validation of endorsement policy for chaincode %s in tx %d:%

Error message

validation of endorsement policy for chaincode %s in tx %d:%d failed

What it means

In v20.go's CheckCCEPIfNotChecked, when there is no collection-level policy for the namespace, the chaincode-level endorsement policy (p.ccEP) is evaluated against the endorsement signature set; failure is wrapped with this error, invalidating the transaction.

Source

Thrown at core/common/validation/statebased/v20.go:141

				return policyErr(errors.Wrapf(err, "validation of endorsement policy for collection %s chaincode %s in tx %d:%d failed", coll, cc, blockNum, txNum))
			}

			p.nsEPChecked[coll] = true
			p.someEPChecked = true
			return nil
		}
	}

	// we're here either because we're not in a collection or because there was
	// no endorsement policy for that collection - we turn to the chaincode EP
	if p.nsEPChecked[""] {
		return nil
	}

	// evaluate the cc EP
	err := p.policySupport.Evaluate(p.ccEP, sd)
	if err != nil {
		return policyErr(errors.Wrapf(err, "validation of endorsement policy for chaincode %s in tx %d:%d failed", cc, blockNum, txNum))
	}

	p.nsEPChecked[""] = true
	p.someEPChecked = true
	return nil
}

func (p *policyCheckerV20) CheckCCEPIfNoEPChecked(cc string, blockNum, txNum uint64, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	if p.someEPChecked {
		return nil
	}

	// validate against cc ep
	err := p.policySupport.Evaluate(p.ccEP, sd)
	if err != nil {
		return policyErr(errors.Wrapf(err, "validation of endorsement policy for chaincode %s in tx %d:%d failed", cc, blockNum, txNum))
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

Refresh service discovery / chaincode policy info and re-collect endorsements per the current CC EP
Include signatures from every org/principal the endorsement policy requires
Check peer MSP configuration includes all endorsing organizations
Re-endorse after any lifecycle (approve/commit) policy change

Defensive patterns

Strategy: validation

Validate before calling

ok, err := policyManager.Evaluate(signatureSet)
if err != nil || !ok { return errors.New("CC EP not satisfied for namespace") }

Prevention

Query the committed CC endorsement policy before endorsing
Include all orgs required by the policy in the endorsement set
Keep peer channel MSP configuration up to date

When it happens

Trigger: Validating a transaction whose rwset touches a namespace with no collection EP, where the signature set does not satisfy the chaincode endorsement policy at blockNum:txNum.

Common situations: Not enough/mismatched org signatures for the CC EP; CC EP updated via lifecycle while client uses stale discovery results; missing MSP config so an endorsement is unverifiable.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5d1da8d126a89715. Report an issue: GitHub.