build(solidity)!: remove @defi-wonderland/smock

[mswilkison]

Stacked on #4202. Removes @defi-wonderland/smock, which upstream archived
with this notice:

⚠️ DEPRECATED – DO NOT USE

It may contain outdated, insecure, or vulnerable code and should not
be used in production or as a dependency in any project.

No support, updates, or security patches will be provided.

That is the reason. The toolchain ceiling — no smock version reaches hardhat
2.26+, which is what Node 24 needs — is what made it unavoidable rather than
schedulable, and removing it unblocks that bump.

Result

Verified with smock uninstalled, not merely unused:

	before	after
random-beacon	926 passing / 6 pending / 0 failing	955 / 0 / 0
ecdsa	650 passing / 44 pending / 0 failing	673 / 44 / 0

The increases are the 23 mock self-tests in each package, plus six tests in
random-beacon that smock kept disabled. They sat behind

// FIXME: Blocked by https://github.com/defi-wonderland/smock/issues/101
context.skip("when token staking seize call fails", ...)

— the paths asserting that a failing seize does not take the whole operation
down with it. They pass against MockContract. That is the point of replacing
smock rather than pinning it.

The replacement

contracts/test/MockContract.sol plus test/helpers/mock.ts, ported from
threshold-network/tbtc-v2#1062 where it has replaced 554 call sites and runs on
hardhat 2.29 / Node 24. smock configured fakes by mutating in-process
JavaScript inside Hardhat's EVM, which is why it broke on every hardhat past
2.19; this drives an ordinary deployed contract over the public provider API.

The one behavioural difference is that configuration is a transaction and
must be awaited, which is why call sites change at all. allowBlocksWithSameTimestamp
is set in both configs so that configuring a mock cannot advance the chain clock.

Judgement calls worth reviewing

expectCalledWith is new. smock's calledWith says nothing about call
count, so reusing the existing expectCalledOnceWith for those two sites would
have silently strengthened the assertion. It has its own self-test including
the negative case.

Five assertions on a view function had to change. The TIP-092 suite
checked that IStaking.authorizedStake was called; it is view, so Solidity
reaches it by STATICCALL where recording is impossible, and the mock refuses
loudly rather than answering zero. Four already asserted the value the mock
returns — the same proof by a stronger route — so the call check is dropped
with a comment. The fifth, updateOperatorStatus, had no other assertion;
it now asserts the operator is up to date, which holds only if the registry
read the allowlist and synced the pool to it.

resetMock is gone, and this one caused a real failure. Both callers were
smock-era bookkeeping that became harmful once resetting meant sending a
transaction. In the RandomBeacon suite it ran after restoreSnapshot(), so
it was redundant and, unawaited, landed in the next context and wiped the call
log that context asserted on. In createNewWallet it mined a block inside a
shared helper, which shifted cumulative state enough to flip an
isWalletMember assertion in the full run while passing in isolation.

One gas budget moved, and it is the only assertion relaxed rather than
replaced. approveDkgResult reaches the wallet owner; recording a call SSTOREs
its calldata — 447k against a 274k ± 1000 budget. Switching recording off for
that suite (nothing there inspects the wallet owner's calls) gives ~286k. The
residual ~12k is MockContract's fallback dispatch, real work smock's fake did
not do, so the expectation moves to 286 000 and the tolerance stays. In
production the wallet owner is a real contract and costs more than either.

smock.mock was a false alarm. The one use only ever read .address, with
no setVariable/getVariable, so it is now a plain factory deploy.

Next

hardhat 2.19.5 → 2.29 and Node 22 → 24, which this unblocks.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bfcf4db0-52ed-452d-84f2-61cc64bf85c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/solidity-remove-smock

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}