Suppose we have a smart contract that has one variable: url, and a updateURL function to update that url that only the owner can access.

Suppose that, for the purposes of the contract, the url should only point to images. Most sites end with a file extension (eg, site.com/image.png), but not all, so in order to validate that the url is valid, some server-side validation has to be done.

Essentially, the idea is that any user can access the frontend and send a request to the server and verify that it's a valid URL, and if it's valid, the contract will update the url (suppose the server has access to the contract owner's wallet).

This is where the dilemma comes into play; if anyone can modify the url, they can have it point to invalid sites. But if we restrict it to just the owner, how can a user update the url?

One option is to have two transactions; one where the user submits a request to update the url, and the server listens to those requests, processes the data, and updates the contract if it's valid.

The issue with this is that it requires two transactions, and costs gas for both the user and the owner of the contract.

Is there a way for the owner to complete the user's transaction on their behalf, with only the user paying gas? Eg, the user calls the server, if it's a valid url it generates the transaction, asks the user to pay for the gas, and then the owner ends up signing the transaction so it can access updateURL

2 Answers 2


Maybe you need another function that’s public, that requires some conditions be met, that then executes the update url

Otherwise, look into access control on oz

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Nov 26, 2021 at 10:35
  1. Have the user submit an API request to the server with the new URL.
  2. Server validates the new URL and generates a signature using the owner wallet.
  3. The user invokes the contract function updateURL(URL, signature)
  4. The contract validates that the signature was generated using the owner wallet and updates the URL.
  5. You may also want to protect against replay attacks, but that's a different question.

All gas fees were paid by the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.