0

from my backend, I want to call the following onlyOwner function from my deployed smart contract:

function isValid(address _address)
        public
        view
        onlyOwner
        returns (bool){
        // ... validating and returning bool
    }

I implemented a working solution on my backend, where I add the contract owner's private key temporarily to the wallet like so:

// prepare wallet before calling onlyOwner function
web3.eth.accounts.wallet.add(OWNER_PRIVATE_KEY);
const account = web3.eth.accounts.wallet[0].address;

// create contract instance and call onlyOwner function
let contract = new web3.eth.Contract(abi, CONTRACT_ADDRESS);
const isValid = await contract.methods
          .isValid(address)
          .call({ from: account });

Now, cause the private key, is the most sensitive data, i'm wondering, is this a good practice of calling the onlyOwner function or is there a better way of calling a onlyOwner function? My fear is, that some exception could be thrown and is revealing the private key or something. Again the whole code is running on a backend, so nothing to exploit on client side, but I think you understand my fear.

Maybe important to mention, this function could be called 100 times a second, but because it's a read only function and no transactions, from my knowledge right now, this should be no problem, right?

Would be great, if someone give me feedback on this.

2
  • onlyOwner is a function modifier not a function. Commented Feb 7, 2022 at 9:08
  • I know that, but I wanted to highlight it in the text. Should I make it bold instead of code style? I made an edit
    – Yetispapa
    Commented Feb 7, 2022 at 9:11

1 Answer 1

1

This should be fine as long as you make sure your private key doesn't leak anyway to the front-end. But I'm not sure why you'd need a onlyOwner modifier for a view function. Even though the function contains a modifier, anyone can look up the state of the contract (for example using eth_getStorageAt) and compute the response isValid function might return. The modifier is primarily used to restrict write operations on the contract as anyone can technically perform read by looking at the contract state.

8
  • I didn't know that. I thought onlyOwner is also valid for view functions. Is it easy to bypass this by using eth_getStorageAt? I used the isValid function as a extra security step, so this would be actually important.
    – Yetispapa
    Commented Feb 7, 2022 at 9:49
  • 1
    A view function just lets you read the contract state. With onlyOwner other contracts can't read the state if that's what you are looking for. But it can be read off-chain using eth_getStorageAt.
    – pbsh
    Commented Feb 7, 2022 at 10:19
  • Understand. Thanks for this letting me know about eth_getStorageAt. I will take a look, how this function works. Just one last question, which is a bit off hand from the origin question I posted, but maybe you can quickly help me here.
    – Yetispapa
    Commented Feb 7, 2022 at 10:34
  • As I said the isValid function is like a secuirty step, but only temporarily. So would I remove the ownerOnly modified, how easy or even possible is it for someone to know that the isValid function exists / what is does / structure of function, when the contract is not verified / visible on etherscan? So my Plan B would be, to verify the contract after this temporarly phase, so that the code is not visible for everyone. Does this make sense as a plan b in security?
    – Yetispapa
    Commented Feb 7, 2022 at 10:35
  • Can you explain what kind of security you are trying to implement? I can try to suggest good patterns accordingly?
    – pbsh
    Commented Feb 7, 2022 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.