What causes "no policies in config block" in hyperledger/fabric?

Regenerate the genesis block with a configtx.yaml profile that defines Orderer: -> Policies (including BlockValidation).

hyperledger/fabric · error

no policies in config block

Error message

no policies in config block

What it means

When constructing the block signature verifier from a config block, the code fetches the BlockValidation policy from the bundle's policy manager. If the policy does not exist, the returned verifier always fails with this error, because blocks cannot be validated without it.

Source

Thrown at orderer/common/cluster/util.go:399

	for _, endpoint := range bundle.ChannelConfig().OrdererAddresses() {
		globalEndpoints = append(globalEndpoints, EndpointCriteria{
			Endpoint:   endpoint,
			TLSRootCAs: aggregatedTLSCerts,
		})
	}
	return globalEndpoints
}

func BlockVerifierBuilder(bccsp bccsp.BCCSP) func(block *common.Block) protoutil.BlockVerifierFunc {
	return func(block *common.Block) protoutil.BlockVerifierFunc {
		bundle, failed := bundleFromConfigBlock(block, bccsp)
		if failed != nil {
			return failed
		}

		policy, exists := bundle.PolicyManager().GetPolicy(policies.BlockValidation)
		if !exists {
			return createErrorFunc(errors.New("no policies in config block"))
		}

		bftEnabled := bundle.ChannelConfig().Capabilities().ConsensusTypeBFT()

		var consenters []*common.Consenter
		if bftEnabled {
			cfg, ok := bundle.OrdererConfig()
			if !ok {
				return createErrorFunc(errors.New("no orderer section in config block"))
			}
			consenters = cfg.Consenters()
		}

		return protoutil.BlockSignatureVerifier(bftEnabled, consenters, policy)
	}
}

func bundleFromConfigBlock(block *common.Block, bccsp bccsp.BCCSP) (*channelconfig.Bundle, protoutil.BlockVerifierFunc) {

View on GitHub (pinned to 2736b63f8f)

Solutions

Regenerate the genesis block with a configtx.yaml profile that defines Orderer: -> Policies (including BlockValidation).
Use the standard fabric sampleconfig policies as a template for the missing policy entries.
Verify the block is a genuine config block of the target channel, not one from an incompatible network.
Perform a config update adding the missing policy if the channel is already live.

Example fix

// configtx.yaml before: Orderer group has no Policies
// after:
// Orderer:
//   Policies:
//     Readers:
//     Writers:
//     Admins:
//     BlockValidation:
//       Type: ImplicitMeta
//       Rule: "MAJORITY Writers"

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the genesis profile defines policies
// configtx.yaml must contain Orderer.Policies incl. BlockValidation
if profile.Orderer.Policies == nil || profile.Orderer.Policies.BlockValidation == nil {
    return errors.New("profile missing Orderer BlockValidation policy")
}

Prevention

Always start from the fabric sampleconfig policies section.
Run configtxgen and inspect output with configtxlator decode before channel creation.
Never delete Policies entries during config updates.

When it happens

Trigger: Verifying blocks for a channel whose config block lacks the /Channel/Orderer/BlockValidation policy (or the policies subtree in general), e.g. a hand-crafted or non-standard genesis block used as the cluster verifier source.

Common situations: Genesis blocks generated by old or custom tooling without the standard policies section, config blocks from networks where Policies: was omitted from the Orderer group in configtx.yaml.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/df18c9811ef0379e. Report an issue: GitHub.