{"record":{"id":"bb7fd09734773c2e","repo":"nautechsystems/nautilus_trader","slug":"signed-transaction-payload-nonce-is-invalid","errorCode":null,"errorMessage":"Signed transaction payload nonce is invalid","messagePattern":"Signed transaction payload nonce is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":202,"sourceCode":"        Ok(envelope)\n    }\n\n    pub(crate) fn unseal(\n        &self,\n        envelope: &[u8],\n        context: &PayloadContext,\n    ) -> anyhow::Result<Vec<u8>> {\n        validate_context(context, &self.deployment_id)?;\n        let parsed = parse_envelope(envelope)?;\n        let key = self.keys.get(&parsed.key_id).ok_or_else(|| {\n            anyhow::anyhow!(\n                \"Payload sealing key {} is not configured\",\n                hex::encode(parsed.key_id)\n            )\n        })?;\n        let aad = encode_aad(&parsed.key_id, context)?;\n        let nonce = Nonce::try_assume_unique_for_key(parsed.nonce)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload nonce is invalid\"))?;\n        let mut plaintext = parsed.ciphertext_and_tag.to_vec();\n        let plaintext_len = key\n            .open_in_place(nonce, Aad::from(aad), &mut plaintext)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload authentication failed\"))?\n            .len();\n        plaintext.truncate(plaintext_len);\n        anyhow::ensure!(\n            plaintext.len() <= MAX_SIGNED_TRANSACTION_BYTES,\n            \"Unsealed transaction payload is {} bytes, exceeding the {} byte limit\",\n            plaintext.len(),\n            MAX_SIGNED_TRANSACTION_BYTES\n        );\n        Ok(plaintext)\n    }\n}\n\npub(crate) fn authenticate_payload(\n    raw_transaction: &[u8],","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L184-L220","documentation":"Thrown in `unseal` when the nonce bytes parsed from the envelope are not a valid 12-byte AEAD nonce (Ring's `Nonce::try_assume_unique_for_key` rejects them). This indicates the envelope structure or its nonce field is malformed.","triggerScenarios":"Calling `unseal` with an envelope whose 12-byte nonce region was truncated, corrupted, or produced by a different envelope version/parser.","commonSituations":"Manual envelope editing, storage-layer truncation, byte-offset drift after a format change, or copying payloads between systems with encoding corruption.","solutions":["Verify the envelope is intact (correct total length: header + key id + nonce + ciphertext+tag) and re-copy from source if corrupted","Confirm the envelope version byte matches the parser version in use","Re-seal and persist the payload from its original source if the stored envelope is unrecoverable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// envelope layout: version(1) + key_id + nonce(12) + ciphertext_and_tag\nif envelope.len() < ENVELOPE_HEADER_LEN {\n    return Err(anyhow!(\"envelope truncated\"));\n}","typeGuard":"fn envelope_well_formed(e: &[u8]) -> bool { e.len() >= ENVELOPE_HEADER_LEN }","tryCatchPattern":"match sealer.unseal(&envelope, &ctx) {\n    Err(e) if e.to_string().contains(\"nonce is invalid\") => {\n        restore_envelope_from_backup().context(\"envelope corrupted\")?\n    }\n    other => other,\n}","preventionTips":["Store envelopes as opaque blobs; never parse or rewrite their bytes","Include integrity checksums for envelopes in external storage","Verify envelope lengths after any storage migration"],"tags":["crypto","nonce","payload-corruption"],"backgroundTag":"invalid-argument-format","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}