Limits and errors — Trust Stack Docs

Trust Stack validates user-facing bounds before the wallet opens. The Move modules repeat critical checks because the chain—not the browser—is the security boundary.

Common limits#

Input	Bound	Enforced by
Token name	32 UTF-8 bytes	SDK
Token symbol	1–10 letters or numbers	SDK
Token decimals	0–18	SDK
Token icon/project URI	512 bytes; `https://` or `ipfs://`	SDK
Token maximum supply	lifetime minted supply, including burned units, never exceeds it	MoveRev. 6
Multi-send recipients	1–100 unique addresses per transaction	Move
Merkle root/node	exactly 32 bytes	Move
Merkle proof depth	at most 64 nodes	Move
Merkle campaign seed	at most 64 bytes	Move
Vesting steps	at most 10,000	Move
Schedule horizon	unlock, start, end, and reclaim times at most 3,153,600,000 seconds (about 100 years) after chain time	Move
Fee caps	token creation 25,000 SUPRA; fixed lock 10,000 SUPRA; vesting 100 bps (1%)	Move
Governance delay	at least 172,800 seconds (48 hours) outside test chains 6 and 4	MoveRev. 6
Proposal acceptance window	1,209,600 seconds (14 days, inclusive) after the effective time	MoveRev. 6
Digital Asset media	at most 5 MiB per file (the API upload limit); PNG, JPEG, GIF, WebP, GLB, or glTF	API
On-chain token amounts	positive integer base units that fit `u64`	SDKMove
Addresses	canonicalizable, non-zero where ownership is assigned	SDKMove

The revision-6 testnet package was initialized with 300-second governance delays, shortened for testing; chain 6 is allow-listed below the 48-hour floor. Mainnet payloads use 604,800 seconds (7 days).

Reading an abort#

Abort codes are module-local. Always interpret the code together with the package address and module name. The VM status shows the reason combined with a Move error category, for example 0x30009 is category 0x3 (invalid state) with reason 9, and 0x50005 is category 0x5 (permission denied) with reason 5. The tables list the reason.

Decode an abort code#

VM status codeModule

Category0x3INVALID_STATE

Reason5module-local

ConstantELOCKEDthe unlock time has not been reached

Hex or decimal. Runs in your browser; nothing is sent anywhere.

Core package abort codes#

Codes are identical across revisions unless marked. Codes marked rev. 6 exist only in the active revision-6 package, not in the retained claim-only revision-5 package or earlier revisions.

`token_factory`#

13 codes1 new in rev. 6Core package

Code	Name	Meaning
1	`EZERO_SUPPLY`	initial supply is zero
2	`EMAXIMUM_BELOW_INITIAL`	maximum supply is below the initial supply
3	`EINVALID_FIXED_SUPPLY`	a fixed-supply token has a maximum different from its initial supply
4	`ENOT_CREATOR`	the signer is not the token controller
5	`EMINT_DISABLED`	minting is disabled for this token
6	`EBURN_DISABLED`	burning is disabled for this token
7	`EZERO_RECIPIENT`	the recipient is the zero address
8	`EZERO_CONTROLLER`	a proposed controller is the zero address
9	`ESAME_CONTROLLER`	the proposed controller is the current controller
10	`EPENDING_CONTROLLER`	a controller rotation is already pending
11	`ENO_PENDING_CONTROLLER`	no controller rotation is pending
12	`ENOT_PENDING_CONTROLLER`	the signer is not the pending controller
13	`EMAXIMUM_SUPPLY_EXCEEDED`	the mint would take lifetime minted supply above the maximum Rev. 6

`fixed_lock`#

9 codesCore package

Code	Name	Meaning
1	`EZERO_AMOUNT`	the amount is zero
2	`EUNLOCK_NOT_FUTURE`	the unlock time is not in the future
3	`EZERO_BENEFICIARY`	the beneficiary is the zero address
4	`ENOT_BENEFICIARY`	the signer is not the beneficiary
5	`ELOCKED`	the unlock time has not been reached
6	`EALREADY_CLAIMED`	the lock was already claimed
7	`EDISPATCHABLE_ASSET`	the asset is a dispatchable Fungible Asset
8	`ENO_SURPLUS`	the vault holds no surplus above the recorded amount
9	`ESCHEDULE_TOO_FAR`	the unlock time exceeds the schedule horizon

