validation of endorsement policy for chaincode %s in tx %d:%

Error message

validation of endorsement policy for chaincode %s in tx %d:%d failed

What it means

In state-based (key-level) endorsement validation (v1.3 validator), checkCCEPIfCondition evaluates the chaincode endorsement policy against the transaction's endorsement signature set via policySupport.Evaluate. When the signatures don't satisfy the chaincode-level endorsement policy it wraps the error with this message and flags it as a policy error (tx marked invalid).

Source

Thrown at core/common/validation/statebased/v13.go:61

/**********************************************************************************************************/
/**********************************************************************************************************/

type policyCheckerV13 struct {
	someEPChecked bool
	ccEPChecked   bool
	policySupport validation.PolicyEvaluator
	ccEP          []byte
}

func (p *policyCheckerV13) checkCCEPIfCondition(cc string, blockNum, txNum uint64, condition bool, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	if condition {
		return nil
	}

	// validate against cc ep
	err := p.policySupport.Evaluate(p.ccEP, sd)
	if err != nil {
		return policyErr(errors.Wrapf(err, "validation of endorsement policy for chaincode %s in tx %d:%d failed", cc, blockNum, txNum))
	}

	p.ccEPChecked = true
	p.someEPChecked = true
	return nil
}

func (p *policyCheckerV13) CheckCCEPIfNotChecked(cc, coll string, blockNum, txNum uint64, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	return p.checkCCEPIfCondition(cc, blockNum, txNum, p.ccEPChecked, sd)
}

func (p *policyCheckerV13) CheckCCEPIfNoEPChecked(cc string, blockNum, txNum uint64, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	return p.checkCCEPIfCondition(cc, blockNum, txNum, p.someEPChecked, sd)
}

func (p *policyCheckerV13) SBEPChecked() {
	p.someEPChecked = true
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Collect endorsements satisfying the current chaincode endorsement policy (check `peer chaincode list` / policy definition)
Re-endorse the transaction after any endorsement-policy update
Ensure all endorsing orgs' MSPs are configured on the peer validating the tx
Verify endorsers are running the same chaincode version as required

Defensive patterns

Strategy: validation

Validate before calling

ok, err := policyManager.Evaluate(signatureSet)
if err != nil || !ok { return errors.New("signatures do not satisfy CC endorsement policy") }

Try / catch

err := validator.Validate(block, policy)
var perr *validationpolicy.Error
if errors.As(err, &perr) && strings.Contains(perr.Error(), "validation of endorsement policy for chaincode") {
	// tx will be marked invalid: re-endorse with required orgs
}

Prevention

Refresh discovery results before each endorsement round
Re-endorse immediately after any CC endorsement policy update
Ensure peer MSPs contain all endorsing organizations

When it happens

Trigger: CheckCCEPIfNotChecked/CheckCCEPIfNoEPChecked called during tx validation where the endorsement signature set fails the chaincode's endorsement policy (p.ccEP) for the given block/tx number.

Common situations: Endorsements collected from peers that don't satisfy the CC endorsement policy; endorsement policy changed via lifecycle after endorsements were collected; a new endorsing org's signature missing after policy update; peers with outdated CC or MSP missing the endorsing org.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/fd0f396ed1c7e647. Report an issue: GitHub.