Retrieving address of contract owner and making call to all smart contract methods

Question

guys need some help related to enforcing security more on the lines of authentication in my smart contract.

So I have a smart contract that has an owner as the deployers address. This owner will be able to call any of the methods in the smart contract using the web3 library. My question is what if some malicious user is able to identify the owner's address and in turn, he can substitute his own address with the owner's address and make the method calls using the same web3 library. The methods are very critical in nature as they transfer funds. I do understand that only the owner can call certain methods but in this case, the attacker knows the owner's address.

How do I make sure my methods are protected against this user what kind of security mechanism do I need to implement for my smart contract? Or is there a piece of the puzzle I am missing?

Answer 1

The contract owner address is msg.sender. msg.sender is as secure as elliptic curve cryptography. Ethereum uses the same curve and key size as Bitcoin. Everyone knows msg.sender but only possession of the private key will allow someone to sign a transaction as that msg.sender. So, in short even if someone knows the address, they won't have the private key.

A transaction actually doesn't contain a sender. The address of the sender is derived from the signature on the transaction.

If you look at token contracts, you'll see they usually use a mapping of balances where the key is msg.sender.