`vesting`#

15 codesCore package

Code	Name	Meaning
1	`EZERO_AMOUNT`	the amount is zero
2	`EZERO_BENEFICIARY`	the beneficiary is the zero address
3	`EINVALID_CURVE`	the curve is not cliff, linear, or stepped
4	`EINVALID_SCHEDULE`	the start is not in the future, or start, cliff, and end are out of order for the curve
5	`EINVALID_STEPS`	the step count does not fit the curve: 1 for cliff, 0 for linear, 2–10,000 for stepped
6	`ENOT_BENEFICIARY`	the signer is not the beneficiary
7	`ENOTHING_TO_CLAIM`	nothing is currently claimable
8	`EDISPATCHABLE_ASSET`	the asset is a dispatchable Fungible Asset
9	`ENO_FEE_TO_SWEEP`	no accrued vesting fee is waiting to be swept
10	`ENO_SURPLUS`	the vault holds no surplus
11	`ESCHEDULE_TOO_FAR`	the schedule exceeds the horizon
12	`ENOT_CREATOR`	the signer is not the creator
13	`ENOT_REVOCABLE`	the schedule was created irrevocable
14	`EALREADY_REVOKED`	the schedule was already revoked
15	`ENOTHING_TO_REVOKE`	no unvested amount remains to revoke

`batch_distribution`#

8 codesCore package

Code	Name	Meaning
1	`EEMPTY_BATCH`	no recipients
2	`ELENGTH_MISMATCH`	recipient and amount lists differ in length
3	`EBATCH_TOO_LARGE`	more than 100 recipients
4	`EZERO_RECIPIENT`	a recipient is the zero address
5	`EZERO_AMOUNT`	an amount is zero
6	`EDUPLICATE_RECIPIENT`	a recipient appears more than once
7	`ETOTAL_OVERFLOW`	the total overflows `u64`
8	`EDISPATCHABLE_ASSET`	the asset is a dispatchable Fungible Asset

`merkle_airdrop`#

16 codesCore package

Code	Name	Meaning
1	`EZERO_AMOUNT`	the funding or claim amount is zero
2	`EINVALID_ROOT`	the root is not 32 bytes
3	`EINVALID_SEED`	the campaign seed is empty or longer than 64 bytes
4	`ESTART_IN_PAST`	the claim start is in the past
5	`EINVALID_END`	the claim end is not after the claim start
6	`EINVALID_RECLAIM`	the reclaim time is not after the claim end
7	`EDISPATCHABLE_ASSET`	the asset is a dispatchable Fungible Asset
8	`EPROOF_TOO_LONG`	the proof has more than 64 nodes
9	`EINVALID_PROOF_NODE`	a proof node is not 32 bytes
10	`ECLAIM_NOT_ACTIVE`	the claim window is not open
11	`EALREADY_CLAIMED`	the allocation was already claimed
12	`EINVALID_PROOF`	the proof does not match the root
13	`EALLOCATION_EXCEEDS_REMAINING`	the allocation exceeds the remaining campaign balance
14	`EALREADY_RECLAIMED`	a repeated reclaim found an empty vault (see below)
15	`ERECLAIM_NOT_ACTIVE`	the reclaim time has not been reached
16	`ESCHEDULE_TOO_FAR`	a campaign time exceeds the schedule horizon

In revision 6, a later reclaim sweeps any balance deposited after the first reclaim to the creator and aborts with EALREADY_RECLAIMED only when the vault is empty.

