{"record":{"id":"aebef47b870fd327","repo":"hyperledger/fabric","slug":"lscc-invocation-is-attempting-to-write-to-namespac-aebef4","errorCode":null,"errorMessage":"LSCC invocation is attempting to write to namespace %s","messagePattern":"LSCC invocation is attempting to write to namespace (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v13/lscc_validation_logic.go","lineNumber":484,"sourceCode":"\t\t}\n\t\t// the value must be a ChaincodeData struct\n\t\tcdRWSet := &ccprovider.ChaincodeData{}\n\t\terr = proto.Unmarshal(lsccrwset.Writes[0].Value, cdRWSet)\n\t\tif err != nil {\n\t\t\treturn policyErr(fmt.Errorf(\"unmarshalling of ChaincodeData failed, error %s\", err))\n\t\t}\n\t\t// the chaincode name in the lsccwriteset must match the chaincode name in the deployment spec\n\t\tif cdRWSet.Name != cdsArgs.ChaincodeSpec.ChaincodeId.Name {\n\t\t\treturn policyErr(fmt.Errorf(\"expected cc name %s, found %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Name, cdRWSet.Name))\n\t\t}\n\t\t// the chaincode version in the lsccwriteset must match the chaincode version in the deployment spec\n\t\tif cdRWSet.Version != cdsArgs.ChaincodeSpec.ChaincodeId.Version {\n\t\t\treturn policyErr(fmt.Errorf(\"expected cc version %s, found %s\", cdsArgs.ChaincodeSpec.ChaincodeId.Version, cdRWSet.Version))\n\t\t}\n\t\t// it must only write to 2 namespaces: LSCC's and the cc that we are deploying/upgrading\n\t\tfor _, ns := range txRWSet.NsRwSets {\n\t\t\tif ns.NameSpace != \"lscc\" && ns.NameSpace != cdRWSet.Name && len(ns.KvRwSet.Writes) > 0 {\n\t\t\t\treturn policyErr(fmt.Errorf(\"LSCC invocation is attempting to write to namespace %s\", ns.NameSpace))\n\t\t\t}\n\t\t}\n\n\t\tlogger.Debugf(\"Validating %s for cc %s version %s\", lsccFunc, cdRWSet.Name, cdRWSet.Version)\n\n\t\tswitch lsccFunc {\n\t\tcase lscc.DEPLOY:\n\n\t\t\t/******************************************************************/\n\t\t\t/* security check 1 - cc not in the LCCC table of instantiated cc */\n\t\t\t/******************************************************************/\n\t\t\tif ccExistsOnLedger {\n\t\t\t\treturn policyErr(fmt.Errorf(\"Chaincode %s is already instantiated\", cdsArgs.ChaincodeSpec.ChaincodeId.Name))\n\t\t\t}\n\n\t\t\t/****************************************************************************/\n\t\t\t/* security check 2 - validation of rwset (and of collections if enabled) */\n\t\t\t/****************************************************************************/","sourceCodeStart":466,"sourceCodeEnd":502,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v13/lscc_validation_logic.go#L466-L502","documentation":"An lscc deploy/upgrade transaction is only allowed to write to two namespaces: \"lscc\" itself and the namespace of the chaincode being deployed/upgraded. This error means the transaction's rwset contains writes to some other namespace, so the validator rejects the transaction as a policy violation.","triggerScenarios":"An lscc invocation whose transaction rwset includes writes to a third namespace — e.g. a chaincode's Invoke path that performs putState on other keys/namespaces during an lscc-driven deploy, or a maliciously composed rwset.","commonSituations":"Custom or modified lscc implementations writing extra state, bundling additional state changes into the same transaction as a deploy/upgrade, chaincode upgrade logic triggering writes to other chaincodes' namespaces, attempt to smuggle state changes through lifecycle transactions.","solutions":["Remove any putState/delState calls to namespaces other than lscc and the target chaincode from the lscc transaction path.","Perform ancillary state updates in separate transactions, not in the same deploy/upgrade transaction.","If running a patched lscc, review the patch — stock Fabric lscc never writes to other namespaces.","Inspect the transaction rwset (e.g. with the SDK) to identify which extra namespace was written."],"exampleFix":"// before: same tx writes other cc state\nstub.PutState(\"othercc~key\", val) // during upgrade tx\n// after: separate transaction\n// emit an event and do the other putState in a dedicated invoke","handlingStrategy":"validation","validationCode":"// pre-flight: inspect the rwset namespaces before submit\nfor _, ns := range txRWSet.NsRwSets {\n    if ns.NameSpace != \"lscc\" && ns.NameSpace != targetCC && len(ns.KvRwSet.Writes) > 0 {\n        return fmt.Errorf(\"illegal write to namespace %s in lscc tx\", ns.NameSpace)\n    }\n}","typeGuard":"func onlyAllowedNamespaces(rwset *rwset.TxRwSet, cc string) bool {\n    for _, ns := range rwset.NsRwSets {\n        if ns.NameSpace != \"lscc\" && ns.NameSpace != cc && len(ns.KvRwSet.Writes) > 0 { return false }\n    }\n    return true\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"attempting to write to namespace\") { /* split the offending write into its own transaction */ }","preventionTips":["Keep deploy/upgrade transactions free of unrelated state writes","Use events or separate transactions for ancillary updates","Audit any patched lscc for extra putState calls"],"tags":["hyperledger-fabric","lscc","rwset","transaction-validation"],"backgroundTag":"unauthorized-namespace-write","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}