{"record":{"id":"9c503f7a5524ac1f","repo":"hyperledger/fabric","slug":"instantiation-policy-mismatch-for-cc-s","errorCode":null,"errorMessage":"Instantiation policy mismatch for cc %s","messagePattern":"Instantiation policy mismatch for cc (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/scc/lscc/lscc.go","lineNumber":248,"sourceCode":"\t\t\tls.PackageCache.ValidatedPackages[ccid] = fsData\n\t\t}\n\t}\n\n\t// we have the info from the fs, check that the policy\n\t// matches the one on the file system if one was specified;\n\t// this check is required because the admin of this peer\n\t// might have specified instantiation policies for their\n\t// chaincode, for example to make sure that the chaincode\n\t// is only instantiated on certain channels; a malicious\n\t// peer on the other hand might have created a deploy\n\t// transaction that attempts to bypass the instantiation\n\t// policy. This check is there to ensure that this will not\n\t// happen, i.e. that the peer will refuse to invoke the\n\t// chaincode under these conditions. More info on\n\t// https://jira.hyperledger.org/browse/FAB-3156\n\tif fsData.InstantiationPolicy != nil {\n\t\tif !bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy) {\n\t\t\treturn fmt.Errorf(\"Instantiation policy mismatch for cc %s\", cd.ChaincodeID())\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (lscc *SCC) ChaincodeEndorsementInfo(channelID, chaincodeName string, qe ledger.SimpleQueryExecutor) (*lifecycle.ChaincodeEndorsementInfo, error) {\n\tchaincodeDataBytes, err := qe.GetState(\"lscc\", chaincodeName)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"could not retrieve state for chaincode %s\", chaincodeName)\n\t}\n\n\tif chaincodeDataBytes == nil {\n\t\treturn nil, errors.Errorf(\"chaincode %s not found\", chaincodeName)\n\t}\n\n\tchaincodeData := &ccprovider.ChaincodeData{}\n\terr = proto.Unmarshal(chaincodeDataBytes, chaincodeData)","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/scc/lscc/lscc.go#L230-L266","documentation":"SecurityCheckLegacyChaincode raises this when the InstantiationPolicy bytes stored in the filesystem chaincode data (fsData) do not match the InstantiationPolicy in the chaincode definition (cd) being checked. Fabric guards (FAB-3156) against invoking a chaincode whose stored instantiation policy differs from the current definition, which could otherwise let a differently-authorized definition be used.","triggerScenarios":"Calling ChaincodeEndorsementInfo for a legacy chaincode where bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy) is false — the packaged chaincode on disk was deployed under a different instantiation policy than the current lscc definition.","commonSituations":"Re-deploying/re-installing a chaincode with a modified instantiation policy after an upgrade; stale filesystem chaincode packages left from a previous deploy; environment changes where the definition in lscc was updated but the old package (or vice versa) persists.","solutions":["Re-deploy the chaincode so the package and the lscc definition carry the identical instantiation policy","If the definition changed intentionally, upgrade the chaincode so fsData is refreshed to match","Compare the policy bytes on disk vs the definition to find the mismatch (signature policy vs policy byte differences)","Remove stale legacy chaincode packages and reinstall/redefine cleanly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Go: compare stored instantiation policies before calling endorsement info\nfsData, err := ccprovider.GetChaincodeDataFromLscc(fsName)\nif err != nil { return err }\ncd, err := ccprovider.GetChaincodeDefinition(channelID, chaincodeName, qe)\nif err != nil { return err }\nif fsData.InstantiationPolicy != nil && !bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy()) {\n    return fmt.Errorf(\"policies differ for %s; redeploy/upgrade required\", chaincodeName)\n}","typeGuard":null,"tryCatchPattern":"// Go\n_, err := lscc.ChaincodeEndorsementInfo(channelID, chaincodeName, qe)\nif err != nil {\n    if strings.Contains(err.Error(), \"Instantiation policy mismatch\") {\n        return fmt.Errorf(\"chaincode %s package/definition policy out of sync; upgrade the chaincode\", chaincodeName)\n    }\n    return err\n}","preventionTips":["Never change a chaincode's instantiation policy without a full upgrade/redeploy","Clean up stale legacy (filesystem) chaincode packages after upgrades","Keep installed package metadata and lscc definitions in sync","Audit policy bytes on disk vs ledger when migrating legacy chaincodes"],"tags":["hyperledger-fabric","instantiation-policy","lscc","security"],"backgroundTag":"policy-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}