{"record":{"id":"6619e12ea63345f3","repo":"nautechsystems/nautilus_trader","slug":"signer-address-derived-from-does-not-match","errorCode":null,"errorMessage":"Signer address {} derived from '{}' does not match configured wallet address {}","messagePattern":"Signer address (.+?) derived from '(.+?)' does not match configured wallet address (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/adapters/blockchain/src/execution/client.rs","lineNumber":2790,"sourceCode":"        }\n\n        // Load the signer key from the configured environment variable; the key is never\n        // logged, serialized, or stored in configuration\n        let private_key = std::env::var(&self.config.signer_private_key_env).map_err(|_| {\n            anyhow::anyhow!(\n                \"Signer private key environment variable '{}' is not set\",\n                self.config.signer_private_key_env\n            )\n        })?;\n        let signer = PrivateKeySigner::from_str(private_key.trim()).map_err(|_| {\n            anyhow::anyhow!(\n                \"Signer private key in '{}' is not a valid hex private key\",\n                self.config.signer_private_key_env\n            )\n        })?;\n\n        if signer.address() != self.wallet_address {\n            anyhow::bail!(\n                \"Signer address {} derived from '{}' does not match configured wallet address {}\",\n                signer.address(),\n                self.config.signer_private_key_env,\n                self.wallet_address\n            );\n        }\n\n        self.signer = Some(signer);\n\n        if self.cache.has_database()\n            && let Err(e) = self.reconcile_unresolved_execution().await\n        {\n            self.signer = None;\n            return Err(e);\n        }\n\n        if let Err(e) = self.refresh_wallet_balances().await {\n            self.signer = None;","sourceCodeStart":2772,"sourceCodeEnd":2808,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/2114cf6f761429e0adb5ca9596fcd7b895b16011/crates/adapters/blockchain/src/execution/client.rs#L2772-L2808","documentation":"At connect(), the signer private key is read from the environment variable named by signer_private_key_env, parsed, and its derived address must equal the configured wallet_address. A mismatch aborts the connection: the system refuses to trade with a key that is not the account the rest of the configuration (balances, allowances, wallet address) refers to.","triggerScenarios":"connect() with SIGNER_PRIVATE_KEY-style env var holding a key whose address differs from wallet_address in the config: key rotated in env but config not updated (or vice versa), the env var name resolving to a different environment's key, or a copy/paste of a test key into a mainnet config.","commonSituations":"Deploying the same config template to multiple environments with per-environment keys; CI and local shells exporting different keys; wallet address taken from an explorer for the wrong account; leading/trailing whitespace is handled (the key is trimmed) but a wrong-length or wrong-key value is not.","solutions":["Determine the address of the key currently in the env var (e.g. cast wallet address --private-key ...) and set wallet_address in config to that value","Or update the environment variable to hold the key that controls the configured wallet_address","Pin the exact env var name per environment in deployment manifests so the wrong key cannot leak across environments"],"exampleFix":"# before: env holds test key, config expects mainnet wallet\n# SIGNER_PRIVATE_KEY=0x<testnet-key>  wallet_address = 0x<mainnet-wallet>\n\n# after: key and config address match\nexport SIGNER_PRIVATE_KEY=0x<mainnet-key>   # cast wallet address -> 0x<mainnet-wallet>\n# config: wallet_address = 0x<mainnet-wallet>","handlingStrategy":"try-catch","validationCode":"// At startup, prove key/address pairing before connecting the client\nlet key = std::env::var(&config.signer_private_key_env)?;\nlet signer = PrivateKeySigner::from_str(key.trim())?;\nanyhow::ensure!(\n    signer.address() == config.wallet_address,\n    \"key in '{}' controls {}, config expects {}\",\n    config.signer_private_key_env, signer.address(), config.wallet_address\n);","typeGuard":null,"tryCatchPattern":"match client.connect().await {\n    Err(e) if e.to_string().contains(\"does not match configured wallet\") => {\n        // Secrets/coordination issue: page the operator; do not guess which side to change\n        fatal!(\"signer/wallet mismatch: {e}\");\n    }\n    other => other,\n}","preventionTips":["Run a pre-flight check that derives the key's address and diffs it against config","Store the wallet address WITH the key in your secret manager so they cannot drift","Never silence this failure to get a session running"],"tags":["signer","private-key","wallet","configuration","key-mismatch","connect"],"backgroundTag":"signer-key-address-mismatch","analyzedSha":"2114cf6f761429e0adb5ca9596fcd7b895b16011","analyzedAt":"2026-08-21T11:28:30.864Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}