deploy: Fix witnesses for Balance and Container contract deployments

To deploy these contracts in `@v0.19.1` revision:
 - both must be witnessed by the Alphabet (2/3n+1) to call Netmap
 - Container must be also witnessed by the committee majority (n/2+1) to
  call NNS

Signed-off-by: Leonard Lyubich <[email protected]>

CHANGELOG.md

@@ -6,6 +6,7 @@ Changelog for NeoFS Node
 ### Added
 
 ### Fixed
+- Auto-deployment of the Balance and Container contracts (#2695)
 
 ### Changed
 

pkg/morph/deploy/contracts.go

@@ -13,6 +13,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/notary"
+	"github.com/nspcc-dev/neo-go/pkg/smartcontract"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/manifest"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/nef"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -25,6 +26,12 @@ const (
 	methodUpdate = "update"
 )
 
+const (
+	_ uint8 = iota
+	witnessAlphabet
+	witnessAlphabetAndCommittee
+)
+
 // syncNeoFSContractPrm groups parameters of syncNeoFSContract.
 type syncNeoFSContractPrm struct {
 	logger *zap.Logger
@@ -56,10 +63,12 @@ type syncNeoFSContractPrm struct {
 	// if set, syncNeoFSContract attempts to deploy the contract when it's
 	// missing on the chain
 	tryDeploy bool
-	// is contract must be deployed by the committee
-	committeeDeployRequired bool
-	// additional allowed contracts to be added to the NNS one if committeeDeployRequired
-	extraCommitteeDeployAllowedContracts []util.Uint160
+	// 0: committee witness is not needed
+	// witnessAlphabet: committee 2/3n+1 with allowed alphabetDeployAllowedContracts
+	// witnessAlphabetAndCommittee: witnessAlphabet + committee n/2+1 with allowed NNS contract calls
+	deployWitness uint8
+	// contracts that are allowed to be called for the Alphabet-witnessed deployment
+	alphabetDeployAllowedContracts []util.Uint160
 
 	// optional constructor of extra arguments to be passed into method deploying
 	// the contract. If returns both nil, no data is passed (noExtraDeployArgs can
@@ -126,11 +135,46 @@ func syncNeoFSContract(ctx context.Context, prm syncNeoFSContractPrm) (util.Uint
 		Sender() util.Uint160
 	}
 	var managementContract *management.Contract
-	if prm.committeeDeployRequired {
-		deployCommitteeActor, err := newCommitteeNotaryActorWithCustomCommitteeSigner(prm.blockchain, prm.localAcc, prm.committee, func(s *transaction.Signer) {
-			s.Scopes = transaction.CustomContracts
-			s.AllowedContracts = append(prm.extraCommitteeDeployAllowedContracts, prm.nnsContract)
-		})
+	if prm.deployWitness > 0 {
+		if prm.deployWitness != witnessAlphabet && prm.deployWitness != witnessAlphabetAndCommittee {
+			panic(fmt.Sprintf("unexpected deploy witness mode value %v", prm.deployWitness))
+		}
+
+		committeeDefaultMultiSigAcc := wallet.NewAccountFromPrivateKey(prm.localAcc.PrivateKey())
+		err := committeeDefaultMultiSigAcc.ConvertMultisig(smartcontract.GetDefaultHonestNodeCount(len(prm.committee)), prm.committee)
+		if err != nil {
+			return util.Uint160{}, fmt.Errorf("compose committee default multi-signature account: %w", err)
+		}
+
+		signers := make([]actor.SignerAccount, 2, 3)
+		// payer
+		signers[0].Account = prm.localAcc
+		signers[0].Signer.Account = prm.localAcc.ScriptHash()
+		signers[0].Signer.Scopes = transaction.None
+		// Alphabet
+		signers[1].Account = committeeDefaultMultiSigAcc
+		signers[1].Signer.Account = committeeDefaultMultiSigAcc.ScriptHash()
+		signers[1].Signer.Scopes = transaction.CustomContracts
+		signers[1].Signer.AllowedContracts = prm.alphabetDeployAllowedContracts
+
+		if prm.deployWitness == witnessAlphabetAndCommittee {
+			committeeMajorityMultiSigAcc := wallet.NewAccountFromPrivateKey(prm.localAcc.PrivateKey())
+			err := committeeMajorityMultiSigAcc.ConvertMultisig(smartcontract.GetMajorityHonestNodeCount(len(prm.committee)), prm.committee)
+			if err != nil {
+				return util.Uint160{}, fmt.Errorf("compose committee majority multi-signature account: %w", err)
+			}
+
+			signers = append(signers, actor.SignerAccount{
+				Signer: transaction.Signer{
+					Account:          committeeMajorityMultiSigAcc.ScriptHash(),
+					Scopes:           transaction.CustomContracts,
+					AllowedContracts: []util.Uint160{prm.nnsContract},
+				},
+				Account: committeeMajorityMultiSigAcc,
+			})
+		}
+
+		deployCommitteeActor, err := notary.NewActor(prm.blockchain, signers, prm.localAcc)
 		if err != nil {
 			return util.Uint160{}, fmt.Errorf("create Notary service client sending deploy transactions to be signed by the committee: %w", err)
 		}
@@ -226,7 +270,7 @@ func syncNeoFSContract(ctx context.Context, prm syncNeoFSContractPrm) (util.Uint
 			nefCp := prm.localNEF
 			manifestCp := prm.localManifest
 
