{"record":{"id":"00cacdf3b4487f79","repo":"nautechsystems/nautilus_trader","slug":"deployment-manifest-digest-must-be-nonzero","errorCode":null,"errorMessage":"Deployment manifest digest must be nonzero","messagePattern":"Deployment manifest digest must be nonzero","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/rpc/verification.rs","lineNumber":1237,"sourceCode":"        .map_err(|_| anyhow::anyhow!(\"Chain checkpoint hash must contain 32 hexadecimal bytes\"))?;\n    anyhow::ensure!(\n        checkpoint_hash != B256::ZERO,\n        \"Chain checkpoint hash must be nonzero\"\n    );\n    anyhow::ensure!(\n        anchor.max_head_skew_blocks != 0\n            && anchor.max_head_age_secs != 0\n            && anchor.max_future_drift_secs != 0,\n        \"Chain head skew, age, and future-drift limits must be nonzero\"\n    );\n    anyhow::ensure!(\n        !config.manifest_version.trim().is_empty(),\n        \"Deployment manifest version is required\"\n    );\n    let manifest_digest = B256::from_str(&config.manifest_digest).map_err(|_| {\n        anyhow::anyhow!(\"Deployment manifest digest must contain 32 hexadecimal bytes\")\n    })?;\n    anyhow::ensure!(\n        manifest_digest != B256::ZERO,\n        \"Deployment manifest digest must be nonzero\"\n    );\n    let manifest = &config.deployment_manifest;\n    anyhow::ensure!(\n        manifest.version == config.manifest_version,\n        \"Deployment manifest version does not match its configured identity\"\n    );\n    anyhow::ensure!(\n        manifest.chain_id == anchor.chain_id && manifest.chain_name == anchor.chain_name,\n        \"Deployment manifest chain identity does not match the chain anchor\"\n    );\n    let canonical_manifest = serde_json::to_vec(manifest)\n        .map_err(|_| anyhow::anyhow!(\"Failed to serialize the deployment manifest\"))?;\n    anyhow::ensure!(\n        keccak256(canonical_manifest) == manifest_digest,\n        \"Deployment manifest digest does not match its canonical content\"\n    );","sourceCodeStart":1219,"sourceCodeEnd":1255,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/rpc/verification.rs#L1219-L1255","documentation":"After the manifest digest parses successfully as a B256, it is checked against B256::ZERO. A zero digest would let any zero-content commitment pass, so the validator rejects it as an obviously unset or forged value. Only a real keccak commitment of the manifest bytes is acceptable.","triggerScenarios":"Validating a DeploymentConfig whose `manifest_digest` is a well-formed 32-byte value but all zeros (0x0000...0000).","commonSituations":"Default-constructed configs where the digest field defaulted to zeroed bytes; an operator zeroing the digest to bypass integrity checks; a migration that inserted 0 placeholders.","solutions":["Set `manifest_digest` to the actual keccak256 digest of the canonical manifest JSON.","Regenerate the digest from the current manifest bytes rather than reusing a stored zero value.","Audit the config pipeline for code that writes a zeroed digest when the manifest is missing."],"exampleFix":"// before\nlet config = DeploymentConfig { manifest_digest: B256::ZERO.to_string(), ..config };\n// after\nlet config = DeploymentConfig { manifest_digest: keccak256(serde_json::to_vec(&manifest)?).to_string(), ..config };","handlingStrategy":"validation","validationCode":"let digest = B256::from_str(&config.manifest_digest).expect(\"digest must be hex\");\nassert_ne!(digest, B256::ZERO, \"manifest_digest must be the real keccak commitment\");","typeGuard":"fn is_nonzero_digest(s: &str) -> Option<B256> {\n    B256::from_str(s).ok().filter(|d| *d != B256::ZERO)\n}","tryCatchPattern":null,"preventionTips":["Compute the digest in the build pipeline; never allow zeroed or placeholder digests into configs.","Treat a zero digest as 'unsigned/unverified' in your own tooling and block deploys on it.","Add a config linter rule rejecting B256::ZERO for any digest field."],"tags":["validation","config","blockchain"],"backgroundTag":"invalid-config-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}