSenders[0], oldTxSenders[1]]);
+      const epochId = await confirmCreation(contextId, [...newTxSenders, oldTxSenders[0]]);
       await confirmActivation(epochId!, newTxSenders);
 
       const result = await inspectKmsContextSwitch(hre, proxyAddress, 0);

host-contracts/test/tasks/kmsContext.ts

@@ -180,8 +180,8 @@ export async function buildControllableKmsCommittee(): Promise<ControllableKmsCo
   });
   return {
     nodes: [node(txSender0, signer0, 0), node(txSender1, signer1, 1)],
-    // mpc threshold 1 keeps the previous-signer creation quorum at the full set, satisfied by reusing
-    // the same committee for the rotated context.
+    // Reusing the same committee for the rotated context satisfies both creation-quorum sides
+    // (all new tx-senders + n - t previous) with the same two confirmations.
     thresholds: { publicDecryption: 1, userDecryption: 1, kmsGen: 1, mpc: 1 },
     signerSigners: [signer0, signer1],
     txSenderSigners: [txSender0, txSender1],

host-contracts/test/tasks/taskHelpers.ts

@@ -141,14 +141,9 @@ describe('OnchainPublicDecrypt', function () {
       },
     ];
     const resetThresholds = { publicDecryption: 1, userDecryption: 1, kmsGen: 1, mpc: 1 };
-    await activateNewKmsContext(
-      protocolConfig,
-      deployer,
-      resetNodes,
-      resetThresholds,
-      [accounts[2], accounts[3]],
-      [accounts[2]],
-    );
+    // accounts[2] alone completes the creation quorum: it is the only new tx-sender and its
+    // confirmation also covers the previous side's n - t = 1 target (3 nodes, mpc = 2).
+    await activateNewKmsContext(protocolConfig, deployer, resetNodes, resetThresholds, [accounts[2]], [accounts[2]]);
     expect(await protocolConfig.getPublicDecryptionThreshold()).to.equal(1);
     expect(await kmsVerifier.getKmsSigners()).to.deep.equal([signerAddresses[0]]);
   });

library-solidity/test/onchainPublicDecrypt/OnchainPublicDecrypt.ts

@@ -4,7 +4,8 @@
  * Drives the two ProtocolConfig KMS-context lifecycle flows end to end on a threshold-mode cluster and
  * proves the KMS reacts to the emitted events:
  *   1. NewKmsContext — broadcast `defineNewKmsContextAndEpoch` (same committee, so no new signing
- *      keys are needed), wait for the new context to become the on-chain active one, then decrypt.
+ *      keys are needed; on a spare-core cluster, a node swap with the dropped node's tx-sender
+ *      stopped first), wait for the new context to become the on-chain active one, then decrypt.
  *   2. NewKmsEpoch — broadcast `defineNewEpochForCurrentKmsContext` (same context, new epoch), wait
  *      for the new epoch to activate, then decrypt again.
  *
@@ -22,12 +23,13 @@
 import { PreflightError } from "../errors";
 import { castCall, resolveKmsGenerationTarget, waitForContainer } from "../flow/readiness";
 import { stepComposeTask } from "../flow/runtime-compose";
-import { reconstructionThreshold } from "../kms-party";
+import { kmsTxSenderName, reconstructionThreshold } from "../kms-party";
 import type { State } from "../types";
 import {
   type DecryptionRunner,
   partyContainers,
   setRunning,
+  waitForContainersStopped,
   waitForPartiesRunning,
   waitForPartiesStopped,
 } from "./kms-generation";
@@ -104,11 +106,13 @@ const committeeSwapPlan = (kms: State["scenario"]["kms"]) => {
 
