I am having an ERC721 contract (implementation). I want to run a script on a remote system (e.g. a docker container hosted in the cloud) that calls a function which writes to the contract and has the following modifier:

modifier onlyOwner() {
  require(owner() == _msgSender(), "Ownable: caller is not the owner");

The current owners private key which was also used initially for signing the contract deployment transaction resides somewhere else already (so it is not present on the remote system).

Current solution

The only solution I found so far is to build and sign the transactions on the owners machine where the private key resides. Instead of sending the raw transactions I am going to transfer them to the remote system where they can be sent whenever the script wants to.


So now I wonder, are there any problems (e.g. security) with my current solution? For example, does any information get leaked that shouldn't or is this already the best practice for my problem's requirements?

1 Answer 1


First, please use a hot wallet and a cold wallet.

The very first ERC-721 NFT implements this approach and and I included it as a demonstration of a best practice you should use. (P.S., the first ERC-721s are still for sale 😀).

Please see the recently open sourced: https://github.com/su-squares/ethereum-contract

Specifically: https://github.com/su-squares/ethereum-contract/blob/master/contracts/AccessControl.sol

In this model, your contract "owner" ("CEO") would be a cold wallet THAT YOU KEEP OFFLINE.

And the operational transaction signing would be performed using a different account ("COO").

Now you run that separate account, with the live private key on your server and you sign the transactions when needed.

And let's get you a quick diagram:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.