Make Smart Contract Only Accessible from a Web App

Question

I have got a Solidity smart contract which only interacts with a React front-end using web3. I want to restrict access to the smart contract so that only the React front-end can access the smart contract. This should prevent other contracts or dapps being able to call the contract. How can this be done?

Answer 1

These kinds of things are fundamentally impossible. Front-end code by definition is running on the user's machine. The user controls their machine, so they control the front-end.

Imagine a hypothetical solution to your problem: The user could just right-click your front-end, choose Inspect Element and replace your front-end code with their own. So it's necessarily impossible.

You can actually prevent another smart contract from calling your smart contract. In general this is bad practice, but you can do it like this:

modifier noCallByContract()
{
    uint32 size;
    assembly { size := extcodesize(caller) }
    require(size == 0);
    _;
}

Answer 2

This cannot be done, as Ethereum is an open, public network.

There are things to be done that will prevent other contracts interacting with it, such as making functions internally callable, but in doing so you will remove the ability for your Dapp to interact with it.

What it sounds like you are looking for is either a traditional database or a private chain that only you have access to.

Answer 3

For now, it is impossible. You can only prevent another DApp or contract from accessing your functions and variable, not your contract.