hyperledger/fabric · error · VSCCEndorsementPolicyError

LSCC can only issue one or two putState upon deploy

Error message

LSCC can only issue one or two putState upon deploy

What it means

validateRWSetAndCollection found the LSCC write-set for a deploy/upgrade contains more than two writes. LSCC may only write the chaincode data key and (optionally) the collections key, so extra writes indicate a tampered or malformed transaction.

Source

Thrown at core/handlers/validation/builtin/v12/validation_logic.go:375

}

// validateRWSetAndCollection performs validation of the rwset
// of an LSCC deploy operation and then it validates any collection
// configuration.
func (vscc *Validator) validateRWSetAndCollection(
	lsccrwset *kvrwset.KVRWSet,
	cdRWSet *ccprovider.ChaincodeData,
	lsccArgs [][]byte,
	lsccFunc string,
	ac vc.Capabilities,
	channelName string,
) commonerrors.TxValidationError {
	/********************************************/
	/* security check 0.a - validation of rwset */
	/********************************************/
	// there can only be one or two writes
	if len(lsccrwset.Writes) > 2 {
		return policyErr(fmt.Errorf("LSCC can only issue one or two putState upon deploy"))
	}

	/**********************************************************/
	/* security check 0.b - validation of the collection data */
	/**********************************************************/
	var collectionsConfigArg []byte
	if len(lsccArgs) > 5 {
		collectionsConfigArg = lsccArgs[5]
	}

	var collectionsConfigLedger []byte
	if len(lsccrwset.Writes) == 2 {
		key := privdata.BuildCollectionKVSKey(cdRWSet.Name)
		if lsccrwset.Writes[1].Key != key {
			return policyErr(fmt.Errorf("invalid key for the collection of chaincode %s:%s; expected '%s', received '%s'",
				cdRWSet.Name, cdRWSet.Version, key, lsccrwset.Writes[1].Key))
		}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the deploy/upgrade transaction writes only the CD and collection keys via LSCC
2. Reject the transaction — extra writes fail validation at commit

When it happens

Trigger: Thrown at core/handlers/validation/builtin/v12/validation_logic.go:375 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d69e46b8252b6007. Report an issue: GitHub.