Invalid
Exception thrown when the challenge transaction doesn't have exactly one signature.
SEP-10 Security Requirement: When validating an unsigned challenge from the server, it MUST contain exactly 1 signature - the server's signature.
This validation ensures:
The server has signed the challenge (proving authenticity)
No client signatures are present yet (preventing pre-signed challenges)
No extra signatures from unknown parties
Challenge signature lifecycle:
Server generates challenge and signs it (1 signature)
Client validates challenge has exactly 1 signature (this check)
Client adds their signature(s) (1 + n signatures)
Client submits to server with all signatures
Attack scenarios prevented:
0 signatures: Unsigned challenge could be from anyone (no server authentication)
2+ signatures: Extra signatures could indicate tampering or pre-signed challenges
Note: This validation applies to the challenge BEFORE client signing. After signing, the transaction will have 1 + n signatures (server + client signers).
Parameters
The actual number of signatures found