Policy attestations are generated using HMAC-SHA256 with an enclave secret (INTERNAL_POLICY_HMAC_SECRET). The canonical payload hashes the mandateId, executionId, rfqId, sellToken, buyToken, takerPays, buyAmount, and nonce. If any byte of the transaction is modified, the attestation becomes invalid.
Attestation & Replay Protection
HMAC-SHA256 policy tokens and cryptographic nonce binding.