{"record":{"id":"83bbb81bf4dd8a50","repo":"nautechsystems/nautilus_trader","slug":"system-clock-overflowed-when-converting-to-i64","errorCode":null,"errorMessage":"system clock overflowed when converting to i64","messagePattern":"system clock overflowed when converting to i64","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/lighter/src/signing/auth_token.rs","lineNumber":124,"sourceCode":"/// The token format matches the Go reference's `ConstructAuthToken`. The\n/// returned string is the value the WebSocket subscribe handshake sends in\n/// the `auth` field of an `account_*` channel subscription.\n///\n/// # Errors\n///\n/// Returns the underlying [`crate::common::credential::Credential::private_key`]\n/// failure if the secret cannot be decoded, or any [`build_auth_token`]\n/// failure (clock-before-epoch or, hypothetically, a breach caused by its own\n/// deadline validation).\npub fn build_auth_token_for(\n    credential: &crate::common::credential::Credential,\n) -> anyhow::Result<SecretString> {\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .map_err(|_| anyhow::anyhow!(\"system clock is before UNIX epoch\"))?\n        .as_secs();\n    let now_i64 = i64::try_from(now)\n        .map_err(|_| anyhow::anyhow!(\"system clock overflowed when converting to i64\"))?;\n    let deadline = now_i64\n        .checked_add(DEFAULT_AUTH_TOKEN_TTL_SECS)\n        .ok_or_else(|| anyhow::anyhow!(\"deadline computation overflowed\"))?;\n    let sk = credential.private_key()?;\n    build_auth_token(\n        deadline,\n        credential.account_index(),\n        credential.api_key_index(),\n        &sk,\n        fresh_k(),\n    )\n    .map_err(|e| anyhow::anyhow!(\"failed to mint Lighter auth token: {e}\"))\n}\n\n/// Draws a fresh canonical [`Scalar`] from the thread-local CSPRNG suitable\n/// for the per-signature `k` nonce.\n///\n/// The Schnorr binding requires `k` to be drawn from a cryptographic RNG and","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/lighter/src/signing/auth_token.rs#L106-L142","documentation":"build_auth_token_for converts the seconds-since-epoch value to i64 before computing the token deadline. If the seconds count exceeds i64::MAX (far beyond year 2262), i64::try_from fails and this error is raised. This guards deadline arithmetic from silent overflow; in practice it indicates an absurd system clock rather than a normal condition.","triggerScenarios":"Any authenticated call (auth token builders listed in callers) running on a system whose UNIX seconds since epoch exceed i64::MAX — e.g. corrupted clock libraries or mocked/faulty SystemTime sources returning huge values.","commonSituations":"Faulty or mocked time sources in exotic runtimes; integer-corrupted environment; practically never on a healthy host since real epoch seconds (~1.7e9) fit easily in i64.","solutions":["Inspect the system clock (`date -u +%s`) — a value near 9e18 indicates an OS/hypervisor time bug.","Fix the time source (NTP resync, VM tools, host clock) and retry.","If this occurs in tests, ensure any time mocking returns realistic epoch values.","Report the runtime/environment bug if the OS consistently reports impossible times."],"exampleFix":"// before (mocked time in a test harness)\nSystemTime::now = () => SystemTime::UNIX_EPOCH + Duration::from_secs(i64::MAX as u64)\n// after\nSystemTime::now = () => SystemTime::UNIX_EPOCH + Duration::from_secs(1_700_000_000)","handlingStrategy":"try-catch","validationCode":"// Sanity-check the clock before authenticating\nlet secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_secs();\nanyhow::ensure!(secs < i64::MAX as u64 / 2, \"implausible system time {secs}\");","typeGuard":null,"tryCatchPattern":"match build_auth_token_for(&credential) {\n    Ok(t) => t,\n    Err(e) if e.to_string().contains(\"overflowed when converting\") => {\n        eprintln!(\"system time is absurd; fix OS/hypervisor clock\");\n        Err(e)\n    }\n    Err(e) => Err(e),\n}","preventionTips":["Monitor system time monotonic sanity in production daemons.","Use realistic values when mocking SystemTime in tests.","Keep host/VM time sources (VMware tools, Hyper-V integration) healthy."],"tags":["rust","clock","overflow","auth-token"],"backgroundTag":"invalid-system-clock","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}