I'm developing a game on top of Ethereum which combines NFT's and some cool RPG gameplay dynamics. My doubt is that, for as far as I know, every function in the contract can be called from outside from anyone.

That makes me wonder, for instance my game is planned to reward players by giving them NFT's if they do some in-game stuff, like quests or fights. The function I thought it could look like this:

function rewardPlayer(address memory newOwner,string memory tokenURI){

Obviously, my biggest concern is that someone could come and call this method giving its own address, awarding himself with rewards.

So, I need a manner to avoid this. I thought of generating a encrypted key which only allows to be executed with it, but, how does Solidity decrypt keys? Is it even possible? Is it any better way?

Thanks in advance :)

  • Everything on the blockchain is public, if you use a secret be aware that once a transaction is public anyone can front run them when they reach the pending pool. I'd ask myself who will call rewardPlayer ?, which conditions has to be satisfied to earn a reward?
    – Ismael
    Aug 25, 2021 at 4:16
  • @Ismael Hey Ismael thanks for answering, I thought in some ideas to fix this some are complex but could work, but also I thought of using a secret key which will be set to a private variable to the contract and then each "protected function" would need the key in order to work. When you say it can be front run what do you mean? You mean that someone can take the transaction and see the data u sending? With the key into it? Aug 25, 2021 at 7:28
  • There's no such things as private variables in the EVM, all data is public, with a full node you could use getStorageAt to read any data from a contract ethereum.stackexchange.com/questions/5865/…. Yes, front run is taking a transaction from the pending pool and sending from a different account with higher gas price so it will mine faster.
    – Ismael
    Aug 25, 2021 at 14:40
  • @Ismael I see, then I will quit the idea of the key, I was thinking another alternatives like relating user address to quest Id for instance and dont let anyone other than that user to do the action, what do you think about? Aug 25, 2021 at 19:38
  • That's a possible design, storing level per user so they can obtain the rewards after achieving certain level.
    – Ismael
    Aug 26, 2021 at 2:53

1 Answer 1


Id make the function callable by one wallet only (using onlyOwner for example), and handle the rest of the logic to figure out what the parameters should be on the website directly. The drawback is that you'd have to pay the gas fees yourself.

  • There should be another way =/ Aug 23, 2021 at 10:36
  • Cant think of any other besides putting all your game logic on chain, which would be a VERY bad idea
    – Foxxxey
    Aug 23, 2021 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.