{"record":{"id":"c8e8784e0492eea7","repo":"nautechsystems/nautilus_trader","slug":"unsealed-transaction-payload-is-bytes-exceedin","errorCode":null,"errorMessage":"Unsealed transaction payload is {} bytes, exceeding the {} byte limit","messagePattern":"Unsealed transaction payload is (.+?) bytes, exceeding the (.+?) byte limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":209,"sourceCode":"    ) -> anyhow::Result<Vec<u8>> {\n        validate_context(context, &self.deployment_id)?;\n        let parsed = parse_envelope(envelope)?;\n        let key = self.keys.get(&parsed.key_id).ok_or_else(|| {\n            anyhow::anyhow!(\n                \"Payload sealing key {} is not configured\",\n                hex::encode(parsed.key_id)\n            )\n        })?;\n        let aad = encode_aad(&parsed.key_id, context)?;\n        let nonce = Nonce::try_assume_unique_for_key(parsed.nonce)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload nonce is invalid\"))?;\n        let mut plaintext = parsed.ciphertext_and_tag.to_vec();\n        let plaintext_len = key\n            .open_in_place(nonce, Aad::from(aad), &mut plaintext)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload authentication failed\"))?\n            .len();\n        plaintext.truncate(plaintext_len);\n        anyhow::ensure!(\n            plaintext.len() <= MAX_SIGNED_TRANSACTION_BYTES,\n            \"Unsealed transaction payload is {} bytes, exceeding the {} byte limit\",\n            plaintext.len(),\n            MAX_SIGNED_TRANSACTION_BYTES\n        );\n        Ok(plaintext)\n    }\n}\n\npub(crate) fn authenticate_payload(\n    raw_transaction: &[u8],\n    intent: &ExecutionIntentRow,\n    hash: &ExecutionTransactionHashRow,\n    policy: PayloadPolicy,\n    deployment_id: &str,\n) -> anyhow::Result<PayloadContext> {\n    let context = payload_context(intent, hash, deployment_id)?;\n    authenticate_payload_identity(","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L191-L227","documentation":"Post-decryption sanity check in `unseal`: after successful authentication, the recovered plaintext is re-checked against `MAX_SIGNED_TRANSACTION_BYTES`. This catches envelopes that authenticate but claim or contain an implausibly large payload, defending against crafted or oversized plaintext.","triggerScenarios":"Calling `unseal` on an envelope whose decrypted plaintext exceeds the maximum byte limit — possible only if such an oversized payload was sealed by code that bypassed the seal-time check, or after a limit downgrade.","commonSituations":"Envelopes written by older/patched versions with a larger limit, a lowered `MAX_SIGNED_TRANSACTION_BYTES` in the current build, or adversarial envelopes from an attacker with key access.","solutions":["Check whether `MAX_SIGNED_TRANSACTION_BYTES` was reduced; if so, migrate or drop legacy oversized payloads","Re-seal the payload in smaller pieces that satisfy the current limit","Audit how the envelope was produced (custom tooling may have skipped the seal-time size check)"],"exampleFix":"// before\nlet pt = sealer.unseal(&legacy_envelope, &ctx)?; // fails: legacy oversized\n// after\nassert!(legacy_plaintext.len() <= MAX_SIGNED_TRANSACTION_BYTES, \"re-seal required\");","handlingStrategy":"try-catch","validationCode":"// after unseal succeeds this cannot trigger; guard seal-time instead:\nassert!(plaintext.len() <= MAX_SIGNED_TRANSACTION_BYTES);","typeGuard":null,"tryCatchPattern":"match sealer.unseal(&envelope, &ctx) {\n    Err(e) if e.to_string().contains(\"Unsealed transaction payload\") => {\n        migrate_legacy_oversized_payload(envelope)?\n    }\n    other => other,\n}","preventionTips":["Never lower MAX_SIGNED_TRANSACTION_BYTES without a payload migration plan","Only seal through the official `seal` API, which enforces the limit","Audit any custom tooling that produces envelopes directly"],"tags":["validation","size-limit","payload"],"backgroundTag":"payload-too-large","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}