 /**
  * NewKmsContext step. On a cluster with a spare core this is a genuine node swap: the new context
- * drops a committee node and promotes the spare, keeping n = committeeSize so the threshold stays
- * valid. The dropped node reshares as Set 1 (outgoing), the spare as Set 2 (incoming), the rest as
- * both. Without a spare it is a same-committee reshare. Activation already gates on the spare:
- * it requires ALL new-committee signers to confirm, so the context id only advances once the
- * spare has reshared and submitted confirmKmsContextCreation.
+ * drops a committee node and promotes the spare, keeping n = committeeSize. The dropped node's
+ * tx-sender is stopped before the broadcast, so the switch must complete on the n − t
+ * previous-side quorum without its confirmation — a node that cannot transact must not veto its
+ * own removal. The rest of the node stays up because the reshare still needs its core (the KMS
+ * core cannot yet reshare around an absent outgoing party); upgrade to a full party stop once it
+ * can. Without a spare it is a same-committee reshare. Activation gates on ALL new-committee
+ * signers, so the context id only advances once the spare has reshared and confirmed.
  */
 const switchKmsContext = async (
   state: State,
@@ -122,9 +126,19 @@ const switchKmsContext = async (
   const hostEnv: Record<string, string> = isSwap ? { HOST_SC_CONTEXT_ENV: "host-sc-swap.env" } : {};
   const gatewayEnv: Record<string, string> = isSwap ? { GATEWAY_SC_CONTEXT_ENV: "gateway-sc-swap.env" } : {};
 
+  if (isSwap) {
+    // Stopped before the broadcast and left down: the new committee does not include the node.
+    const droppedTxSenders = dropped.map((party) => kmsTxSenderName(party));
+    console.log(
+      `[kms-context-switch] stopping dropped node(s) ${dropped.join(",")} tx-sender before the switch — a node that cannot confirm must not block its own replacement…`,
+    );
+    await setRunning(droppedTxSenders, "stop");
+    await waitForContainersStopped(droppedTxSenders);
+  }
+
   console.log(
     isSwap
-      ? `[kms-context-switch] broadcasting defineNewKmsContextAndEpoch — node swap (drop ${dropped.join(",")}, add ${added.join(",")}, keep ${continuing.join(",")})…`
+      ? `[kms-context-switch] broadcasting defineNewKmsContextAndEpoch — node swap (drop ${dropped.join(",")} with tx-sender stopped, add ${added.join(",")}, keep ${continuing.join(",")})…`
       : "[kms-context-switch] broadcasting defineNewKmsContextAndEpoch (NewKmsContext, same committee)…",
   );
   await stepComposeTask("host-sc", state, ["host-sc-context-switch"], { noDeps: true, env: hostEnv });

test-suite/fhevm/src/commands/kms-context-switch.ts

@@ -9,7 +9,7 @@
  */
 import { PreflightError } from "../errors";
 import { castCall, dockerInspect, probeBootstrap, resolveKmsGenerationTarget, waitForContainer } from "../flow/readiness";
-import { kmsConnectorPrefix, kmsCoreName, reconstructionThreshold } from "../kms-party";
+import { kmsConnectorPrefix, kmsCoreName, kmsTxSenderName, reconstructionThreshold } from "../kms-party";
 import type { State } from "../types";
 import { withHexPrefix } from "../utils/fs";
 import { run } from "../utils/process";
@@ -20,7 +20,7 @@ export type DecryptionRunner = (label: string, opts?: { expectFailure?: boolean
 /** Every container that belongs to one KMS party (its core + its connector tier). */
 export const partyContainers = (party: number) => {
   const connector = kmsConnectorPrefix(party);
-  return [kmsCoreName(party), `${connector}-gw-listener`, `${connector}-kms-worker`, `${connector}-tx-sender`];
+  return [kmsCoreName(party), `${connector}-gw-listener`, `${connector}-kms-worker`, kmsTxSenderName(party)];
 };
 
 /**
@@ -59,14 +59,19 @@ const waitForContainerStopped = async (container: string) => {
   );
 };
 
-/** Confirms every stopped party is genuinely down before a quorum verdict is read. `setRunning`
+/** Confirms every listed container is genuinely down before a verdict is read. `setRunning`
  * tolerates stop failures for idempotency, so without this check a silently no-op'd stop would
- * probe with too many live parties and misdiagnose "2t+1 not enforced". */
+ * probe with too many live containers and misdiagnose the scenario. */
+export const waitForContainersStopped = async (containers: string[]) => {
+  for (const container of containers) {
+    await waitForContainerStopped(container);
+  }
+};
+
+/** Confirms every stopped party is genuinely down before a quorum verdict is read. */
 export const waitForPartiesStopped = async (parties: number[]) => {
   for (const party of parties) {
-    for (const container of partyContainers(party)) {
-      await waitForContainerStopped(container);
-    }
+    await waitForContainersStopped(partyContainers(party));
   }
 };