Are pure functions and events verifiable/guaranteed

Question

I am very new to solidity so please forgive me if I'm mistaken, but it seems that pure and view functions are not really run on chain if I access them with web3 (but they are if I access within a smart contract), instead the node I connect to will run the function for me and return a result.

Logically, this seems cause an issue: what if the node simply does the wrong computation, e.g. just return 0 because why should they spend resources for me? Events seem to have the same problem, since they too seem to rely on a centralized node doing something within spec that doesn't actually benefit the node provider.

Is my understanding correct for calling view/pure from web3? How does this work with calls from solidity? In those cases is the computation guaranteed to run the code in the pure function correctly?

Answer 1

Just to get some definitions out of the way:

View Functions -- "Functions can be declared view in which case they promise not to modify the state."

Pure Functions -- "Functions can be declared pure in which case they promise not to read from or modify the state."

The important part here is that these functions types will not modify the state. Because they don't modify the state, there is no reason to run calls to these functions on the blockchain (for example, from web3).

---

what if the node simply does the wrong computation

With any innocent node, your code will be run as if it were run on the chain, but just by the one node (instead of broadcasting as a transaction, it will run locally only).

It is somewhat possible there would be a malicious node that returns incorrect answers, but at that point, the question would be why you are asking that node for information in the first place. If you are hosting the node yourself, calls to view/pure functions will be run locally (on your own node) -- They will be correct as far as your node is synced up with the rest of the network. If you are using a service (like infura), your calls will be run against their node, and you are assuming they are acting honestly.

---

How does this work with calls from solidity? In those cases is the computation guaranteed to run the code in the pure function correctly?

If I understand the question, you are asking about function calls from within an actual transaction. In this case, the calls are being run "on the chain". All this means is that each node participating in the mining process is running all the transactions in order to find a block. Any attempt to change data (e.g. return incorrect answers from view/pure functions) would invalidate the block, and the network wouldn't accept it as a valid block. So you can trust that the transactions are being run correctly -- any tampering would only hurt the miner because they would miss out on any rewards they would have claimed from mining a valid block.

---

One side I note I thought I should mention is that the difference between calling view functions from web3 and calling them in actual transactions is that the state of the chain will have changed based one the transactions appearing above your transaction in a given block. These may or may not affect the result given on the chain.

This is not an issue for pure functions because they do not even read the state in order to execute.

Answer 2

The broader question that you are asking is How can I trust a foreign node with the information that it gives me, such as the result of a web3 call?

The issue you are raising is not specific to pure and view functions.

If you are calling your own local node, then you can trust that the answer it gives is correct since you did not modify the original open sourced code from which your node is compiled. The node should make sure that the state of the blockchain that it has is valid.

If you are calling a foreign node operated by a third-party, such as a RPC provider like Infura, you cannot be sure that the information you receive is valid. In fact, since you are simply making RPC requests to that operator, a malicious operator could return any information it wants without even querying a node.

If you want absolute security, you must run your own node.