`digital_asset_factory`#

5 codesCore package

Code	Name	Meaning
1	`EZERO_RECIPIENT`	the recipient is the zero address
2	`EEMPTY_ASSET_NAME`	the asset name is empty
3	`EEMPTY_COLLECTION_NAME`	the collection name is empty
4	`EEMPTY_METADATA_URI`	the metadata URI is empty
5	`EOWNER_MISMATCH`	the minted asset is not owned by the recipient

`digital_asset_lock`#

10 codesCore package

Code	Name	Meaning
1	`EUNLOCK_NOT_FUTURE`	the unlock time is not in the future
2	`EZERO_BENEFICIARY`	the beneficiary is the zero address
3	`ENOT_OWNER`	the signer does not own the Digital Asset
4	`ENOT_BENEFICIARY`	the signer is not the beneficiary
5	`ELOCKED`	the unlock time has not been reached
6	`EALREADY_CLAIMED`	the lock was already claimed
7	`ENOT_TRANSFERABLE`	ungated transfer is disabled for the Digital Asset
8	`ECUSTODY_LOST`	the lock no longer owns the Digital Asset
9	`EUNVERIFIED_ASSET`	the Digital Asset was not created by the Trust Stack Digital Asset factory
10	`ESCHEDULE_TOO_FAR`	the unlock time exceeds the schedule horizon

`payment_stream`#

12 codesCore package

Code	Name	Meaning
1	`EZERO_AMOUNT`	the amount is zero
2	`EZERO_BENEFICIARY`	the beneficiary is the zero address
3	`EINVALID_SCHEDULE`	the start is not in the future or the end is not after the start
4	`ENOT_BENEFICIARY`	the signer is not the beneficiary
5	`ENOTHING_TO_CLAIM`	nothing has accrued since the last claim
6	`ENOT_CREATOR`	the signer is not the creator
7	`ENOT_CANCELABLE`	the stream was created non-cancelable
8	`EALREADY_CANCELED`	the stream was already canceled
9	`ESTREAM_COMPLETED`	the end time has passed, so the stream can no longer be canceled
10	`EDISPATCHABLE_ASSET`	the asset is a dispatchable Fungible Asset
11	`ENO_SURPLUS`	the vault holds no surplus
12	`ESCHEDULE_TOO_FAR`	the end time exceeds the schedule horizon

`staking_pool`#

13 codesCore package

Code 5 and code 10 are not used.

Code	Name	Meaning
1	`EZERO_AMOUNT`	the amount is zero
2	`EINVALID_SCHEDULE`	the start is not in the future or the end is not after the start
3	`EDISPATCHABLE_ASSET`	a stake or reward asset is a dispatchable Fungible Asset
4	`EZERO_ADDRESS`	the creator address is the zero address
6	`EPOOL_ENDED`	the pool reward period has ended
7	`ENOT_CREATOR`	the signer is not the pool creator
8	`ENOT_STAKER`	the signer does not own the staking position
9	`EALREADY_WITHDRAWN`	the position was already withdrawn
11	`ENOTHING_TO_CLAIM`	no reward is claimable
12	`EPOOL_ACTIVE`	the pool reward period has not ended
13	`EREWARD_INSOLVENT`	the reward vault cannot cover its protected reserve during recovery
14	`ENO_SURPLUS`	no surplus is available to recover
15	`ESCHEDULE_TOO_FAR`	the reward schedule exceeds the horizon

In revision 6, withdraw always returns principal: an unbacked settled reward is forfeited rather than aborting the withdrawal.

`fee_config`#

22 codes2 new in rev. 6Core package

Code 16 is not used.

Code	Name	Meaning
1	`ENOT_BOOTSTRAP_AUTHORITY`	the signer is not the recorded bootstrap authority
2	`EALREADY_INITIALIZED`	fee configuration already exists
3	`ENOT_INITIALIZED`	fee configuration does not exist
4	`EZERO_ROLE`	a role address is the zero address
5	`ENOT_GOVERNOR`	the signer is not the fee governor
6	`ENOT_TREASURY_ADMIN`	the signer is not the treasury administrator
7	`ENOT_PENDING_ROLE`	the signer is not the pending role holder
8	`EFEE_ABOVE_CAP`	a fee exceeds its immutable cap
9	`ECHANGE_NOT_EFFECTIVE`	the effective time has not been reached
10	`EPENDING_CHANGE`	a change is already pending
11	`ENO_PENDING_CHANGE`	no change is pending
12	`ERENOUNCED`	fee governance was renounced
13	`ERENOUNCE_NOT_EFFECTIVE`	the renunciation delay has not elapsed
14	`ENO_PENDING_RENOUNCE`	no renunciation is pending
15	`EFEE_EXCEEDS_SIGNED_MAXIMUM`	the live fee exceeds the maximum fee signed by the user
17	`ESAME_ROLE`	the proposed role holder is the current holder
18	`ECOLLECTOR_CANNOT_RECEIVE`	the collector has no registered SUPRA coin store
19	`ETERMINAL_SCHEDULE_MISMATCH`	the signed terminal schedule differs from the live schedule
20	`EIMMEDIATE_SCHEDULE_DISABLED`	direct `set_schedule` is disabled because the schedule delay is nonzero
21	`EDELAY_TOO_LARGE`	a governance delay exceeds the schedule horizon
22	`EDELAY_BELOW_PRODUCTION_MINIMUM`	a governance delay below 48 hours outside a test chain Rev. 6
23	`EPROPOSAL_EXPIRED`	a matured proposal executed more than 14 days after its effective time Rev. 6

