{"record":{"id":"744bbeae4b53b2a2","repo":"hyperledger/fabric","slug":"invalid-mod-policy-for-element-s","errorCode":null,"errorMessage":"invalid mod_policy for element %s","messagePattern":"invalid mod_policy for element (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/configtx/update.go","lineNumber":76,"sourceCode":"\n\tfor i, pathElement := range strings.Split(trimmed, pathSeparator) {\n\t\terr := validateConfigID(pathElement)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"path element at %d is invalid\", i)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (vi *ValidatorImpl) verifyDeltaSet(deltaSet map[string]comparable, signedData []*protoutil.SignedData) error {\n\tif len(deltaSet) == 0 {\n\t\treturn errors.Errorf(\"delta set was empty -- update would have no effect\")\n\t}\n\n\tfor key, value := range deltaSet {\n\t\tlogger.Debugf(\"Processing change to key: %s\", key)\n\t\tif err := validateModPolicy(value.modPolicy()); err != nil {\n\t\t\treturn errors.Wrapf(err, \"invalid mod_policy for element %s\", key)\n\t\t}\n\n\t\texisting, ok := vi.configMap[key]\n\t\tif !ok {\n\t\t\tif value.version() != 0 {\n\t\t\t\treturn errors.Errorf(\"attempted to set key %s to version %d, but key does not exist\", key, value.version())\n\t\t\t}\n\n\t\t\tcontinue\n\t\t}\n\t\tif value.version() != existing.version()+1 {\n\t\t\treturn errors.Errorf(\"attempt to set key %s to version %d, but key is at version %d\", key, value.version(), existing.version())\n\t\t}\n\n\t\tpolicy, ok := vi.policyForItem(existing)\n\t\tif !ok {\n\t\t\treturn errors.Errorf(\"unexpected missing policy %s for item %s\", existing.modPolicy(), key)\n\t\t}","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/configtx/update.go#L58-L94","documentation":"When processing each delta entry, its mod_policy is validated via validateModPolicy. This wrapped error means one of the changed elements has a missing or malformed mod_policy; see errors 144/145 for the inner causes.","triggerScenarios":"Submitting a ConfigUpdate whose delta set contains an element with an empty or syntactically invalid mod_policy string.","commonSituations":"Hand-crafted delta sets missing ModPolicy; SDK versions or tooling that don't populate ModPolicy on modified elements.","solutions":["Set a valid ModPolicy (e.g. 'Admins') on every modified element in the write set.","Fix path syntax issues (empty segments, invalid characters) in the mod_policy.","Validate the delta set with validateModPolicy-equivalent checks client-side before submission."],"exampleFix":"// before\ndelta[\"/Channel/Application/Org4\"] = comparable{ConfigGroup: &cb.ConfigGroup{}} // no ModPolicy\n// after\ndelta[\"/Channel/Application/Org4\"] = comparable{ConfigGroup: &cb.ConfigGroup{ModPolicy: \"Admins\"}}","handlingStrategy":"validation","validationCode":"for key, value := range deltaSet {\n  if err := validateModPolicy(value.modPolicy()); err != nil {\n    return fmt.Errorf(\"element %s: %w\", key, err)\n  }\n}","typeGuard":"func deltaModPolicyOK(value comparable) bool { return validateModPolicy(value.modPolicy()) == nil }","tryCatchPattern":"err := validator.ProposeUpdate(env)\nif err != nil && strings.Contains(err.Error(), \"invalid mod_policy for element\") {\n  var key string\n  fmt.Sscanf(err.Error(), \"invalid mod_policy for element %s\", &key)\n  return fmt.Errorf(\"repair ModPolicy on %s and resubmit\", key)\n}","preventionTips":["Validate every delta element's mod_policy client-side before submission","Populate ModPolicy centrally in your config-building code","Run the update against a local validator in CI to catch this before ordering"],"tags":["hyperledger-fabric","configtx","mod-policy"],"backgroundTag":"mod-policy-not-set","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}