I know exposing personal over rpc is vulnerable. But is there any way I can make exposure of personal over rpc safe?
Let me state my requirement. I have deployed a cryptocurrency. Now I want to expose it's functions as api.
But for that I have to expose personal over rpc to carry out transactions. For eg. to perform transfer
, I can write following code:
function transferCoin(to, amount,frm, passphrase){
web3.personal.unlockAccount(frm,passphrase);
var tx=contract1.transfer(to, amount, {from: frm});
}
Problem:
But if someone can connect to my node then he can misuse personal and empty my account.
Edit:
As I was writing the question I realised that it's not only about personal but it's rpc that is insecure. For example let's consider a case where personal is not exposed over rpc. But, if someone can connect to my node via rpc, they can execute a function like:
function EtherTransfer(){
while(true){
//console.log("hello");
web3.eth.sendTransaction({from:"addr1", to:"addr2", value: web3.toWei(100,"ether")});
}
};
and carry all my ethers.
So is there any solution to the problem. As I stated in my requirement I need to expose personal over rpc in order to provide api's of my contract functions to my other application.