{"record":{"id":"a5ea891ce9b89928","repo":"nautechsystems/nautilus_trader","slug":"configured-active-payload-key-does-not-match-the-d","errorCode":null,"errorMessage":"Configured active payload key does not match the database active key","messagePattern":"Configured active payload key does not match the database active key","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":7493,"sourceCode":"        operation: row.try_get(\"operation\")?,\n        active_key_id: row.try_get(\"active_key_id\")?,\n    })\n}\n\nfn validate_execution_payload_state(\n    state: &ExecutionPayloadState,\n    keys: &PayloadKeySet,\n) -> anyhow::Result<()> {\n    anyhow::ensure!(\n        state.protocol_version == EXECUTION_PAYLOAD_PROTOCOL_VERSION,\n        \"Execution payload protocol version {} is not supported\",\n        state.protocol_version\n    );\n    anyhow::ensure!(\n        state.deployment_id == keys.deployment_id(),\n        \"Execution payload deployment ID does not match this database\"\n    );\n    anyhow::ensure!(\n        state.active_key_id.as_slice() == keys.active_key_id(),\n        \"Configured active payload key does not match the database active key\"\n    );\n    Ok(())\n}\n\nasync fn lock_execution_payload_operation(\n    transaction: &mut Transaction<'_, Postgres>,\n) -> anyhow::Result<()> {\n    let lock = PgAdvisoryLock::new(\"nautilus:blockchain:execution-payload\");\n    let PgAdvisoryLockKey::BigInt(lock_key) = lock.key() else {\n        unreachable!(\"string advisory locks use the 64-bit key space\");\n    };\n    sqlx::query(\"SELECT pg_advisory_xact_lock($1)\")\n        .bind(*lock_key)\n        .execute(&mut **transaction)\n        .await\n        .context(\"failed to acquire execution payload operation fence\")?;","sourceCodeStart":7475,"sourceCodeEnd":7511,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L7475-L7511","documentation":"This ensure! checks that the active_key_id recorded in the stored ExecutionPayloadState equals the active key ID from the configured payload keys. It guards against loading payloads whose encryption key differs from the key the operator has configured, which would otherwise cause undecryptable data.","triggerScenarios":"The configured active payload key was rotated or replaced but the database still records a different active_key_id (or vice versa) when validation runs.","commonSituations":"Rotating payload keys on one node but not propagating the change to the database/config; restoring config from a backup while the DB was rotated; mismatched key material between replicas.","solutions":["Align the configured active payload key with the key recorded in the database (or complete the rotation in the database)","If the old key is intentionally retired, run the key-rotation procedure that updates the database's active key","Verify key material/config files were not restored from an outdated backup"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if stored.active_key_id != configured_keys.active_key_id() {\n    return Err(\"active payload key out of sync with database\".into());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Perform key rotation atomically: update config and database together","Verify key configuration against the database at startup","Never restore config files from backups newer data depends on"],"tags":["database","configuration","rust","key-rotation"],"backgroundTag":"invalid-config-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}