{"record":{"id":"585d3cfc0fe3145e","repo":"hyperledger/fabric","slug":"no-instantiation-policy-was-specified-585d3c","errorCode":null,"errorMessage":"no instantiation policy was specified","messagePattern":"no instantiation policy was specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v13/lscc_validation_logic.go","lineNumber":521,"sourceCode":"\t\t\tif ac.PrivateChannelData() {\n\t\t\t\t// do extra validation for collections\n\t\t\t\terr := vscc.validateRWSetAndCollection(lsccrwset, cdRWSet, lsccArgs, lsccFunc, ac, chid)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// there can only be a single ledger write\n\t\t\t\tif len(lsccrwset.Writes) != 1 {\n\t\t\t\t\treturn policyErr(fmt.Errorf(\"LSCC can only issue a single putState upon deploy\"))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t/*****************************************************/\n\t\t\t/* security check 3 - check the instantiation policy */\n\t\t\t/*****************************************************/\n\t\t\tpol := cdRWSet.InstantiationPolicy\n\t\t\tif pol == nil {\n\t\t\t\treturn policyErr(fmt.Errorf(\"no instantiation policy was specified\"))\n\t\t\t}\n\t\t\t// FIXME: could we actually pull the cds package from the\n\t\t\t// file system to verify whether the policy that is specified\n\t\t\t// here is the same as the one on disk?\n\t\t\t// PROS: we prevent attacks where the policy is replaced\n\t\t\t// CONS: this would be a point of non-determinism\n\t\t\terr := vscc.checkInstantiationPolicy(chid, env, pol, payl)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\tcase lscc.UPGRADE:\n\t\t\t/**************************************************************/\n\t\t\t/* security check 1 - cc in the LCCC table of instantiated cc */\n\t\t\t/**************************************************************/\n\t\t\tif !ccExistsOnLedger {\n\t\t\t\treturn policyErr(fmt.Errorf(\"Upgrading non-existent chaincode %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Name))\n\t\t\t}","sourceCodeStart":503,"sourceCodeEnd":539,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v13/lscc_validation_logic.go#L503-L539","documentation":"Security check 3 on deploy requires the ChaincodeData record produced by lscc to carry an InstantiationPolicy. A nil policy means the deployment record has no rule governing who may instantiate/upgrade the chaincode, so the validator rejects it rather than accepting an unprotected lifecycle record.","triggerScenarios":"A deploy transaction whose ChaincodeData has InstantiationPolicy == nil — typically from a hand-constructed ChaincodeData or a lscc variant that skipped policy generation.","commonSituations":"Custom tooling marshaling ChaincodeData without setting InstantiationPolicy, old chaincode packages built before policy fields were mandatory, test fixtures with minimal ChaincodeData structs, ledger records created by an older/patched peer.","solutions":["Deploy through the standard flow (SDK instantiate or lifecycle tooling) so lscc generates and embeds an instantiation policy.","If constructing ChaincodeData manually (tests), set InstantiationPolicy to a valid policy (e.g. SignedBy any MSP member).","Verify the chaincode package and peer versions are consistent so policy serialization is preserved.","Re-deploy the chaincode properly if the ledger record is missing its policy."],"exampleFix":"// before\ncd := &ccprovider.ChaincodeData{Name: name, Version: ver}\n// after\ncd := &ccprovider.ChaincodeData{Name: name, Version: ver, InstantiationPolicy: ipolBytes, ...}","handlingStrategy":"validation","validationCode":"// before submit: ensure an instantiation policy is present\ncd := &ccprovider.ChaincodeData{}\nproto.Unmarshal(lsccWriteValue, cd)\nif cd.InstantiationPolicy == nil {\n    return errors.New(\"ChaincodeData has no instantiation policy\")\n}","typeGuard":"func hasInstantiationPolicy(cd *ccprovider.ChaincodeData) bool { return cd != nil && cd.InstantiationPolicy != nil }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no instantiation policy\") { /* re-deploy via standard tooling so the policy is generated */ }","preventionTips":["Always deploy through the standard SDK/lifecycle flow","Set an explicit policy in instantiate requests (e.g. SignedBy MSP member)","Do not strip fields when re-serializing ChaincodeData in tests"],"tags":["hyperledger-fabric","lscc","instantiation-policy","deploy"],"backgroundTag":"missing-instantiation-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}