hyperledger/fabric · error

No instantiation policy was specified

Error message

No instantiation policy was specified

What it means

Returned by ValidateLSCCInvocation (security check 4) during upgrade when the existing ledger chaincode data carries no instantiation policy to evaluate the upgrade signature against. Without a stored policy, upgrade authorization cannot be verified.

Source

Thrown at core/handlers/validation/builtin/v13/lscc_validation_logic.go:570

			if ac.V1_2Validation() {
				// do extra validation for collections
				err := vscc.validateRWSetAndCollection(lsccrwset, cdRWSet, lsccArgs, lsccFunc, ac, chid)
				if err != nil {
					return err
				}
			} else {
				// there can only be a single ledger write
				if len(lsccrwset.Writes) != 1 {
					return policyErr(fmt.Errorf("LSCC can only issue a single putState upon upgrade"))
				}
			}

			/*****************************************************/
			/* security check 4 - check the instantiation policy */
			/*****************************************************/
			pol := cdLedger.InstantiationPolicy
			if pol == nil {
				return policyErr(fmt.Errorf("No instantiation policy was specified"))
			}
			// FIXME: could we actually pull the cds package from the
			// file system to verify whether the policy that is specified
			// here is the same as the one on disk?
			// PROS: we prevent attacks where the policy is replaced
			// CONS: this would be a point of non-determinism
			err := vscc.checkInstantiationPolicy(chid, env, pol, payl)
			if err != nil {
				return err
			}

			/******************************************************************/
			/* security check 5 - check the instantiation policy in the rwset */
			/******************************************************************/
			if ac.V1_1Validation() {
				polNew := cdRWSet.InstantiationPolicy
				if polNew == nil {
					return policyErr(fmt.Errorf("No instantiation policy was specified"))

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Include a valid instantiation policy in the upgrade transaction
2. Default it to the channel's instantiation policy when unspecified

When it happens

Trigger: Thrown at core/handlers/validation/builtin/v13/lscc_validation_logic.go:570 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/8ed0f2308070e807. Report an issue: GitHub.