What causes "Instantiation policy mismatch for cc %s" in hyperledger/fabric?

Re-deploy the chaincode so the package and the lscc definition carry the identical instantiation policy

Instantiation policy mismatch for cc %s

Error message

Instantiation policy mismatch for cc %s

What it means

SecurityCheckLegacyChaincode raises this when the InstantiationPolicy bytes stored in the filesystem chaincode data (fsData) do not match the InstantiationPolicy in the chaincode definition (cd) being checked. Fabric guards (FAB-3156) against invoking a chaincode whose stored instantiation policy differs from the current definition, which could otherwise let a differently-authorized definition be used.

Source

Thrown at core/scc/lscc/lscc.go:248

			ls.PackageCache.ValidatedPackages[ccid] = fsData
		}
	}

	// we have the info from the fs, check that the policy
	// matches the one on the file system if one was specified;
	// this check is required because the admin of this peer
	// might have specified instantiation policies for their
	// chaincode, for example to make sure that the chaincode
	// is only instantiated on certain channels; a malicious
	// peer on the other hand might have created a deploy
	// transaction that attempts to bypass the instantiation
	// policy. This check is there to ensure that this will not
	// happen, i.e. that the peer will refuse to invoke the
	// chaincode under these conditions. More info on
	// https://jira.hyperledger.org/browse/FAB-3156
	if fsData.InstantiationPolicy != nil {
		if !bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy) {
			return fmt.Errorf("Instantiation policy mismatch for cc %s", cd.ChaincodeID())
		}
	}

	return nil
}

func (lscc *SCC) ChaincodeEndorsementInfo(channelID, chaincodeName string, qe ledger.SimpleQueryExecutor) (*lifecycle.ChaincodeEndorsementInfo, error) {
	chaincodeDataBytes, err := qe.GetState("lscc", chaincodeName)
	if err != nil {
		return nil, errors.Wrapf(err, "could not retrieve state for chaincode %s", chaincodeName)
	}

	if chaincodeDataBytes == nil {
		return nil, errors.Errorf("chaincode %s not found", chaincodeName)
	}

	chaincodeData := &ccprovider.ChaincodeData{}
	err = proto.Unmarshal(chaincodeDataBytes, chaincodeData)

View on GitHub (pinned to 2736b63f8f)

Solutions

Re-deploy the chaincode so the package and the lscc definition carry the identical instantiation policy
If the definition changed intentionally, upgrade the chaincode so fsData is refreshed to match
Compare the policy bytes on disk vs the definition to find the mismatch (signature policy vs policy byte differences)
Remove stale legacy chaincode packages and reinstall/redefine cleanly

Defensive patterns

Strategy: validation

Validate before calling

// Go: compare stored instantiation policies before calling endorsement info
fsData, err := ccprovider.GetChaincodeDataFromLscc(fsName)
if err != nil { return err }
cd, err := ccprovider.GetChaincodeDefinition(channelID, chaincodeName, qe)
if err != nil { return err }
if fsData.InstantiationPolicy != nil && !bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy()) {
    return fmt.Errorf("policies differ for %s; redeploy/upgrade required", chaincodeName)
}

Try / catch

// Go
_, err := lscc.ChaincodeEndorsementInfo(channelID, chaincodeName, qe)
if err != nil {
    if strings.Contains(err.Error(), "Instantiation policy mismatch") {
        return fmt.Errorf("chaincode %s package/definition policy out of sync; upgrade the chaincode", chaincodeName)
    }
    return err
}

Prevention

Never change a chaincode's instantiation policy without a full upgrade/redeploy
Clean up stale legacy (filesystem) chaincode packages after upgrades
Keep installed package metadata and lscc definitions in sync
Audit policy bytes on disk vs ledger when migrating legacy chaincodes

When it happens

Trigger: Calling ChaincodeEndorsementInfo for a legacy chaincode where bytes.Equal(fsData.InstantiationPolicy, cd.InstantiationPolicy) is false — the packaged chaincode on disk was deployed under a different instantiation policy than the current lscc definition.

Common situations: Re-deploying/re-installing a chaincode with a modified instantiation policy after an upgrade; stale filesystem chaincode packages left from a previous deploy; environment changes where the definition in lscc was updated but the old package (or vice versa) persists.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9c503f7a5524ac1f. Report an issue: GitHub.