test: Add some missing sc messages tests (#3187)

# Description


## Linked Issues
- Fixes # (issue, if applicable)
- Related to # (issue) 

## Testing
Describe how these changes were tested. If you've added new features,
have you added unit tests?

## Docs
Describe where this code is documented. If it changes a documented
interface, have the docs been updated?

Author: ercecan

bin/citrea/tests/bitcoin/light_client_test.rs

@@ -27,8 +27,8 @@ use citrea_e2e::Result;
 use citrea_fullnode::rpc::FullNodeRpcClient;
 use citrea_light_client_prover::circuit::{
     AddSecurityCouncilMember, BatchProofMethodIdUpdate, RemoveBatchProofMethodId,
-    RemoveSecurityCouncilMember, UpdateBatchProverDaPubKey, UpdateSecurityCouncilThreshold,
-    UpdateSequencerDaPubKey,
+    RemoveSecurityCouncilMember, ReplaceSecurityCouncilMember, UpdateBatchProverDaPubKey,
+    UpdateSecurityCouncilThreshold, UpdateSequencerDaPubKey,
 };
 use citrea_light_client_prover::rpc::LightClientProverRpcClient;
 use citrea_primitives::compression::{compress_blob, decompress_blob};
@@ -39,9 +39,10 @@ use risc0_zkvm::{FakeReceipt, InnerReceipt, MaybePruned, ReceiptClaim};
 use sov_modules_api::BlobReaderTrait;
 use sov_rollup_interface::da::{
     AddSecurityCouncilMemberV1Body, BatchProofMethodIdBody, DaTxRequest, DaVerifier, DataOnDa,
-    RemoveBatchProofMethodIdV1Body, RemoveSecurityCouncilMemberV1Body, SecurityCouncilTx,
-    SecurityCouncilTxType, SequencerCommitment, UpdateBatchProverDaPubKeyV1Body,
-    UpdateSecurityCouncilThresholdV1Body, UpdateSequencerDaPubKeyV1Body,
+    RemoveBatchProofMethodIdV1Body, RemoveSecurityCouncilMemberV1Body,
+    ReplaceSecurityCouncilMemberV1Body, SecurityCouncilTx, SecurityCouncilTxType,
+    SequencerCommitment, UpdateBatchProverDaPubKeyV1Body, UpdateSecurityCouncilThresholdV1Body,
+    UpdateSequencerDaPubKeyV1Body,
 };
 use sov_rollup_interface::rpc::BatchProofMethodIdRpcResponse;
 use sov_rollup_interface::services::da::DaService;
@@ -4530,6 +4531,126 @@ impl TestCase for SecurityCouncilMemberManagementTest {
             "CASE 7: Should still have 4 members (below min rejected)"
         );
 
