{"record":{"id":"66b85d6e993027fe","repo":"hyperledger/fabric","slug":"vscc-error-endorsement-policy-failure-err-s","errorCode":null,"errorMessage":"VSCC error: endorsement policy failure, err: %s","messagePattern":"VSCC error: endorsement policy failure, err: (.+?)","errorType":"validation","errorClass":"VSCCEndorsementPolicyError","httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v12/validation_logic.go","lineNumber":165,"sourceCode":"\tif err != nil {\n\t\tlogger.Errorf(\"VSCC error: GetChaincodeActionPayload failed, err %s\", err)\n\t\treturn policyErr(err)\n\t}\n\n\tsignatureSet, err := vscc.deduplicateIdentity(cap)\n\tif err != nil {\n\t\treturn policyErr(err)\n\t}\n\n\t// evaluate the signature set against the policy\n\terr = vscc.policyEvaluator.Evaluate(policyBytes, signatureSet)\n\tif err != nil {\n\t\tlogger.Warningf(\"Endorsement policy failure for transaction txid=%s, err: %s\", chdr.GetTxId(), err.Error())\n\t\tif len(signatureSet) < len(cap.Action.Endorsements) {\n\t\t\t// Warning: duplicated identities exist, endorsement failure might be cause by this reason\n\t\t\treturn policyErr(errors.New(DUPLICATED_IDENTITY_ERROR))\n\t\t}\n\t\treturn policyErr(fmt.Errorf(\"VSCC error: endorsement policy failure, err: %s\", err))\n\t}\n\n\t// do some extra validation that is specific to lscc\n\tif namespace == \"lscc\" {\n\t\tlogger.Debugf(\"VSCC info: doing special validation for LSCC\")\n\t\terr := vscc.ValidateLSCCInvocation(chdr.ChannelId, env, cap, payl, vscc.capabilities)\n\t\tif err != nil {\n\t\t\tlogger.Errorf(\"VSCC error: ValidateLSCCInvocation failed, err %s\", err)\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// checkInstantiationPolicy evaluates an instantiation policy against a signed proposal.\nfunc (vscc *Validator) checkInstantiationPolicy(chainName string, env *common.Envelope, instantiationPolicy []byte, payl *common.Payload) commonerrors.TxValidationError {\n\t// get the signature header","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v12/validation_logic.go#L147-L183","documentation":"The endorsement policy evaluation against the transaction's signature set failed, so VSCC rejects the transaction and marks it invalid via policyErr. This is the generic failure branch when there are no duplicated identities — the signatures present simply do not satisfy the chaincode's endorsement policy.","triggerScenarios":"Submitting a transaction endorsed by fewer/different organizations than the endorsement policy requires; a signature that does not verify against the claimed creator identity; a mismatch between the policy referenced in the chaincode data and the channel policy actually evaluated.","commonSituations":"Chaincode endorsement policies changed after the client code was written; requests collected from peers that are not in the policy's member list; expired or rotated certificates invalidating a signature; load-testing tools that fake endorsements.","solutions":["Collect endorsements from the exact set of organizations required by the endorsement policy (peer chaincode invoke normally does this automatically)","Verify endorsing peers' certificates are valid and current (MSP, expiry, rotation)","Check the chaincode's endorsement policy definition (e.g. AND('Org1.member','Org2.member')) matches what clients can satisfy","Inspect the wrapped err in the message (VSCC error: endorsement policy failure, err: ...) for the precise evaluation failure cause"],"exampleFix":"// before\n// invoking with endorsements from Org1 only, policy requires Org1 AND Org2\nproposalTargets = [peerOrg1]\n// after\nproposalTargets = [peerOrg1Peers, peerOrg2Peers] // collect endorsements from all required orgs","handlingStrategy":"try-catch","validationCode":"// client-side: verify collected endorsements satisfy the policy before submit\nif len(collectedEndorsements) < requiredDistinctOrgs(policy) {\n    return errors.New(\"insufficient endorsements for policy, aborting submit\")\n}","typeGuard":null,"tryCatchPattern":"evt, err := notifier() // commit event\nif err != nil { return err }\nif code := evt.ValidationCode; code != int32(pb.TxValidationCode_VALID) {\n    return fmt.Errorf(\"tx %s rejected: endorsement policy failure (%v)\", evt.TxId, err)\n}","preventionTips":["Keep client SDK updated so it collects endorsements from all required orgs","Review endorsement policies after channel config changes","Monitor certificate expiry and MSP changes that break signature verification"],"tags":["go","endorsement-policy","vscc","transaction-validation"],"backgroundTag":"endorsement-policy-failure","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}