`asset_policy`#

21 codes3 new in rev. 6Core package

Code	Name	Meaning
1	`ENOT_BOOTSTRAP_AUTHORITY`	the signer is not the recorded bootstrap authority
2	`EALREADY_INITIALIZED`	the asset policy already exists
3	`ENOT_INITIALIZED`	the asset policy does not exist
4	`EZERO_ROLE`	the council address is the zero address
5	`ENOT_COUNCIL`	the signer is not the asset-policy council
6	`EINVALID_METADATA`	the address is zero or not a Fungible Asset metadata object
7	`EPENDING_CHANGE`	a change is already pending
8	`ENO_PENDING_CHANGE`	no change is pending
9	`ECHANGE_NOT_EFFECTIVE`	the effective time has not been reached
10	`EINVALID_EVIDENCE`	the evidence digest is not 32 bytes
11	`EASSET_NOT_ADMITTED`	the asset has no active admission
12	`ESAME_ROLE`	the proposed council is the current council
13	`ENOT_PENDING_COUNCIL`	the signer is not the pending council
14	`EINVALID_RISK_CLASS`	the risk class is not recognised
15	`EINVALID_POLICY_VERSION`	the policy version is zero
16	`EFACTORY_ASSET`	the asset was created by the Trust Stack token factory and cannot be admitted
17	`ESCHEDULE_TOO_FAR`	the effective time exceeds the schedule horizon
18	`EDELAY_TOO_LARGE`	a policy delay exceeds the schedule horizon
19	`EDELAY_BELOW_PRODUCTION_MINIMUM`	a policy delay below 48 hours outside a test chain Rev. 6
20	`EPROPOSAL_EXPIRED`	a council rotation or admission executed after its 14-day window Rev. 6
21	`ESTALE_COUNCIL_PROPOSAL`	an admission proposed by a council that has since rotated Rev. 6

Dexlyn adapter abort codes#

The separately published dexlyn_lp_lock adapter has its own codes.

8 codesDexlyn adapter

Code	Name	Meaning
1	`EZERO_AMOUNT`	the LP amount is zero
2	`EZERO_BENEFICIARY`	the beneficiary is the zero address
3	`EINVALID_UNLOCK_TIME`	the unlock time is not in the future
4	`EPOOL_NOT_REGISTERED`	the LP type has no registered Dexlyn pool
5	`ENOT_BENEFICIARY`	the signer is not the beneficiary
6	`ENOT_UNLOCKED`	the unlock time has not been reached
7	`EALREADY_CLAIMED`	the lock was already claimed
8	`ESCHEDULE_TOO_FAR`	the unlock time exceeds the schedule horizon

Handling a failure#

Preserve the transaction hash if one exists.
Read the VM status and exact module/code in SupraScan.
Re-read the current object and vault state.
Correct the input or lifecycle condition only after determining whether the prior transaction finalized.
Do not retry a claim solely because the UI lost its response.

The TypeScript client converts known validation failures into field-level guidance before signing. Unexpected execution failures retain the transaction hash for investigation.

Common limits#

Reading an abort#

Decode an abort code#

Core package abort codes#

token_factory#

fixed_lock#

vesting#

batch_distribution#

merkle_airdrop#

digital_asset_factory#

digital_asset_lock#

payment_stream#

staking_pool#

fee_config#

asset_policy#