How to calculate the code hash for fn authorize_upgrade of cumulus_pallet_parachain_system?

As per crate substrate-runtime-proposal-hash been trying BLAKE2B32(0x0103 | BLAKE2B32(wasm_bytes)) with no luck, i.e. Error::Unauthorized.

  • Why are you trying to calculate the hash and not call the function directly? May 5, 2022 at 11:32
  • @joepetrowski I need the hash as func input authorize_upgrade to kickoff the upgrade.
    – user1813
    May 6, 2022 at 9:12
  • How are you kicking off the upgrade? That is likely the problem, not authorize_upgrade. May 7, 2022 at 6:01
  • 1. npx @polkadot/api-cli@beta --ws $provider --sudo --seed "$phrase" tx.parachainSystem.authorizeUpgrade $hash; 2. npx @polkadot/api-cli@beta --ws $provider --sudo --seed "$phrase" --params $wasm tx.parachainSystem.enactAuthorizedUpgrade; with $hash=0xdeadbeef..? and $wasm=./path/to/export-genesis-wasm-output
    – user1813
    May 8, 2022 at 8:29

1 Answer 1


OK, I see what you are trying to do. You don't need the hash of the authorize_upgrade call, you need it encoded and wrapped with sudo. Then, anyone (i.e. not just sudo) can submit enact_authorized_upgrade as an unsigned transaction.

You are getting the Unauthorized error because in sudo you are only providing the hash of the call, not authorize_upgrade(<code_hash>).

Here's your solution (with examples taken from the latest Statemint upgrade):

First, you need the authorize_upgrade call data, not call hash:


As in, you want: 0x01023ef62993199d2253ec1f49508e4cff7e6d293555e405ab024a0c87db5c5008c0

Now you need to submit this as sudo. Statemint doesn't have sudo, so you can't copy this exactly, but it would be like:

npx @polkadot/api-cli@beta --ws $provider --sudo --seed "$phrase" tx.parachainSystem.authorizeUpgrade "0x01023ef62993199d2253ec1f49508e4cff7e6d293555e405ab024a0c87db5c5008c0"

If this is successful, you will see an UpgradeAuthorized(code_hash) event on the parachain.

Now that it's authorized, you can do the enact_authorized_upgrade part. Again, you do not need sudo for this.


I'm not super familiar with the CLI you are using, but you want to submit this as an unsigned transaction. In the screenshot, that would be the "Submit Unsigned" button.

If that is successful, you will see a ValidationFunctionStored event. Note that depending on your Relay Chain configuration (config.validation_upgrade_delay), the upgrade won't take place right away, but after the number of Relay Chain blocks in the config.

  • Thanks for your detailed answer! Unfortunately, still stuck at the original question as the call data is just a derivative of the code hash - how did you calculate it?
    – user1813
    May 9, 2022 at 9:37
  • Here's the PR that added the ability to the UI: github.com/polkadot-js/apps/pull/5226 I'd consider adding it to the output of your builds, though. SrTool for example gives you the blake256 hash when it builds the runtime. May 9, 2022 at 14:49
  • Also added a feature request for the CLI: github.com/polkadot-js/tools/issues/376 May 9, 2022 at 14:55
  • Thanks a ton for your profound support and follow-up. Really appreciate the srtool hint and tools PR <3
    – user1813
    May 9, 2022 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.