Contract and on-chain reverts
These revert the transaction. Nothing moves; the EIP-3009 nonce is not consumed (except a genuine replay, where the nonce was already spent).| Revert | Origin | Meaning | How to fix |
|---|---|---|---|
FeeTooHigh() | CapabilityBroker | order.feeBps > 10000. | Set feeBps at most 10000. |
ReentrancyGuardReentrantCall() | CapabilityBroker | A reentrant call into the broker mid-settlement. | An adapter must not re-enter the broker; keep checks-effects-interactions. |
SafeERC20FailedOperation(address) | CapabilityBroker | A payout transfer failed. | Check the payToken and balances. |
| invalid signature | TestUSDC (EIP-3009) | The recovered signer is not order.consumer. Any tampered order field changes the orderHash and breaks the signature. | Submit the order exactly as signed; recompute the encoding. |
| authorization expired | TestUSDC (EIP-3009) | block.timestamp > validBefore. | Re-sign with a fresh window. |
| authorization used | TestUSDC (EIP-3009) | The orderHash nonce was already spent (replay). | Build a new order (a fresh order.nonce salt). |
AllocationSoldOut(uint256 vaultId) | AllocationAdapter | The vault has no remaining slots (or is unconfigured). | Pick an open vault, or ask the provider to raise the cap. |
NoLaneControl() | TimeboostAdapter | The laneOperator does not control the current express-lane round. | Retry when the operator holds the round. |
NotBroker() | any adapter | grant was called by something other than the broker. | Only the broker calls grant; route through brokerCapability. |
BadAttestation() | AttestedAdapter | The attestation signer is not the configured attestor. | Obtain a valid attestation from the provider’s attestor. |
AttestationExpired() | AttestedAdapter | block.timestamp > notAfter. | Request a fresh attestation. |
ZeroAddress() | any adapter | A required address argument was zero (construction or admin). | Pass a non-zero address. |
Relayer wire codes
The relayer returns{ ok: false, code, message } (no key or signature material) with the HTTP status below. These come from RelayErrorCode and RELAY_ERROR_STATUS in @caplane/shared.
| Code | HTTP | Meaning | How to fix |
|---|---|---|---|
MALFORMED_ORDER | 400 | The request body failed validation. | Check field types (feeBps is a uint16; amount and nonce are decimal strings). |
ORDERHASH_MISMATCH | 400 | The client orderHash does not match the relayer’s recomputed hash. | Re-encode the order. See Order encoding. |
FEE_BELOW_FLOOR | 402 | order.feeBps is under this relayer’s floor. | Raise feeBps, or pick a relayer with a lower floor (GET /info). |
WOULD_REVERT | 422 | Pre-simulation shows the order would revert on-chain. | Fix the inputs (fund the key, pick an open vault). |
AUTH_EXPIRED | 422 | The signed window has passed. | Re-sign with a fresh window. |
INSUFFICIENT_RELAYER_GAS | 503 | The relayer is low on gas. | Try another relayer, or run your own. |
UPSTREAM_RPC | 502 | The relayer’s RPC failed. | Retry, or try another relayer. |
SubmitError("BAD_RESPONSE").
Hardened-edge codes
A public relayer may run the opt-in hardened edge. Its rejections use a separateEdgeErrorCode union, so the audited settlement taxonomy above stays clean.
| Code | HTTP | Meaning | How to fix |
|---|---|---|---|
RATE_LIMITED | 429 | Per-IP rate limit exceeded. | Wait for the Retry-After delay. |
SERVER_BUSY | 429 | The relayer is at its concurrency cap. | Retry shortly, or use another relayer. |
INSUFFICIENT_RELAYER_GAS | 503 | The relayer key’s balance is below its gas floor; POST /broker is paused. | Try another relayer, or run your own. (Reuses the settlement code so handling stays uniform.) |
See also
- Relayer API: the wire shapes these codes accompany.
- The binding and security: why a tampered order reverts at the token.