{"record":{"id":"6cb72981402bb284","repo":"nautechsystems/nautilus_trader","slug":"unsupported-signed-transaction-payload-envelope-ve","errorCode":null,"errorMessage":"Unsupported signed transaction payload envelope version {}","messagePattern":"Unsupported signed transaction payload envelope version (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":412,"sourceCode":"\nstruct ParsedEnvelope<'a> {\n    key_id: [u8; KEY_ID_LEN],\n    nonce: &'a [u8],\n    ciphertext_and_tag: &'a [u8],\n}\n\nfn parse_envelope(envelope: &[u8]) -> anyhow::Result<ParsedEnvelope<'_>> {\n    anyhow::ensure!(\n        envelope.len() <= MAX_SEALED_TRANSACTION_BYTES,\n        \"Sealed transaction payload is {} bytes, exceeding the {} byte limit\",\n        envelope.len(),\n        MAX_SEALED_TRANSACTION_BYTES\n    );\n    anyhow::ensure!(\n        envelope.len() >= ENVELOPE_HEADER_LEN + TAG_LEN,\n        \"Sealed transaction payload is truncated\"\n    );\n    anyhow::ensure!(\n        envelope[0] == ENVELOPE_VERSION,\n        \"Unsupported signed transaction payload envelope version {}\",\n        envelope[0]\n    );\n\n    let key_id = envelope[1..1 + KEY_ID_LEN]\n        .try_into()\n        .expect(\"fixed key ID slice length\");\n    let nonce_start = 1 + KEY_ID_LEN;\n    let ciphertext_start = nonce_start + NONCE_LEN;\n    Ok(ParsedEnvelope {\n        key_id,\n        nonce: &envelope[nonce_start..ciphertext_start],\n        ciphertext_and_tag: &envelope[ciphertext_start..],\n    })\n}\n\nfn validate_context(context: &PayloadContext, deployment_id: &str) -> anyhow::Result<()> {","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L394-L430","documentation":"The first byte of a sealed envelope is a version tag (ENVELOPE_VERSION). If it does not match the version this binary supports, the envelope format is unknown and cannot be safely parsed, so parse_envelope fails. This protects against misinterpreting bytes produced by a different envelope layout.","triggerScenarios":"Calling unseal() or envelope_key_id() on bytes whose first byte != ENVELOPE_VERSION — e.g. decrypting data written by a newer/older deployment with a different envelope version, or passing ciphertext that was never enveloped (random/plaintext bytes).","commonSituations":"Rolling deployment where a newer service re-sealed payloads with version N+1 and an older consumer reads them; passing raw AES-GCM ciphertext without the version header; byte offset bug causing the slice to start one byte late.","solutions":["Print envelope[0] and compare with the ENVELOPE_VERSION constant in sealing.rs to identify what produced the bytes","Upgrade the reading service to a version supporting the envelope version found in the payload","Re-seal old payloads with the current version during a migration","Verify you are slicing from offset 0 — an off-by-one start shifts the version byte"],"exampleFix":"// before\nlet sealed = &blob[1..]; // accidental offset\nunseal(sealed, ...)?; // reads wrong version byte\n// after\nlet sealed = &blob[..];\nunseal(sealed, ...)?;","handlingStrategy":"validation","validationCode":"fn check_envelope_version(envelope: &[u8]) -> anyhow::Result<()> {\n    anyhow::ensure!(!envelope.is_empty(), \"empty envelope\");\n    anyhow::ensure!(\n        envelope[0] == ENVELOPE_VERSION,\n        \"envelope version {} not supported (need {})\",\n        envelope[0],\n        ENVELOPE_VERSION\n    );\n    Ok(())\n}","typeGuard":"fn has_supported_version(envelope: &[u8]) -> bool {\n    !envelope.is_empty() && envelope[0] == ENVELOPE_VERSION\n}","tryCatchPattern":"match unseal(&blob, deployment_id) {\n    Ok(tx) => tx,\n    Err(e) if e.to_string().contains(\"envelope version\") => {\n        // route to migration/re-seal path; do not attempt re-parse\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Check the version byte before unsealing and branch on it explicitly","Migrate old-version payloads during deployments, not lazily at read time","Never pass raw ciphertext; always persist the full versioned envelope"],"tags":["blockchain","cryptography","version-mismatch"],"backgroundTag":"unsupported-enum-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}