nautechsystems/nautilus_trader · error · anyhow::Error

Current database payload key is not configured for rewrap

Error message

Current database payload key is not configured for rewrap

What it means

In the 'ready' rewrap phase, the state's active_key_id identifies the key currently wrapping payloads in the database. The ensure! requires the supplied PayloadKeySet to contain that key; otherwise old envelopes could never be unwrapped for rewrapping, so the operation aborts.

Source

Thrown at crates/adapters/blockchain/src/cache/database.rs:5361

        .fetch_optional(&mut *transaction)
        .await
        .context("failed to lock execution payload state for rewrap")?
        .ok_or_else(|| anyhow::anyhow!("Execution payload protection is not active"))?;
        let state = execution_payload_state_from_row(&state_row)?;
        anyhow::ensure!(
            state.protocol_version == EXECUTION_PAYLOAD_PROTOCOL_VERSION
                && state.deployment_id == keys.deployment_id(),
            "Execution payload rewrap context does not match this database"
        );

        match state.operation.as_str() {
            "ready" => {
                let current_id: [u8; 32] = state
                    .active_key_id
                    .as_slice()
                    .try_into()
                    .context("database active payload key ID is invalid")?;
                anyhow::ensure!(
                    keys.contains_key(&current_id),
                    "Current database payload key is not configured for rewrap"
                );
                validate_execution_payload_key_inventory(&mut transaction, keys).await?;
                if current_id == *keys.active_key_id() {
                    transaction
                        .commit()
                        .await
                        .context("failed to complete no-op execution payload rewrap")?;
                    return Ok(());
                }
                sqlx::query(
                    "UPDATE execution_payload_state \
                     SET operation = 'rewrap', active_key_id = $1, progress_id = 0, updated_at = NOW() \
                     WHERE component = 'signed_transactions'",
                )
                .bind(keys.active_key_id().as_slice())
                .execute(&mut *transaction)

View on GitHub (pinned to 18893faf8b)

Solutions

1. Add the key whose id equals execution_payload_state.active_key_id to the PayloadKeySet and retry.
2. Recover the retired wrapping key from your secret manager or backup and register it with the payload key set.
3. Complete the interrupted rotation: with the old key present, rerun the rewrap so envelopes move to the new active key, then retire the old key.
4. Compare configured key ids with the database's active_key_id (hex) to confirm which key is missing.

Example fix

// before: only the new key configured, db still on old key
let keys = PayloadKeySet::builder().active_key(new_key).build();
// after: retain the database's current key until rewrap completes
let keys = PayloadKeySet::builder()
    .active_key(new_key)
    .retained_key(old_key) // must cover execution_payload_state.active_key_id
    .build();

let active_id: Vec<u8> = sqlx::query_scalar(
    "SELECT active_key_id FROM execution_payload_state WHERE component='signed_transactions'"
).fetch_one(&pool).await?;
if !keys.contains_key(active_id.as_slice().try_into()?) {
    return Err(anyhow!("configured key set lacks the database active key {}", alloy::hex::encode(&active_id)));
}

When it happens

Trigger: Calling rewrap_execution_payload_storage in state 'ready' when execution_payload_state.active_key_id is not a key present in the supplied keys set (keys.contains_key(current_id) is false).

Common situations: Key rotation replaced the configured active key and dropped the old key from config before the database's envelopes were rewrapped; loading only the new key in a fresh environment while the database still uses the retired key; secret-manager deletion of a still-in-use wrapping key.

Related errors

• Execution payload storage is in {operation} maintenance; com
• Execution payload storage is in {operation} maintenance, not
• Execution transaction {} requires an unavailable payload key
• Execution payload rewrap context does not match this databas
• Configured active payload key does not match the database ac

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/df71a9ab2c94d2a9. Report an issue: GitHub.