[BUG] Pre-prod: malformed gateway-crawler /search traffic since 17-Jul (corrupted city codes, signature/body mismatch); gateway 401-NACKs on_search replies to its own crawler searches

[nandal]

Network Participant

• subscriber_id: ondc.16ane.com (Seller NP / BPP, MSN)
• Environment: Pre-production
• ukId: dd1248a6-4d88-40a9-ab3d-58b84529bb33
• Domains: ONDC:RET11, ONDC:RET12, ONDC:RET18 (city *), status SUBSCRIBED
• Related earlier ticket: ONWGR-008563

Summary

Since 2026-07-17 ~14:15 IST our BPP endpoint (https://ondc.16ane.com) receives a continuous stream of /search requests whose context.bap_id / bap_uri are the gateways themselves (pre-prod.gcr.ondc.org and qa-gcr.ondc.org), core_version 1.2.0, cycling through our subscribed domains × per-city codes, roughly one request every 1–3 minutes, ongoing.

Three problems with this traffic:

1. Malformed city codes

Many requests carry corrupted context.city values that are not valid std codes, e.g. std:01onal2, std:01onal3, std:01onal11. This looks like a templating bug in whatever generates these searches.

2. Signature does not verify against the body

A large share of these requests fail Ed25519 verification against the sender's registry signing key (BLAKE-512 digest mismatch) — consistent with the body being modified (city substituted) after signing. We NACK these with 401 per spec. Byte-exact requests from the same senders verify fine, so our verification pipeline is not the issue.

3. Our /on_search replies to the verifiable ones are rejected

• Replies to https://pre-prod.gcr.ondc.org/on_search get:

  {"error":{"code":"401","message":"Invalid Signature","type":"HTTP-ERROR"},"message":{"ack":{"status":"NACK"}}}

  even though the same signed pipeline is accepted by (a) the registry's signed /v2.0/lookup and (b) the pre-prod gateway itself for its regular city:"*" crawls (most recently ACKed 2026-07-22 08:01 IST). Only the per-city crawler searches are affected, so this looks like the gateway failing to correlate/validate its own crawler transactions rather than an actual signature problem.
• Replies to https://qa-gcr.ondc.org receive a plain nginx 403 Forbidden — expected, since we are not a QA-env participant; but then the QA gateway should not be crawling a pre-prod-only NP at all.

Sample transactions (full raw payloads retained; available on request)

transaction_id	domain	city	timestamp	bap_id	result
6862ffba-3dd5-4c3c-9726-db2178592e5d	ONDC:RET11	std:02359	2026-07-22T06:34:17.500Z	pre-prod.gcr.ondc.org	our on_search NACKed 401
0086f315-3e37-49d4-84b6-b93ad03f0171	ONDC:RET18	std:01onal3 (malformed)	2026-07-22T06:32:32.987Z	pre-prod.gcr.ondc.org	inbound sig mismatch

Requests

1. Please confirm whether this per-city crawl is an official ONDC pre-prod process, and if so fix (a) the malformed city codes, (b) the signature/body mismatch, and (c) the gateway-side rejection of on_search replies to its own crawler searches.
2. Please stop the QA gateway (qa-gcr.ondc.org) from crawling pre-prod-only participants, or advise if we are expected to subscribe on QA.
3. If this traffic is not ONDC-originated, please treat this as a report of spoofed/replayed gateway traffic on the pre-prod network.