-			if prm.committeeDeployRequired {
+			if prm.deployWitness > 0 {
 				l.Info("contract requires committee witness for deployment, sending Notary request...")
 
 				mainTxID, fallbackTxID, vub, err := prm.committeeLocalActor.Notarize(managementContract.DeployTransaction(&nefCp, &manifestCp, extraDeployArgs))

pkg/morph/deploy/deploy.go

@@ -464,8 +464,8 @@ func Deploy(ctx context.Context, prm Prm) error {
 	syncPrm.localNEF = prm.BalanceContract.Common.NEF
 	syncPrm.localManifest = prm.BalanceContract.Common.Manifest
 	syncPrm.domainName = domainBalance
-	syncPrm.committeeDeployRequired = true
-	syncPrm.extraCommitteeDeployAllowedContracts = []util.Uint160{netmapContractAddress}
+	syncPrm.deployWitness = witnessAlphabet
+	syncPrm.alphabetDeployAllowedContracts = []util.Uint160{netmapContractAddress}
 	syncPrm.buildExtraDeployArgs = noExtraDeployArgs
 
 	prm.Logger.Info("synchronizing Balance contract with the chain...")
@@ -477,8 +477,8 @@ func Deploy(ctx context.Context, prm Prm) error {
 
 	prm.Logger.Info("Balance contract successfully synchronized", zap.Stringer("address", balanceContractAddress))
 
-	syncPrm.committeeDeployRequired = false
-	syncPrm.extraCommitteeDeployAllowedContracts = nil
+	syncPrm.deployWitness = 0
+	syncPrm.alphabetDeployAllowedContracts = nil
 
 	// 5. Reputation
 	syncPrm.localNEF = prm.ReputationContract.Common.NEF
@@ -514,8 +514,8 @@ func Deploy(ctx context.Context, prm Prm) error {
 	syncPrm.localNEF = prm.ContainerContract.Common.NEF
 	syncPrm.localManifest = prm.ContainerContract.Common.Manifest
 	syncPrm.domainName = domainContainer
-	syncPrm.committeeDeployRequired = true
-	syncPrm.extraCommitteeDeployAllowedContracts = []util.Uint160{netmapContractAddress}
+	syncPrm.deployWitness = witnessAlphabetAndCommittee
+	syncPrm.alphabetDeployAllowedContracts = []util.Uint160{netmapContractAddress}
 	syncPrm.buildExtraDeployArgs = func() ([]any, error) {
 		return []any{
 			notaryDisabledExtraUpdateArg,
@@ -536,7 +536,8 @@ func Deploy(ctx context.Context, prm Prm) error {
 
 	prm.Logger.Info("Container contract successfully synchronized", zap.Stringer("address", containerContractAddress))
 
-	syncPrm.committeeDeployRequired = false
+	syncPrm.deployWitness = 0
+	syncPrm.alphabetDeployAllowedContracts = nil
 
 	// 8. Alphabet
 	syncPrm.localNEF = prm.AlphabetContract.Common.NEF