+        // --- CASE 8: Replace non-existent member (rejected) ---
+        // Try to replace a member that doesn't exist in the council.
+        let replace_body_1 = ReplaceSecurityCouncilMemberV1Body {
+            to_be_replaced: [0xAAu8; 20], // not in council
+            new_member: [0x33u8; 20],
+            nonce: 7,
+        };
+        let payload = ReplaceSecurityCouncilMember::from(replace_body_1.clone());
+        let signatures_with_index = create_valid_signatures(&signers, &payload, 2);
+        bitcoin_da_service
+            .send_transaction_with_fee_rate(
+                DaTxRequest::SecurityCouncilTx(SecurityCouncilTx {
+                    tx_type: SecurityCouncilTxType::ReplaceSecurityCouncilMemberV1(replace_body_1),
+                    signatures_with_index,
+                }),
+                1.0,
+            )
+            .await?;
+        da.wait_mempool_len(2, None).await?;
+        da.generate(DEFAULT_FINALITY_DEPTH).await?;
+        let l1_height = da.get_finalized_height(None).await?;
+        light_client_prover
+            .wait_for_l1_height(l1_height, Some(TEN_MINS))
+            .await?;
+
+        let addresses = light_client_prover
+            .client
+            .http_client()
+            .get_security_council_addresses()
+            .await?;
+        assert_eq!(
+            addresses.len(),
+            4,
+            "CASE 8: Should still have 4 members (non-existent member replace rejected)"
+        );
+
+        // --- CASE 9: Replace with already existing member (rejected) ---
+        // Try to replace one member with another who is already in the council.
+        let replace_body_2 = ReplaceSecurityCouncilMemberV1Body {
+            to_be_replaced: _initial_addresses[0].0 .0,
+            new_member: _initial_addresses[1].0 .0, // already in council
+            nonce: 7,
+        };
+        let payload = ReplaceSecurityCouncilMember::from(replace_body_2.clone());
+        let signatures_with_index = create_valid_signatures(&signers, &payload, 2);
+        bitcoin_da_service
+            .send_transaction_with_fee_rate(
+                DaTxRequest::SecurityCouncilTx(SecurityCouncilTx {
+                    tx_type: SecurityCouncilTxType::ReplaceSecurityCouncilMemberV1(replace_body_2),
+                    signatures_with_index,
+                }),
+                1.0,
+            )
+            .await?;
+        da.wait_mempool_len(2, None).await?;
+        da.generate(DEFAULT_FINALITY_DEPTH).await?;
+        let l1_height = da.get_finalized_height(None).await?;
+        light_client_prover
+            .wait_for_l1_height(l1_height, Some(TEN_MINS))
+            .await?;
+
+        let addresses = light_client_prover
+            .client
+            .http_client()
+            .get_security_council_addresses()
+            .await?;
+        assert_eq!(
+            addresses.len(),
+            4,
+            "CASE 9: Should still have 4 members (duplicate member replace rejected)"
+        );
+
+        // --- CASE 10: Valid replace member ---
+        // Replace _initial_addresses[2] with a new address.
+        let new_replacement = [0x33u8; 20];
+        let replace_body_3 = ReplaceSecurityCouncilMemberV1Body {
+            to_be_replaced: _initial_addresses[2].0 .0,
+            new_member: new_replacement,
+            nonce: 7,
+        };
+        let payload = ReplaceSecurityCouncilMember::from(replace_body_3.clone());
+        let signatures_with_index = create_valid_signatures(&signers, &payload, 2);
+        bitcoin_da_service
+            .send_transaction_with_fee_rate(
+                DaTxRequest::SecurityCouncilTx(SecurityCouncilTx {
+                    tx_type: SecurityCouncilTxType::ReplaceSecurityCouncilMemberV1(replace_body_3),
+                    signatures_with_index,
+                }),
+                1.0,
+            )
+            .await?;
+        da.wait_mempool_len(2, None).await?;
+        da.generate(DEFAULT_FINALITY_DEPTH).await?;
+        let l1_height = da.get_finalized_height(None).await?;
+        light_client_prover
+            .wait_for_l1_height(l1_height, Some(TEN_MINS))
+            .await?;
+
+        let addresses = light_client_prover
+            .client
+            .http_client()
+            .get_security_council_addresses()
+            .await?;
+        assert_eq!(
+            addresses.len(),
+            4,
+            "CASE 10: Should still have 4 members after replace"
+        );
+        // Verify the old member is gone and new member is present
+        let old_member_addr = format!("{:?}", _initial_addresses[2]);
+        let new_member_addr = format!("{:?}", Address::from_slice(&new_replacement));
+        assert!(
+            !addresses.contains(&old_member_addr),
+            "CASE 10: Old member should be removed"
+        );
+        assert!(
+            addresses.contains(&new_member_addr),
+            "CASE 10: New member should be present"
+        );
+
         Ok(())
     }
 }

crates/light-client-prover/src/circuit/method_id_verifier.rs

@@ -282,6 +282,43 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn test_below_threshold_signature_count_rejected() {
+        let body = BatchProofMethodIdBody {
+            method_id: [0u32; 8],
+            activation_l2_height: 0,
+            nonce: 0,
+        };
+
+        let payload = BatchProofMethodIdUpdate::from(body.clone());
+
+        let (initial_addresses, signers) = generate_initial_addresses_with_signers();
+
+        // Create only 2 signatures when threshold is 3
+        let signatures_with_index =
+            crate::create_valid_signatures_with_count(&signers, &payload, 2);
+
+        assert!(!verify_security_council_signatures(
+            &initial_addresses,
+            BatchProofMethodIdUpdate::from(body.clone()),
+            &signatures_with_index,
+            TEST_THRESHOLD,
+            mockda::EIP712_SECURITY_COUNCIL_MESSAGE_DOMAIN_NAME.to_string(),
+            citrea_network_to_chain_id(Network::Nightly),
+        ));
+
+        // Create 0 signatures
+        let empty_signatures: Vec<([u8; 65], u8)> = vec![];
+        assert!(!verify_security_council_signatures(
+            &initial_addresses,
+            BatchProofMethodIdUpdate::from(body),
+            &empty_signatures,
+            TEST_THRESHOLD,
+            mockda::EIP712_SECURITY_COUNCIL_MESSAGE_DOMAIN_NAME.to_string(),
+            citrea_network_to_chain_id(Network::Nightly),
+        ));
+    }
+
     #[test]
     fn test_signature_index_swapped() {
         let body = BatchProofMethodIdBody {