{"record":{"id":"1d222fc581e65865","repo":"hyperledger/fabric","slug":"no-instantiation-policy-was-specified","errorCode":null,"errorMessage":"no instantiation policy was specified","messagePattern":"no instantiation policy was specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v12/validation_logic.go","lineNumber":663,"sourceCode":"\t\t\tif ac.PrivateChannelData() {\n\t\t\t\t// do extra validation for collections\n\t\t\t\terr := vscc.validateRWSetAndCollection(lsccrwset, cdRWSet, lsccArgs, lsccFunc, ac, chid)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// there can only be a single ledger write\n\t\t\t\tif len(lsccrwset.Writes) != 1 {\n\t\t\t\t\treturn policyErr(fmt.Errorf(\"LSCC can only issue a single putState upon deploy\"))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t/*****************************************************/\n\t\t\t/* security check 3 - check the instantiation policy */\n\t\t\t/*****************************************************/\n\t\t\tpol := cdRWSet.InstantiationPolicy\n\t\t\tif pol == nil {\n\t\t\t\treturn policyErr(fmt.Errorf(\"no instantiation policy was specified\"))\n\t\t\t}\n\t\t\t// FIXME: could we actually pull the cds package from the\n\t\t\t// file system to verify whether the policy that is specified\n\t\t\t// here is the same as the one on disk?\n\t\t\t// PROS: we prevent attacks where the policy is replaced\n\t\t\t// CONS: this would be a point of non-determinism\n\t\t\terr := vscc.checkInstantiationPolicy(chid, env, pol, payl)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\tcase lscc.UPGRADE:\n\t\t\t/**************************************************************/\n\t\t\t/* security check 1 - cc in the LCCC table of instantiated cc */\n\t\t\t/**************************************************************/\n\t\t\tif !ccExistsOnLedger {\n\t\t\t\treturn policyErr(fmt.Errorf(\"Upgrading non-existent chaincode %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Name))\n\t\t\t}","sourceCodeStart":645,"sourceCodeEnd":681,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v12/validation_logic.go#L645-L681","documentation":"The ChaincodeData produced by lscc deploy must include an instantiation policy. If the InstantiationPolicy field is nil, the validator cannot verify who is authorized to deploy/upgrade this chaincode, so the transaction is rejected as a policy error.","triggerScenarios":"cdRWSet.InstantiationPolicy is nil after unmarshalling the lscc write — i.e. the ChaincodeData written by lscc lacks an instantiation policy, typically because it was not generated by the stock lscc deploy path.","commonSituations":"Hand-crafted or modified ChaincodeData / rwsets; running a forked lscc that omits the policy; ledger data written by an older/nonstandard tooling then validated by v12 validator.","solutions":["Deploy through the standard SDK/lscc path so an instantiation policy is automatically attached from the endorsing peers' signature policy.","Use stock lscc — do not modify ChaincodeData generation.","Rebuild the deployment proposal with a current SDK that includes the instantiation policy in the spec.","Inspect the lscc write value to confirm InstantiationPolicy is present before resubmitting."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cd := &ccprovider.ChaincodeData{}\nif err := proto.Unmarshal(ns.KvRwSet.Writes[0].Value, cd); err != nil {\n    return err\n}\nif cd.InstantiationPolicy == nil {\n    return fmt.Errorf(\"ChaincodeData lacks instantiation policy; deploy via standard lscc path\")\n}","typeGuard":"func hasInstantiationPolicy(cd *ccprovider.ChaincodeData) bool {\n    return cd != nil && cd.InstantiationPolicy != nil\n}","tryCatchPattern":"if err := submitTx(envelope); err != nil {\n    if strings.Contains(err.Error(), \"no instantiation policy was specified\") {\n        // rebuild and re-endorse the deploy proposal with a current SDK\n    }\n}","preventionTips":["Always deploy through the official SDK/instantiate flow so lscc attaches the policy","Do not hand-construct ChaincodeData or rwsets","Keep lscc unmodified and peers up to date"],"tags":["hyperledger-fabric","lscc","instantiation-policy","security"],"backgroundTag":"missing-instantiation-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}