{"record":{"id":"6b83463aab9509bc","repo":"hyperledger/fabric","slug":"lscc-invocation-is-attempting-to-write-to-namespac","errorCode":null,"errorMessage":"LSCC invocation is attempting to write to namespace %s","messagePattern":"LSCC invocation is attempting to write to namespace (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v12/validation_logic.go","lineNumber":626,"sourceCode":"\t\t}\n\t\t// the value must be a ChaincodeData struct\n\t\tcdRWSet := &ccprovider.ChaincodeData{}\n\t\terr = proto.Unmarshal(lsccrwset.Writes[0].Value, cdRWSet)\n\t\tif err != nil {\n\t\t\treturn policyErr(fmt.Errorf(\"unmarshalling of ChaincodeData failed, error %s\", err))\n\t\t}\n\t\t// the chaincode name in the lsccwriteset must match the chaincode name in the deployment spec\n\t\tif cdRWSet.Name != cdsArgs.ChaincodeSpec.ChaincodeId.Name {\n\t\t\treturn policyErr(fmt.Errorf(\"expected cc name %s, found %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Name, cdRWSet.Name))\n\t\t}\n\t\t// the chaincode version in the lsccwriteset must match the chaincode version in the deployment spec\n\t\tif cdRWSet.Version != cdsArgs.ChaincodeSpec.ChaincodeId.Version {\n\t\t\treturn policyErr(fmt.Errorf(\"expected cc version %s, found %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Version, cdRWSet.Version))\n\t\t}\n\t\t// it must only write to 2 namespaces: LSCC's and the cc that we are deploying/upgrading\n\t\tfor _, ns := range txRWSet.NsRwSets {\n\t\t\tif ns.NameSpace != \"lscc\" && ns.NameSpace != cdRWSet.Name && len(ns.KvRwSet.Writes) > 0 {\n\t\t\t\treturn policyErr(fmt.Errorf(\"LSCC invocation is attempting to write to namespace %s\", ns.NameSpace))\n\t\t\t}\n\t\t}\n\n\t\tlogger.Debugf(\"Validating %s for cc %s version %s\", lsccFunc, cdRWSet.Name, cdRWSet.Version)\n\n\t\tswitch lsccFunc {\n\t\tcase lscc.DEPLOY:\n\n\t\t\t/******************************************************************/\n\t\t\t/* security check 1 - cc not in the LCCC table of instantiated cc */\n\t\t\t/******************************************************************/\n\t\t\tif ccExistsOnLedger {\n\t\t\t\treturn policyErr(fmt.Errorf(\"Chaincode %s is already instantiated\", cdsArgs.ChaincodeSpec.ChaincodeId.Name))\n\t\t\t}\n\n\t\t\t/****************************************************************************/\n\t\t\t/* security check 2 - validation of rwset (and of collections if enabled) */\n\t\t\t/****************************************************************************/","sourceCodeStart":608,"sourceCodeEnd":644,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v12/validation_logic.go#L608-L644","documentation":"An lscc deploy/upgrade transaction may only write to two namespaces: \"lscc\" itself and the chaincode being deployed/upgraded. Any other namespace with writes indicates the transaction is trying to smuggle in extra ledger mutations, so it is rejected as a policy violation.","triggerScenarios":"txRWSet contains an NsRwSet for a namespace other than lscc or cdRWSet.Name with len(KvRwSet.Writes) > 0 — e.g. the invoking chaincode wrote to another chaincode's keys during the same transaction, or the rwset was merged from multiple transactions.","commonSituations":"Chaincode implementations that call PutState into foreign namespaces during init; cross-chaincode write attempts without proper cross-chaincode calls; rwset aggregation bugs or malicious transaction crafting.","solutions":["Remove any PutState/DelState calls to other namespaces (e.g. 'lscc', other chaincode ids) from the chaincode's Init/upgrade path.","Use proper cross-chaincode invocation (InvokeChaincode) instead of direct namespace writes.","Ensure the rwset is generated from a single simulated transaction, not merged.","Audit the chaincode's init code with peer's rwset inspection before instantiating."],"exampleFix":"// before\nstub.PutState(\"othercc\", key, value) // foreign namespace write\n// after\nstub.InvokeChaincode(\"othercc\", args, channel) // proper cross-cc call","handlingStrategy":"validation","validationCode":"for _, ns := range txRWSet.NsRwSets {\n    if ns.NameSpace != \"lscc\" && ns.NameSpace != cd.Name && len(ns.KvRwSet.Writes) > 0 {\n        return fmt.Errorf(\"chaincode writes to forbidden namespace %q during lscc deploy\", ns.NameSpace)\n    }\n}","typeGuard":"func onlyAllowedNamespaces(txRWSet *rwset.TxRwSet, ccName string) bool {\n    for _, ns := range txRWSet.NsRwSets {\n        if ns.NameSpace != \"lscc\" && ns.NameSpace != ccName && len(ns.KvRwSet.Writes) > 0 {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":"if err := submitTx(envelope); err != nil {\n    if strings.Contains(err.Error(), \"attempting to write to namespace\") {\n        // remove foreign PutState calls from the chaincode Init/upgrade path and redeploy\n    }\n}","preventionTips":["Never call PutState with another chaincode's namespace prefix","Use InvokeChaincode for cross-chaincode interaction","Audit chaincode Init for stray writes before instantiating"],"tags":["hyperledger-fabric","lscc","namespace","rwset","security"],"backgroundTag":"unauthorized-namespace-write","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}