1

So let's say your user sends a transaction, your script gets the receipt (getTransactionReceipt), checks if everything is fine and then does something. Can't people just rewrite your scripts in developer console and send fake data?

For example: Bob needs to pay 1 ETH. Can't he just fake his address (of someone who already paid you the same amount) or use someone's transaction id or maybe when at the end your JS sends data to your server to recheck the transaction he could send fake address/transaction id?

Improve this question
1
  • I have the same root question, different use case. I want my user to be able to link his/her account on my site with their wallet. However, what is to stop them from manipulating the JS that gets their wallet addr and sends it to the server.
    – gunygoogoo
    Jan 14, 2022 at 0:50

1 Answer 1

Reset to default
0

A user will be able to fake their public address for read only purposes (see impersonator) but will never be able to fake a signature for a message or transaction.

I'm not actually sure what your use-case is, but you can safely bind an address to a certain user through a simple utility involving asymmetric encryption. If you have a frontend + backend architecture and you need to be sure the user has access to a certain address (public key), ask them to sign a message (frontend). The decryption of this message (backend) will succeed only if the user has access to the private key of that account, hence owns it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.