0

guys need some help related to enforcing security more on the lines of authentication in my smart contract.

So I have a smart contract that has an owner as the deployers address. This owner will be able to call any of the methods in the smart contract using the web3 library. My question is what if some malicious user is able to identify the owner's address and in turn, he can substitute his own address with the owner's address and make the method calls using the same web3 library. The methods are very critical in nature as they transfer funds. I do understand that only the owner can call certain methods but in this case, the attacker knows the owner's address.

How do I make sure my methods are protected against this user what kind of security mechanism do I need to implement for my smart contract? Or is there a piece of the puzzle I am missing?

1 Answer 1

1

The contract owner address is msg.sender. msg.sender is as secure as elliptic curve cryptography. Ethereum uses the same curve and key size as Bitcoin. Everyone knows msg.sender but only possession of the private key will allow someone to sign a transaction as that msg.sender. So, in short even if someone knows the address, they won't have the private key.

A transaction actually doesn't contain a sender. The address of the sender is derived from the signature on the transaction.

If you look at token contracts, you'll see they usually use a mapping of balances where the key is msg.sender.

2
  • Ahh!! I got your point. So even if the user knows the deployer's address he won't be able to do anything since a call to any smart contract method(basically a transaction) will be signed irrespective of him making an rpc call or a call via web3. And since transactions are signed they are secured by their private key. Oct 20, 2021 at 11:59
  • yes you are right. We need a key to sign transactions
    – mzaidi
    Oct 20, 2021 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.