TEE: Add Expiration and Renewal Mechanism for Node Attestations

Background

Currently, when a node submits an attestation to the contract, that attestation remains valid indefinitely (unless the MPC Docker image hash changes).
In addition, we do not perform node-to-node attestation — instead, we rely solely on the attestation recorded on the contract side.

Proposed security enhancement:
Introduce a validity period for attestations. Nodes would then be required to submit fresh attestations at regular intervals.

Possible approach:

Node side: Include a timestamp in the report_data field of the attestation.
Contract side: When validating the attestation, record this timestamp. The attestation remains valid only for X days, after which the node must submit a new one.

User Story

As a network operator,
I want node attestations to have a defined validity period,
so that outdated or potentially compromised attestations cannot remain trusted indefinitely, and nodes are required to periodically re-attest.

Acceptance Criteria

Decide whether we want to adopt this direction (introducing attestation validity periods).

If yes, define the architecture for implementing it (including node-side timestamping, contract-side validation, and refresh intervals).

Resources & Additional Notes

https://nearone.slack.com/archives/C07UW93JVQ8/p1757340032183499

Note: Not a priority for our soft-launch but would be nice to look into this before the hard launch.

Currently, when a node submits an attestation to the contract, that attestation remains valid indefinitely (unless the MPC Docker image hash changes).

To be more precise: in the current implementation, if someone challenges an already saved attestation whose collateral has expired (by calling verify_tee), the attestation verification will fail, but the participant still won’t be removed. Something to revisit.

mpc/libs/chain-signatures/contract/src/lib.rs

Lines 1105 to 1111 in 9967e16

    
               /// Verifies if all current participants have an accepted TEE state. 
        
               /// Automatically enters a resharing, in case one or more participants do not have an accepted 
        
               /// TEE state. 
        
               /// Returns `false` and stops the contract from accepting new signature requests or responses, 
        
               /// in case less than `threshold` participants run in an accepted Tee State. 
        
               #[handle_result] 
        
               pub fn verify_tee(&mut self) -> Result<bool, Error> {

To be more precise: in the current implementation, if someone challenges an already saved attestation whose collateral has expired (by calling verify_tee), the attestation verification will fail, but the participant still won’t be removed. Something to revisit.

I don't think this is entirely correct. Any participant with an invalid state is kicked out. This happens by:

The call to contract.tee_state.validate_tee returning a partial participant set.
The contract entering a resharing to the partial set here, as long as its larger than the threshold.

this was partially done in PR
perf(contract): contract should not store full attestation submission (#1663)

and there is a follow-up #1639 use expiration durations from the attestation certificate

Closing this in favor of #1639 as we already have a concept of expiry and #1639 seems to be an improvement on this.

Navigation Menu

Repository navigation

TEE: Add Expiration and Renewal Mechanism for Node Attestations #1056

Background

User Story

Acceptance Criteria

Resources & Additional Notes

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	/// Verifies if all current participants have an accepted TEE state.
	/// Automatically enters a resharing, in case one or more participants do not have an accepted
	/// TEE state.
	/// Returns `false` and stops the contract from accepting new signature requests or responses,
	/// in case less than `threshold` participants run in an accepted Tee State.
	#[handle_result]
	pub fn verify_tee(&mut self) -> Result<bool, Error> {

TEE: Add Expiration and Renewal Mechanism for Node Attestations #1056

Description

Background

User Story

Acceptance Criteria

Resources & Additional Notes

Activity

netrome commented on Sep 9, 2025

pbeza commented on Sep 9, 2025

netrome commented on Sep 9, 2025

barakeinav1 commented on Feb 11, 2026

netrome commented on Apr 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions