{"record":{"id":"6c5c14d8c7246e1a","repo":"nautechsystems/nautilus_trader","slug":"sealed-transaction-payload-is-truncated","errorCode":null,"errorMessage":"Sealed transaction payload is truncated","messagePattern":"Sealed transaction payload is truncated","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":408,"sourceCode":"\npub(crate) fn envelope_key_id(envelope: &[u8]) -> anyhow::Result<[u8; KEY_ID_LEN]> {\n    Ok(parse_envelope(envelope)?.key_id)\n}\n\nstruct ParsedEnvelope<'a> {\n    key_id: [u8; KEY_ID_LEN],\n    nonce: &'a [u8],\n    ciphertext_and_tag: &'a [u8],\n}\n\nfn parse_envelope(envelope: &[u8]) -> anyhow::Result<ParsedEnvelope<'_>> {\n    anyhow::ensure!(\n        envelope.len() <= MAX_SEALED_TRANSACTION_BYTES,\n        \"Sealed transaction payload is {} bytes, exceeding the {} byte limit\",\n        envelope.len(),\n        MAX_SEALED_TRANSACTION_BYTES\n    );\n    anyhow::ensure!(\n        envelope.len() >= ENVELOPE_HEADER_LEN + TAG_LEN,\n        \"Sealed transaction payload is truncated\"\n    );\n    anyhow::ensure!(\n        envelope[0] == ENVELOPE_VERSION,\n        \"Unsupported signed transaction payload envelope version {}\",\n        envelope[0]\n    );\n\n    let key_id = envelope[1..1 + KEY_ID_LEN]\n        .try_into()\n        .expect(\"fixed key ID slice length\");\n    let nonce_start = 1 + KEY_ID_LEN;\n    let ciphertext_start = nonce_start + NONCE_LEN;\n    Ok(ParsedEnvelope {\n        key_id,\n        nonce: &envelope[nonce_start..ciphertext_start],\n        ciphertext_and_tag: &envelope[ciphertext_start..],","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L390-L426","documentation":"parse_envelope requires the envelope to contain at least the fixed header (version byte + key id + nonce) plus the AES-GCM authentication tag (ENVELOPE_HEADER_LEN + TAG_LEN). If the byte slice is shorter, it cannot contain a complete sealed envelope and is rejected before any field slicing occurs.","triggerScenarios":"Calling unseal() or envelope_key_id() with a byte slice shorter than ENVELOPE_HEADER_LEN + TAG_LEN — e.g. a DB BLOB that was truncated, a partially written file, or slicing off the last 16 tag bytes.","commonSituations":"Database column truncation (e.g. storing bytes in a fixed-size or length-limited column); failed/interrupted write during persist; a caller passes the plaintext transaction instead of the sealed envelope.","solutions":["Check envelope.len() >= ENVELOPE_HEADER_LEN + TAG_LEN before calling unseal and log the actual length","Re-fetch or re-seal the transaction; the stored payload is irrecoverably incomplete","Fix the persistence layer that truncated the bytes (column size, blob write, serialization)"],"exampleFix":"// before\nunseal(&stored_bytes, ...)?;\n// after\nif stored_bytes.len() < ENVELOPE_HEADER_LEN + TAG_LEN {\n    return Err(anyhow::anyhow!(\"stored sealed tx is {} bytes, minimum is {}\", stored_bytes.len(), ENVELOPE_HEADER_LEN + TAG_LEN));\n}\nunseal(&stored_bytes, ...)?;","handlingStrategy":"validation","validationCode":"fn has_minimum_envelope_len(envelope: &[u8]) -> anyhow::Result<()> {\n    anyhow::ensure!(\n        envelope.len() >= ENVELOPE_HEADER_LEN + TAG_LEN,\n        \"envelope too short: {} bytes\",\n        envelope.len()\n    );\n    Ok(())\n}","typeGuard":"fn is_complete_envelope(envelope: &[u8]) -> bool {\n    envelope.len() >= ENVELOPE_HEADER_LEN + TAG_LEN\n}","tryCatchPattern":"match unseal(&blob, deployment_id) {\n    Ok(tx) => tx,\n    Err(e) if e.to_string().contains(\"truncated\") => {\n        // treat payload as irrecoverable; re-seal from source of truth\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Use a length-prefixed or checksummed storage format for sealed blobs","Verify blob length after every read from the database","Avoid fixed-size DB columns for variable-length sealed payloads"],"tags":["blockchain","cryptography","truncated-data"],"backgroundTag":"invalid-argument-format","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}