I am working on a dApp that grabs json info based on the logged in metamask user. That info is passed on to my contract to allow the mint function to execute based on the value.
So for example if the info value is 30, that gets sent to the mint function and based on the number 30, it executes the mint function a certain way. -
function mint(uint256 amount, uint256 variable) public payable { }
My question is about security. How can I prevent people from using their own dApps or such, to execute my mint function with their own variable?
The problem is that the variable is important and needed so I do not want others to somehow pass their own variables to the mint function. I understand they can mint directly from etherscan but without my dApp the variable would basically be null and they wouldn't be able to mint without it.
How can I protect my smart contract function from being used by any other dApps or js projects other than my own? I want other people to be able to mint on my dApp so using my private keys doesn't seem like the right choice. Possibly like checking the url for the call inside the smart contract?
EDIT: To clarify further - I am looking for a way that my contract can check where the function call came from. If it didnt come from my site then it should fail. I am thinking something like cryptography/signing? Similar to off chain whitelists? Is it possible to use hashing or encryption sent from the dApp to the smart contract that controls access to the function thus removing the ability to use the function directly from etherscan?
struct verifyOrigin {
bytes32 r;
bytes32 s;
uint8 v;
}
enum verifyType {
Sig
}
bytes32 digest = keccak256(
abi.encode(verifyType.Verified, msg.sender)
);
require(
_isVerified(digest, verifyOrigin),
'Invalid'
);